PKI-Based M2M Communication Through Firewalls for Low-Power Modules
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing M2M communication systems face challenges in conserving battery life, managing radio-frequency spectrum, and ensuring secure and efficient communication through intermediate firewalls, particularly with diverse module manufacturers and varying cryptographic algorithms, while supporting periodic and small message transmissions.
Innovation Solution
A server-based system that utilizes public key infrastructure (PKI) to securely generate and manage module keys, translate cryptographic methods, and establish efficient communication protocols, including asymmetric and symmetric ciphering, to support modules and applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Use of energy by moving object
If M2M modules use periodic wake-up transmissions to conserve battery life, then battery consumption is reduced, but communication security and reliability deteriorate due to connection timeouts and firewall interruptions
Solution Approach 1:
The system performs preliminary actions by establishing security associations and obtaining firewall exceptions before the module goes into sleep mode. The server pre-configures firewall rules to allow periodic wake-up messages, and security context is established in advance so that when the module wakes, it can immediately resume secure communication without requiring full re-authentication, thus maintaining both energy efficiency and reliability
Solution Approach 2:
The server acts as an intermediary that maintains persistent security contexts and manages firewall exceptions. It stores security associations between modules and applications, and coordinates with firewalls to create allowed patterns for periodic traffic. This intermediary role allows modules to sleep while the server ensures continuous secure communication pathways are maintained
2Reliability
If M2M modules implement full PKI cryptographic operations locally, then communication security is improved, but device complexity and processing requirements increase
Solution Approach 1:
The cryptographic functionality is segmented between the module and the server. The module contains only essential cryptographic primitives for basic operations, while the server handles complex PKI operations including certificate management, key pair generation, and cryptographic protocol execution. This segmentation allows secure communication without requiring full PKI implementation in resource-constrained modules
Solution Approach 2:
The server acts as a cryptographic intermediary that performs complex PKI operations on behalf of modules. It manages the module's cryptographic identity, generates key pairs, and handles all cryptographic processing for secure message encryption and decryption. Modules only need simple cryptographic capabilities to communicate securely with the server, which in turn secures communication with applications
3Adaptability or versatility
If M2M systems support diverse module manufacturers and cryptographic algorithms, then system versatility is improved, but interoperability and security management complexity increase
Solution Approach 1:
The server implements a universal security management system that supports multiple cryptographic algorithms and module types through a single interface. It provides algorithm-agnostic security services that work with any module regardless of manufacturer or supported cryptographic methods. The server translates between different cryptographic implementations and a unified security framework, enabling multi-vendor support without increasing module complexity
Data Source
AI summary
Methods and systems are provided for supporting efficient and secure “Machine-to-Machine” (M2M) communications using a module, a server, and an application. A module can communicate with the server by accessing the Internet, and the module can include a sensor and/or an actuator. The module, server, and application can utilize public key infrastructure (PKI) such as public keys and private keys. The module can internally derive pairs of private/public keys using cryptographic algorithms and a first set of parameters. A server can authenticate the submission of derived public keys and an associated module identity. The server can use a first server private key and a second set of parameters to (i) send module data to the application and (ii) receive module instructions from the application. The server can use a second server private key and the first set of parameters to communicate with the module.