Secure Paging for M2M Devices Using Hash Chains
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cellular network signaling mechanisms, including security protocols, are inadequate for machine-to-machine (M2M) applications due to inefficiencies in handling large numbers of devices with small data traffic, leading to potential paging attacks that can drain batteries of unattended devices like water meters or environmental sensors, as existing authentication and cryptographic methods are not suited for securing paging messages to a large number of devices.
Innovation Solution
Implementing a device and network architecture that uses cryptographically generated identifiers and one-way hash functions to secure paging messages, ensuring only authentic messages are recognized by devices, through methods such as hash chains, cryptographically generated identifier sequences, and per-device keyed Message Authentication Codes (MACs), which protect the integrity and authenticity of paging messages without significant overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security mechanisms (authentication, integrity protection) are applied to paging messages in M2M networks, then security is improved, but signaling overhead and network load increase significantly
Solution Approach 1:
The patent extracts the security verification function from the paging message itself and implements it separately through a paging response mechanism. Devices verify security by sending paging responses rather than by including security data in the paging message, thereby removing security overhead from the paging message structure while maintaining security functionality.
Solution Approach 2:
The patent introduces a paging response as an intermediary mechanism between the paging message and security verification. The paging response serves as a mediator that carries security verification information separately from the paging message, allowing security to be implemented without adding overhead to the original paging message structure.
2Reliability
If paging messages are secured using asymmetric cryptography (public key signatures), then authentication is improved, but message length and transmission time increase
Solution Approach 1:
The patent replaces expensive, long public key signatures with cheap, short MACs (Message Authentication Codes) for paging message authentication. The MAC is a compact cryptographic checksum that provides authentication without the length and processing overhead of public key signatures, serving as a disposable, efficient alternative for this specific application.
Solution Approach 2:
The patent substitutes the mechanical/public key cryptographic system with a more efficient symmetric cryptographic mechanism (MAC). This replacement uses simpler mathematical operations that produce shorter results, reducing message length and transmission time while maintaining authentication capability.
3Adaptability or versatility
If shared group keys are used to secure paging messages to multiple devices, then scalability is improved, but security is compromised
Solution Approach 1:
The patent segments the security mechanism so that each device has its own unique MAC computed with its individual identifier. Instead of using a single shared group key for all devices, the system computes device-specific MACs that can be verified individually, providing both scalability (handling many devices) and security (device-specific authentication).
Solution Approach 2:
The patent applies local quality by making security verification device-specific rather than group-wide. Each device's paging response includes a MAC computed with that specific device's identifier, providing localized security verification tailored to each device while maintaining the ability to page multiple devices efficiently.
4Speed
If devices respond to every paging message without verification, then response time is improved, but battery drain increases due to unauthorized responses
Solution Approach 1:
The patent implements preliminary action by having devices pre-compute their MACs and prepare paging responses with verification data before receiving paging messages. This allows devices to quickly verify authenticity using pre-prepared security data rather than performing complex verification after receiving each message, maintaining fast response times while enabling efficient security checks to prevent unnecessary battery drain from unauthorized responses.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
There is described a device for communicating with a network. The device receives a series of paging messages from a serving node in the network, where each paging message includes identification and authentication information sufficient to identify at least one device and authenticate the message, at least some of the information having been protected according to a sequence such that it varies between successive paging messages. The device verifies the protected part of the information using a cryptographic function and knowledge of the sequence and identifies whether the information indicates that message is an authentic message intended for that device. The device may act in response to the received paging message.