Offline Device Authentication via Distributed Secure Channels

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional systems for authenticating and authorizing devices, such as smartphones, fail to authenticate and authorize when there is a lack of connectivity between the authority device and the equipment device, preventing the equipment device from determining if the smartphone has been authorized.

Innovation Solution

A distributed security model that enables authentication and authorization without a working Internet connection, using a system with unique identifiers, end-to-end encryption, and a secure communications channel, allowing devices to communicate and authorize actions even when offline.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional authentication systems rely on network connectivity between authority device and equipment device, then authentication can be performed when connected, but authentication fails when connectivity is lost

Engineering Contradiction:

Improveauthentication reliabilityVSAvoidoperational capability without connectivity

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system performs preliminary actions by establishing secure communication channels and exchanging authentication credentials between the equipment device and authority device before connectivity is lost. Authentication tokens and encrypted communication parameters are cached locally, enabling the equipment device to continue authenticating devices even when the authority device becomes unreachable due to connectivity loss.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary secure communication channel that operates independently of the external network connection. This intermediary channel uses pre-established encryption keys and protocols to mediate authentication between the equipment device and attempting devices, allowing authentication to proceed without requiring real-time connectivity to the authority device or cloud infrastructure.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If equipment device stores authentication credentials locally, then authentication can occur offline, but security risk increases from credential storage

Engineering Contradiction:

Improveoffline authentication capabilityVSAvoidsecurity vulnerability

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The authentication credentials and security data are segmented into multiple separate storage locations and protected by different security mechanisms. Rather than storing complete authentication credentials in one location, the system divides them into distributed fragments or separate components that are stored securely, reducing the impact of any single security breach while enabling offline authentication when needed.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent employs flexible, layered security protection around stored credentials, using multiple encryption layers and secure access controls that adapt to different threat levels. These protective layers act as flexible shells that can be breached or bypassed only under specific authorized conditions, allowing offline authentication functionality while maintaining security against unauthorized access.

Inventive Principle:

Principle #30Flexible shells and thin films

3Object-affected harmful factors

If distributed security model uses end-to-end encryption, then communication security is improved, but system complexity increases

Engineering Contradiction:

Improvecommunication securityVSAvoidsystem architecture complexity

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The distributed security model implements self-service encryption and authentication mechanisms where each device independently manages its own cryptographic keys and authentication state. Devices autonomously establish encrypted communication channels using pre-shared secrets or key agreement protocols without requiring centralized key management infrastructure, thereby achieving strong end-to-end encryption while keeping individual device complexity manageable.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent designs a universal authentication framework that handles multiple authentication scenarios and communication patterns through a single set of cryptographic primitives and protocols. This multi-functional approach allows the same encryption and authentication mechanisms to serve various purposes (device-to-device authentication, device-to-cloud authentication, credential verification, etc.), reducing overall system complexity despite implementing comprehensive end-to-end encryption.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS12494924B2System and method for authenticating and authorizing devices

Publication Date: 2025.12.09 DENSO CORP

AI summary

A system and method for a distributed security model that may be used to achieve one or more of the following: authenticate system components; securely transport messages between system components; establish a secure communications channel over a constrained link; authenticate message content; authorize actions; and distribute authorizations and configuration data amongst users' system components in a device-as-a-key system.