Secure Device Onboarding via Local Identifier Assignment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secured automation systems face challenges in efficiently and securely onboarding new devices without manual configuration steps, particularly in establishing mutual trust and authentication for secure communication.
Innovation Solution
A method and system that automates the onboarding process by using a secure communication server to check device identifiers, assigning a local identifier if necessary, and interacting with an authentication authority to ensure secure communication, enabling devices to authenticate and communicate with the automation system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If an automated onboarding process is implemented to minimize manual configuration steps, then ease of operation is improved, but secure authentication and mutual trust establishment become more complex
Solution Approach 1:
The patent introduces a secure communication server as an intermediary component that mediates between the device and the automation system. This server handles the complex authentication and credential exchange processes, allowing devices to be onboarded automatically without manual configuration while maintaining secure authentication. The intermediary absorbs the complexity of the authentication procedure, presenting a simple interface to end users.
2Reliability
If a VPN connection is used for secure communication between devices and the automation system, then system security is improved, but device complexity and configuration requirements increase
Solution Approach 1:
The patent implements a self-service mechanism where the secure communication server automatically manages VPN connections and credential distribution. Devices don't require manual networking configuration or VPN setup - the server handles these tasks automatically during the onboarding process. This maintains the security benefits of VPN connections while eliminating the complexity of manual networking configuration.
3Reliability
If mutual trust is established before credential exchange in the onboarding process, then system security is improved, but the onboarding process cannot be fully automated
Solution Approach 1:
The patent implements preliminary action by having the secure communication server pre-generate and distribute credentials to devices during the initial connection phase, before formal authentication occurs. This allows the onboarding process to be fully automated while maintaining security, as the credentials are established in advance through automated key exchange protocols, eliminating the need for manual trust establishment.
Data Source
Figure 1~2
AI summary
The invention relates to a method and a system for establishing a secure communication (SC) between a device (Dev) and a component (C) of a secured automation system, the method comprising: a) establishing a communication (SC) between the device (Dev) and a secure communication server (SCS), b) checking a device identifier (IDevID, LDevID) of the device (Dev), c1) if the device identifier (IDevID, LDevID) is an initial device identifier (IDevID), assigning a local device identifier (LDevID) to the device (Dev), stopping the communication (SC) between the device (Dev) and the secure communication server (SCS), and returning to step a), or c2) if the device identifier (IDevID, LDevID) is a local device identifier (LDevID), establishing a secure communication (SC) between the device (Dev) and the component (C) of the secured automation system using the local device identifier (LDevID).