LwM2M Module Credential Sharing for Post-Manufacture Registration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT devices face challenges in life-cycle maintenance due to limitations in the lightweight machine-to-machine (LwM2M) protocol, particularly when new modules are introduced without pre-shared keys (PSK), making it difficult for them to register and operate with an operational server.
Innovation Solution
A method where a first IoT module shares its credentials with a second module without a PSK, allowing the second module to register with the operational server, enabling association and operation as a single endpoint, and potentially generating new keys for secure communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a new IoT module is introduced without a pre-shared key, then device functionality and versatility are improved, but the module cannot register with the operational server due to authentication requirements
Solution Approach 1:
The first IoT module acts as an intermediary by sharing its credentials with the second module, enabling the second module to authenticate with the server without having its own pre-shared key. This mediator approach resolves the contradiction by allowing functional expansion while maintaining reliable server registration through the first module's authentication credentials.
2Adaptability or versatility
If multiple IoT modules are supported in a device, then adaptability and service life are improved, but the complexity of credential management and server association increases
Solution Approach 1:
Multiple IoT modules are merged under a single credential identity managed by the first module. Instead of each module requiring separate credentials and server registrations, they operate as a unified group sharing the first module's authentication credentials, significantly reducing credential management complexity while supporting multiple functions.
3Ease of operation
If credential sharing is implemented between modules, then ease of operation and field upgrades are improved, but security risks may increase due to shared authentication credentials
Solution Approach 1:
The second module receives a copy of the first module's credentials rather than sharing the same credential instance. This copying approach enables the second module to independently authenticate with the server using its own credential copy, facilitating easy field upgrades and module additions while maintaining security through independent credential instances that can be individually managed and revoked.
Data Source
AI summary
A module may have more than one device, such as an IoT device, that requires bootstrapping. A first device may be provisioned with a pre-shared key (PSK). The first device, such as an IoT device, may bootstrap in a conventional manner using its PSK. A second device without a PSK may be added to the module post-manufacture. The first device may share registration details with the second device and also with an LwM2M server. When contacted by the second device, the LwM2M server may associate the second device with the first device and treat them as one from an operational standpoint, reducing the need for pre-shared keys across domains lacking an existing trust relationship.