Lighting Control Device Direct Network Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing lighting control systems experience noticeable delays in controlling multiple lighting loads due to the complexity and time-consuming process of establishing a secure communications tunnel, leading to perceptible delays between issuing control commands and their implementation across multiple devices.
Innovation Solution
Implementing a method where command messages are transmitted directly between a lighting control device and multiple lighting devices over a local computer network, using encrypted messages with an incremented sequence number to authenticate authorized commands and prevent replay attacks, allowing for simultaneous control without routing through a remote cloud service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If control commands are routed through a remote cloud service to verify senders and recipients, then security is improved, but noticeable delays occur between issuing control commands and their implementation
Solution Approach 1:
The system performs preliminary authentication during an initial setup phase where a secure communications tunnel is established between the lighting control device and lighting loads. Authentication credentials including sequence numbers are pre-shared through the cloud service. Once established, subsequent control commands can be transmitted directly through the local network without repeated cloud routing, eliminating operational delays while maintaining security.
2Speed
If a direct secure communications tunnel is established between control device and lighting loads, then transmission speed is improved, but the tunnel establishment process is complex and time consuming
Solution Approach 1:
The complex tunnel establishment and authentication process is performed once during initial system setup. The cloud service facilitates this preliminary action by enabling devices to exchange cryptographic credentials and establish trusted relationships. After this one-time setup, the secure communication path is already in place, allowing fast direct command transmission without repeating the complex establishment process.
Solution Approach 2:
The cloud service acts as an intermediary during the initial setup phase to facilitate secure credential exchange between the lighting control device and lighting loads. It enables devices to authenticate each other and establish shared secrets without requiring direct peer-to-peer negotiation. Once the intermediary has facilitated the initial trust relationship, subsequent communications occur directly between devices without needing the cloud intermediary.
3Reliability
If sequence numbers are used to authenticate commands and prevent replay attacks, then security is improved, but additional processing steps are required at each device
Solution Approach 1:
The system uses sequence numbers as a simple numerical parameter that changes with each command. Each lighting control device maintains a stored sequence number and compares it against sequence numbers in received commands. This simple numerical comparison provides robust security against replay attacks while requiring minimal processing logic at each device, avoiding complex cryptographic operations during normal operation.
Data Source
AI summary
Techniques for securely controlling multiple lighting devices simultaneously with a lighting control device are disclosed. Command messages may be transmitted from the lighting control device to multiple lighting devices over a computer network without routing through a remote cloud service. The messages may be encrypted and may include an incremented sequence number. Lighting devices that receive a command message may compare the incremented sequence number to a previously stored sequence number corresponding to the lighting control device. If the incremented sequence number is greater than the stored sequence number, then a lighting device may determine the message was transmitted by an authorized lighting control device and may implement any command instruction included therein. If the incremented sequence number is equal to or less than the stored sequence number, then the lighting device may determine the command message was transmitted by a malicious source and may ignore the command message.