Scalable Personal Device Sharing via MPSK and mDNS Policies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large-scale networks face scalability challenges in device registration and maintenance due to the need for manual device registration and frequent database updates, which consume significant bandwidth and processing power, and existing security protocols like PSK are inadequate for linking user identity to device ownership.
Innovation Solution
Implementing a user-specific multi-PSK (MPSK) system that automates device registration by linking user identity to device ownership, using an authentication server to validate MPSKs and a device-sharing server to enforce policies based on ownership, eliminating the need for manual registration and reducing bandwidth and computation requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual device registration and frequent database updates are implemented in large-scale networks, then device sharing security and ownership tracking are improved, but network scalability deteriorates due to significant bandwidth and processing power consumption
Solution Approach 1:
The system enables devices to automatically register themselves with the mDNS server without manual intervention. Devices autonomously advertise their presence and ownership information through mDNS service records, eliminating the need for manual device registration while maintaining security through automated ownership verification based on network authentication credentials.
Solution Approach 2:
The mDNS server acts as an intermediary that mediates device discovery and sharing without requiring frequent centralized database updates. Instead of a traditional DNS server requiring manual A and PTR record updates, the mDNS server dynamically resolves device addresses through service type queries and response packets, reducing bandwidth consumption and processing requirements.
2Ease of operation
If traditional DNS service records with A and PTR records are used for device sharing, then device address resolution is achieved, but device sharing policies based on ownership cannot be enforced
Solution Approach 1:
The system changes the parameter structure of DNS service records by incorporating ownership identifiers and user credentials directly into the mDNS service record fields. This allows the service records to carry both address resolution information and ownership verification data, enabling policy enforcement based on device ownership while maintaining address resolution functionality.
3Loss of information
If manual device registration is required for each device, then device ownership tracking is improved, but user convenience deteriorates due to the registration process
Solution Approach 1:
Device ownership is determined in advance through network authentication credentials (such as PSK-based authentication) before device sharing occurs. When devices authenticate to the network, their ownership information is pre-established and stored in the mDNS server, eliminating the need for separate manual registration processes while ensuring accurate ownership tracking.
Data Source
AI summary
An access point (AP) receives a network-access request comprising a first multi-pre-shared key (MPSK) password and queries an authentication server to determine an owner of a first device based on the first MPSK password. The AP receives, from the first device, an advertisement packet indicating a service provided by the first device and forwards information about the service and the owner to a device-sharing server to obtain a device-sharing policy. The AP enforces the device-sharing policy, which can include receiving from a second device, a multicast Domain Name System (mDNS) query, indicating the first device in an mDNS response corresponding to the mDNS query in response to determining that the second device belongs to the owner of the first device based on a second MPSK password of the second device, and allowing the second device to access the service provided by the first device.