Monitoring System Multistage Verification for IoT DoS Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Microcontroller-based and microprocessor-based systems in IoT devices are vulnerable to Denial of Service (DoS) attacks due to their low computing capacity, which makes them susceptible to network disruptions leading to functional failures, and existing security measures are not applicable due to computational intensity and power constraints.
Innovation Solution
A multi-stage request check system for monitoring systems, involving an initial quick verification followed by a more complex authorization process, which only executes if the initial check is positive, and includes disconnecting the network if the request is untrustworthy, ensuring minimal computational load and preventing attackers from gaining information about the system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security measures (firewalls, cryptographic authentication) are applied to protect IoT devices, then security level is improved, but computing load and power consumption increase beyond what IoT devices can handle
Solution Approach 1:
The authentication process is segmented into two distinct stages: a lightweight first stage using simple credential verification, and a more comprehensive second stage using mutual authentication protocols. This segmentation allows the system to handle most requests with minimal computational overhead while providing robust security for authorized connections.
Solution Approach 2:
The first authentication stage serves as a preliminary filter that quickly verifies basic credentials before allowing the system to proceed to the more computationally intensive second stage. This preliminary action prevents unauthorized devices from consuming significant computational resources.
2Reliability
If complex authentication protocols are implemented, then security is improved, but processing time and computational resources increase
Solution Approach 1:
The authentication process is divided into two stages: a fast first stage using simple credential matching, and a more thorough second stage using mutual authentication. This segmentation ensures that most authentication operations complete quickly while maintaining security.
Solution Approach 2:
The system applies partial authentication (first stage only) for routine requests where full security is not required, and excessive action (full mutual authentication) only when necessary. This approach optimizes processing time while maintaining adequate security levels.
3Productivity
If network communication is allowed without restrictions, then system functionality is maintained, but vulnerability to DoS attacks increases
Solution Approach 1:
The system performs preliminary authentication verification before allowing any network communication. This preliminary action ensures that only authenticated devices can establish connections, preventing DoS attacks while maintaining system functionality for authorized devices.
Solution Approach 2:
The authentication mechanism acts as an intermediary layer between network requests and system resources. It mediates all communication attempts, allowing legitimate traffic while blocking malicious requests before they can impact system functionality.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
The invention relates to a monitoring system which can be operatively coupled to a monitored object (334, 920, 922, 924), said monitoring system comprising a processor (304, 904.1, 904.2, 904.3), a network interface (308), and at least one sensor (331, 916) and/or a control unit (333, 344, 432). The monitoring system is designed to: • receive (804) a request (322) of a request unit (328); • carry out a first verification (806) of the request; • if the first verification indicates that the request is not trustworthy, canceling (808) the first verification without responding in any manner to the request unit; • otherwise carrying out (810) an additional verification of the request; and • only in the event that the additional verification of the request indicates that the request unit is sufficiently authorized, allowing the transmission of state data of the monitored object, said data having been detected by the sensor, to the request unit and/or changing the state of the monitored object by means of the control unit in accordance with the request.