Server-Derived Device Password Provisioning for Secure Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for setting device passwords, such as generic or unique preset passwords, incur significant logistical and security risks, including increased costs, compromised form-factors, and uncontrolled access, as they are often displayed on the device or easily guessed.
Innovation Solution
A server-based system that derives a unique and random password from a shared key using the Generic Bootstrapping Architecture (GBA), communicating the password to the device via a secure interface, and managing password access through a device management server to ensure security and cost-effectiveness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If a generic preset password is used for all devices, then manufacturing cost is reduced, but security is compromised
Solution Approach 1:
The device automatically generates its own unique preset password during manufacturing without requiring external intervention. The password is stored in the device's memory and can be retrieved by the user through the device's display or associated documentation, eliminating the need for manual password assignment while maintaining uniqueness and security
Solution Approach 2:
The password changes from a static generic value to a dynamic unique value generated by each device based on its individual identifier. This parameter transformation ensures that each device has a distinct password while the generation process remains automated and cost-effective
2Reliability
If a unique preset password is generated for each device, then security is improved, but manufacturing cost and complexity increase
Solution Approach 1:
Each device autonomously generates its own unique password using its device identifier, eliminating the need for external systems to create, manage, and distribute unique passwords. This self-service approach maintains security through uniqueness while significantly reducing manufacturing overhead
Solution Approach 2:
The password generation function is extracted from the manufacturing process and embedded within the device itself. The device uses its inherent identifier to generate the password, removing the need for separate password management infrastructure and reducing manufacturing complexity
3Ease of operation
If the password is displayed on or near the device, then user access is simplified, but security risks increase due to potential observation or theft
Solution Approach 1:
The device provides mechanisms (display screen, documentation) for users to retrieve the password before they need to use it. Users can record the password themselves during the setup phase, eliminating the need for ongoing physical access to the device or reliance on vulnerable display mechanisms
Solution Approach 2:
The password display function serves its purpose during initial setup and can then be considered 'disposable' - the user has already recorded the password, and further displays provide no additional value but increase security risk. The system accepts that the displayed password is temporarily vulnerable but mitigates this through the preliminary recording action
Data Source
Figure 1
AI summary
The present disclosure provides a server 120, a device 110 and methods for providing security data to a device 110 requiring a password for use in protecting a function of the device 110. An example method comprises communicating a device identifier to the server 120; the server 120 communicating security data to the device 110, wherein the password is derivable, at least in part, from the security data; the device 110 deriving the password, at least in part, from the security data and storing the password as the access code for the protected function; and the server 120 storing the device identifier with an association to the password.