System-on-Chip for IoT VPN Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT devices face increasing security threats due to their exposure to internet-based hacking and remote control risks, and existing VPN solutions are limited by high computational overhead, making them unsuitable for low-end processors and memory devices.
Innovation Solution
A miniaturized system-on-chip (SoC) is developed, incorporating a microcontroller unit (MCU), an advanced encryption standard (AES) engine core, a trusted platform module (TPM), and a real-time operating system (RTOS) to perform VPN functions, including message encryption and authentication using TLS, ECDSA, and RSA algorithms, enabling secure communication in resource-constrained devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VPN is implemented using software application or hardware on commercial operating system, then encryption and authentication functions are provided, but computational overhead is high and requires high-end processor and memory
Solution Approach 1:
The patent segments the VPN functionality into a dedicated system-on-chip (SoC) module that can be independently integrated into IoT devices. This separate encryption/authentication module handles security operations independently from the main processor, reducing the computational burden on the main system while maintaining security functions.
Solution Approach 2:
The patent introduces a trusted platform module (TPM) or secure element as an intermediary component that specifically handles cryptographic operations. This mediator handles key storage, encryption, and authentication tasks, protecting the main processor from high computational overhead while ensuring security operations are performed by a specialized component.
2Reliability
If VPN is implemented with high-level encryption algorithms, then security is enhanced, but processing time and resource consumption increase
Solution Approach 1:
The patent replaces software-based cryptographic implementations with hardware-accelerated encryption engines built into the SoC. This substitution of hardware for software mechanics provides the same security functions but executes cryptographic operations much faster, eliminating the processing speed penalty associated with complex encryption algorithms.
3Adaptability or versatility
If commercial operating system is used for VPN, then various security protocols are available, but system size and memory requirements increase
Solution Approach 1:
The patent extracts only the essential security protocols and cryptographic functions needed for VPN operation from a full commercial operating system. By taking out just the necessary components (encryption engines, authentication mechanisms) and integrating them directly into the SoC, the system achieves protocol support without the memory overhead of a complete OS.
Solution Approach 2:
The patent designs the SoC with universal cryptographic engines that can handle multiple encryption standards and authentication protocols (AES, RSA, ECC, SHA) within a single integrated component. This multi-functional approach provides broad protocol support equivalent to a full OS but consumes minimal memory resources.
Data Source
AI summary
Provided is a system-on-chip that may perform a message encryption operation based on a transport layer security (TLS) scheme. The system-on-chip may include an authentication unit configured for exchanging a key used for the message encryption operation and performing authentication for a subject to perform communication, an advanced encryption standard (AES) engine core configured for performing a function of encrypting a message using a key or decrypting the encrypted message and a function of encrypting the key or decrypting the encrypted key, and a controller configured for controlling the AES engine core and the authentication unit based on a real time operating system (RTOS) and firmware for performing the message encryption operation.