Proxy Node Authentication for Resource-Constrained IoT Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Networked devices with limited computational capacity, such as those in the IoT, face challenges in achieving secure communications due to the computational demands of authentication protocols, particularly asymmetric key cryptography.
Innovation Solution
A system and method where a proxy node with higher computational capacity authenticates a supplicant node with limited capacity by verifying a signed digital certificate and communicating a session key, allowing secure communications without requiring the supplicant node to perform asymmetric key operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If asymmetric key cryptography is used for authentication, then security level is improved, but computational capacity requirement increases
Solution Approach 1:
A proxy node is introduced as an intermediary between the supplicant node and the authentication server. The proxy node performs the computationally intensive asymmetric key verification operations on behalf of the supplicant node, which has limited computational capacity. This mediator approach allows the supplicant to benefit from high security authentication without needing to perform complex computations itself.
Solution Approach 2:
The authentication process is segmented into two parts: (1) the supplicant node performs only lightweight operations such as generating a nonce and transmitting it, and (2) the proxy node performs the computationally intensive asymmetric key verification. This division of labor allows each node to operate within its computational capabilities while achieving secure authentication.
2Reliability
If complex authentication computations are performed by the supplicant node, then authentication security is improved, but power consumption increases
Solution Approach 1:
The proxy node acts as an intermediary that performs power-intensive asymmetric key verification operations, shielding the supplicant node from these computational burdens. The supplicant node only performs minimal operations and communicates data, significantly reducing its power consumption while still achieving secure authentication.
Solution Approach 2:
Instead of the supplicant node performing the full authentication computation, the proxy node creates and verifies a copy of the authentication process using the supplicant's credentials. This allows the supplicant to authenticate securely without actually executing the computationally intensive verification operations itself.
3Reliability
If asymmetric key operations are performed by the supplicant node, then authentication robustness is improved, but device cost increases
Solution Approach 1:
The proxy node serves as a mediator that performs the expensive asymmetric key verification operations, allowing the supplicant node to be manufactured with minimal computational capabilities. This significantly reduces the cost of producing inexpensive IoT devices while maintaining robust authentication security through the proxy's computational resources.
Solution Approach 2:
The supplicant node performs only the necessary minimal actions for authentication (generating and transmitting a nonce), while the proxy node performs the excessive computational burden of asymmetric key verification. This partial action approach ensures authentication robustness without requiring expensive components in every device.
Data Source
AI summary
Authentication of a networked device with limited computational resources for secure communications over a network. Authentication of the device begins with the supplicant node transmitting a signed digital certificate with its authentication credentials to a proxy node. Upon verifying the certificate, the proxy node then authenticates the supplicant's credentials with an authentication server accessible over the network, acting as a proxy for the supplicant node. Typically, this verification includes decryption according to a public/private key scheme. Upon successful authentication, the authentication server creates a session key for the supplicant node and communicates it to the proxy node. The proxy node encrypts the session key with a symmetric key, and transmits the encrypted session key to the supplicant node which, after decryption, uses the session key for secure communications. In some embodiments, the authentication server encrypts the session key with the symmetric key.