SDP Handshake Selection for Lightweight IoT Cloud Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SDP solutions face challenges in providing lightweight security measures for low-performance IoT devices, especially in resource-constrained environments, and there is a need for flexible security boundary establishment and protection against network-based attacks in IoT cloud environments.
Innovation Solution
Employing an ephemeral Diffie-Hellman over COSE (EDHOC) protocol to enhance SDP solutions, allowing for scalable and lightweight authentication security by combining TLS-based and EDHOC-based SDP configurations, reducing network bandwidth and memory usage while maintaining compatibility with existing technologies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TLS handshake protocol is used for SDP authentication, then security level is maintained, but resource consumption (memory and bandwidth) increases for low-performance IoT devices
Solution Approach 1:
The patent changes the handshake protocol parameter from TLS to EDHOC, which is specifically designed for resource-constrained environments. EDHOC uses elliptic curve cryptography with smaller key sizes and requires less computational resources while maintaining equivalent security levels, directly addressing the contradiction between security and resource consumption for IoT devices
Solution Approach 2:
The patent employs ephemeral Diffie-Hellman key exchange in EDHOC, where temporary keys are generated for each session and discarded afterward. This ephemeral approach provides forward secrecy without requiring long-term key storage, reducing memory requirements for low-performance devices while maintaining security
2Reliability
If TLS handshake protocol is used for SDP authentication, then security is ensured, but network bandwidth and memory usage increase
Solution Approach 1:
The patent changes cryptographic parameters by using EDHOC with optimized key sizes and message formats compared to TLS. EDHOC's streamlined protocol reduces the number of handshake messages and their sizes, directly reducing network bandwidth consumption and memory requirements while maintaining security
Solution Approach 2:
The patent extracts and removes unnecessary cryptographic operations and message exchanges from the traditional TLS handshake, keeping only the essential key exchange and authentication functions needed for SDP. This streamlined approach reduces bandwidth and memory usage while preserving security
3Productivity
If lightweight handshake protocol is used for resource-constrained devices, then resource utilization improves, but compatibility with existing TLS-based SDP configurations decreases
Solution Approach 1:
The patent implements a universal SDP authentication mechanism that supports multiple handshake protocols (both TLS and EDHOC). The system can select the appropriate protocol based on device capabilities and configuration, allowing lightweight EDHOC for resource-constrained devices while maintaining compatibility with existing TLS-based configurations for other devices
Solution Approach 2:
The patent introduces dynamic protocol selection where the handshake method is determined at runtime based on device characteristics, network conditions, and configuration parameters. This dynamic approach allows the system to adapt between TLS and EDHOC, providing both resource efficiency for IoT devices and compatibility with existing systems
Data Source
AI summary
An information protection method based on software-defined perimeter (SDP) for Internet of Things (IoT) cloud security may comprise: receiving, at an SDP controller, an onboarding request message with an identity (ID) token from an SDP client acting as an initiating host, the onboarding request message comprising information requesting authentication of the SDP client and a handshake parameter specifying a handshake protocol for use in an SDP access process; and issuing, at the SDP controller, an SDP client credential corresponding to the handshake parameter.