One-Round Key Exchange Protocol for IoT Device Configuration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT devices face challenges in securely and efficiently accessing wireless networks due to the lack of input interfaces, and existing methods are vulnerable to data interception and brute force attacks during configuration data transmission.
Innovation Solution
A one-round key exchange protocol is adopted to securely share wireless network configuration data between a first and a second wireless device, using methods like Two-Basis Password Exponential Key Exchange (TBPEKE) or Elliptic Curve Diffie-Hellman (ECDH) protocols, ensuring authentication and encryption of configuration data within a single data exchange.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If basic encryption methods are used to transmit configuration data from mobile device to IoT device, then the configuration process is simple and efficient, but the security is weak and vulnerable to brute force attacks
Solution Approach 1:
The patent applies preliminary action by pre-sharing secret values between the IoT device and mobile device before configuration data transmission. These pre-shared secrets are used to generate session-specific encryption keys, ensuring that even if configuration data is intercepted, it cannot be decrypted without the unique session key. This resolves the contradiction by establishing strong security in advance while keeping the actual transmission process simple.
Solution Approach 2:
The patent changes the encryption parameter from static basic encryption to dynamic session-based encryption. Each configuration session uses a uniquely generated encryption key derived from pre-shared secrets and session-specific random values. This parameter change ensures that intercepted configuration data from one session cannot be used to decrypt data from another session, significantly enhancing security without adding complex protocols.
2Ease of operation
If IoT device creates a separate wireless network (e.g., Bluetooth) for configuration, then configuration data can be transmitted, but the device requires additional network creation capabilities and the process becomes more complex
Solution Approach 1:
The patent extracts the network creation function from the IoT device and relocates it to the mobile device. The IoT device only needs to receive configuration data passively, while the mobile device handles all active communication including creating the temporary network or connection channel. This extraction resolves the contradiction by simplifying IoT device requirements while maintaining ease of operation through the mobile device's capabilities.
Solution Approach 2:
The patent introduces an intermediary approach where the mobile device acts as a mediator between the IoT device and the target wireless network. The mobile device temporarily establishes a connection (using its own network creation capabilities) to transmit configuration data to the IoT device, which then uses this data to connect to the target network. This intermediary role resolves the capability mismatch while keeping the process user-friendly.
3Productivity
If configuration data is transmitted without strong encryption, then the transmission is fast and efficient, but the data is vulnerable to interception and malicious attacks
Solution Approach 1:
The patent applies preliminary action by pre-establishing encryption keys before data transmission. The mobile device and IoT device generate session-specific encryption keys using pre-shared secrets and random values before any configuration data is exchanged. This preliminary key establishment enables fast encrypted transmission without real-time key negotiation overhead, resolving the contradiction between speed and security.
Solution Approach 2:
The patent skips the traditional multi-round key negotiation process by using a one-round key exchange protocol. The mobile device sends all necessary configuration data including encryption keys in a single transmission burst, rather than engaging in multiple back-and-forth authentication exchanges. This rushing through of the configuration process maintains high speed while ensuring security through pre-established cryptographic parameters.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
This document describes a system and method for configuring a second wireless device to access a wireless network using a first wireless device whereby one-round key exchange protocol is adopted to share the wireless network's configuration data with the second wireless device in an efficient and secure manner.