Network Sensing Device Security via Unique Code Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network-connectable sensing devices are vulnerable to spoofing and malicious attacks, particularly against identity replacement, key replacement, and data retransmission, despite some configurations for encryption.
Innovation Solution
A network-connectable sensing device that uses a permanent unique code to prevent unauthorized key generation, includes packed data with a public key for integrity verification, and employs a timestamp to ensure uniqueness of each signed data packet.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network-connectable sensing devices use encryption configurations, then data transmission security is improved, but the devices remain vulnerable to spoofing and malicious attacks including identity replacement, key replacement, and data retransmission
Solution Approach 1:
The patent applies preliminary action by embedding a permanent unique code in the sensing device before deployment, which is used to generate cryptographic key pairs. This pre-established unique identifier prevents unauthorized key generation and identity spoofing, as the private key is derived from this permanent code that cannot be replicated. The public key is registered in advance with the server, creating a trusted relationship before any data transmission occurs.
Solution Approach 2:
The patent introduces a permanent unique code as an intermediary element that bridges the sensing device and the server for authentication purposes. This unique code serves as a trusted mediator that enables the generation of cryptographic keys and the establishment of secure communication channels. The unique code acts as a root of trust that mediates between the device's identity and the server's verification process, preventing man-in-the-middle attacks and identity replacement.
2Adaptability or versatility
If data are transmitted on uncontrollable medium, then remote transmission capability is improved, but data become vulnerable to spoofing or malicious attacks
Solution Approach 1:
The patent applies preliminary action by pre-registering the public key with the server before any data transmission occurs. This advance registration creates a trusted relationship that enables secure remote transmission. The server stores the public key in advance, so when data packets are transmitted remotely over uncontrollable networks, the server can immediately verify their authenticity using the pre-registered public key, preventing spoofing attacks.
Solution Approach 2:
The patent implements feedback through the verification process where the server uses the registered public key to verify each received data packet's digital signature. This feedback mechanism confirms the authenticity and integrity of remotely transmitted data, allowing the system to detect and reject spoofed or malicious packets. The timestamp verification also provides feedback to ensure data freshness and prevent replay attacks.
3Reliability
If a permanent unique code is used to prevent unauthorized key generation, then security against identity replacement is improved, but device complexity increases
Solution Approach 1:
The patent applies universality by making the permanent unique code serve multiple functions: it acts as a device identifier, a seed for generating cryptographic key pairs, and a root of trust for authentication. This multi-functionality reduces device complexity because a single permanent code replaces what would otherwise require separate components for identification and key management. The unique code universally enables all security functions without requiring additional hardware or software complexity.
4Reliability
If packed data include public key and timestamp for verification, then data integrity verification is improved, but data transmission size increases
Solution Approach 1:
The patent applies taking out by extracting only the essential verification elements (public key and timestamp) from the complete security framework and including them in the data packets. Rather than transmitting all security parameters or redundant verification data, the solution extracts and transmits only what is necessary for integrity verification. The public key allows signature verification, and the timestamp ensures data freshness, while minimizing additional bandwidth consumption.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention concerns a sensing device (1) configured to selectively operate in: a manufacturing mode, an unprovisioned mode, a provisioned mode and an end-of-life mode. In the manufacturing mode, the electronic circuit (14) permanently stores a unique code (149) in a storage medium (12), while in the unprovisioned mode, the electronic circuit (14) waits for a provisioning code (31) for generating a private and a public key (143). In the provisioned mode, the electronic circuit (14) signs a timestamp (146) provided by a time-keeping unit (13) and data (110) provided by a sensing unit. The collected data (110), the timestamp (146), the digital signature (144) and the public key (143) is then transmitted. In the end-of-life mode, the electronic circuit (14) permanently erases the private key.