Mesh Network Commissioning via Joiner Router Relay
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current wireless mesh networks face challenges in secure commissioning of devices, particularly in authenticating and provisioning network credentials, due to limited user interfaces and resources on devices, which complicates the joining process and reduces user experience.
Innovation Solution
The implementation of a joiner router that facilitates device authentication using Password Authenticated Key Exchange by Juggling (J-PAKE) and securely transmits network credentials, enabling secure communication sessions and provisioning within the mesh network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional commissioning techniques are used for mesh networks, then device authentication and credential injection can be achieved, but the user experience quality deteriorates and the process becomes complex
Solution Approach 1:
A commissioning device acts as an intermediary between the joining device and the mesh network. The commissioning device receives the joining request, establishes a secure connection with the mesh network using existing credentials, and then facilitates credential transfer to the joining device. This mediator approach simplifies the user experience by providing a centralized commissioning interface while maintaining security through established authentication protocols.
Solution Approach 2:
The commissioning device pre-establishes a secure connection with the mesh network before the joining device attempts to connect. Network credentials and authentication mechanisms are prepared in advance on the commissioning device, which then uses these pre-configured credentials to facilitate the joining process. This preliminary setup eliminates the need for the joining device to directly handle complex authentication sequences.
2Reliability
If secure credential injection is implemented during commissioning, then network security is improved, but the commissioning time and complexity increase
Solution Approach 1:
The secure communication channel established during commissioning is maintained and reused for subsequent credential transfers and device provisioning activities. Instead of establishing new secure connections for each credential injection operation, the system maintains a continuous encrypted session between the commissioning device and the mesh network, allowing multiple credential transfers without repeated authentication handshakes.
Solution Approach 2:
The commissioning device serves as a mediator that caches and manages network credentials, enabling rapid credential injection to multiple joining devices. The commissioning device holds pre-obtained credentials and can quickly distribute them to joining devices without each device needing to independently negotiate secure connections with the mesh network, significantly reducing commissioning time while maintaining security.
3Measurement precision
If device-specific provisioning is performed during commissioning, then network accuracy is improved, but the complexity of the commissioning process increases
Solution Approach 1:
The commissioning process merges multiple functions into a single unified workflow: device discovery, authentication, credential injection, and device-specific provisioning are combined into one continuous process managed by the commissioning device. Instead of separate complex procedures for each function, the system integrates them into a streamlined sequence where the commissioning device handles all aspects of device onboarding, including configuring device-specific parameters and verifying successful joining.
4Reliability
If authentication using J-PAKE is implemented, then security against credential theft is improved, but the computational resources required increase
Solution Approach 1:
The computationally intensive J-PAKE authentication is performed partially on the commissioning device rather than fully on resource-constrained mesh devices. The commissioning device, which has adequate processing resources, handles the heavy cryptographic computations, while the joining devices perform only lighter verification operations. This partial execution approach maintains the security benefits of J-PAKE while reducing the computational burden on battery-powered mesh network devices.
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
A joining device is securely joined to a mesh network. At a joiner router, a Datagram Transport Layer Security-, DTLS-, ClientHello message can be received from the joining device requesting to join the mesh network. The received DTLS-ClientHello message can be encapsulated in a DTLS Relay Receive Notification message, and the DTLS Relay Receive Notification message can be transmitted to a commissioning device of the mesh network. A DTLS Relay Transmit Notification message can be received from the commissioning device. Content of the DTLS Relay Transmit Notification message can be transmitted to the joining device, the content effective to enable the joining device to join the mesh network. An indication that the joining device is to be entrusted to receive network credentials for the mesh network can be received from the commissioning device. A Key Encryption Key, KEK, that is shared between the commissioning device and the joining device can be received from the commissioning device. Responsive to the receiving the indication, the network credentials can be transmitted from the joiner router to the joining device using the KEK to secure communication of the network credentials.