TOTP-Based Wireless Device Onboarding via Provisioner

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for onboarding wireless devices onto secure Wi-Fi networks are time-consuming, inconvenient for users, and prone to errors, especially when multiple devices need to be connected, often requiring manual intervention and being vulnerable to security attacks.

Innovation Solution

A method and system using a provisioning device to generate timestamp-based one-time passwords (TOTPs) and network credentials, which are verified through a remote server over a secure connection, allowing multiple devices to be onboarded simultaneously with minimal user intervention and enhanced security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If manual Wi-Fi credential entry is used for device onboarding, then security is maintained, but user convenience deteriorates and setup time increases

Engineering Contradiction:

ImprovesecurityVSAvoidsetup convenience

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

A provisioner device (mobile phone) acts as an intermediary between the wireless device and the Wi-Fi network. The provisioner generates TOTPs, stores network credentials securely, and facilitates the onboarding process through a mobile application, eliminating the need for manual credential entry on the wireless device while maintaining security through TOTP verification.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The manual mechanical process of typing SSID and password on device screens is replaced with an automated electronic system. The provisioner electronically generates and transmits TOTPs to the wireless device, and the system automatically verifies credentials and completes onboarding without user typing or manual intervention.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If traditional Wi-Fi onboarding is used, then device connectivity is achieved, but onboarding time increases and productivity decreases

Engineering Contradiction:

ImproveconnectivityVSAvoidonboarding speed

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

Network credentials and TOTP secrets are pre-configured on the provisioner device before the onboarding process. The provisioner generates TOTPs in advance and has network credentials ready, allowing immediate onboarding when a wireless device needs to connect, eliminating the need for real-time credential management during the onboarding process.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The provisioner continuously generates fresh TOTPs that are valid for specific time windows, allowing multiple devices to be onboarded in sequence or simultaneously without reconfiguring network credentials. The system maintains continuous readiness to onboard devices by keeping the TOTP generation mechanism active and credentials available.

Inventive Principle:

Principle #20Continuity of useful action

3Ease of operation

If Wi-Fi credentials are stored in devices for network access, then network connectivity is enabled, but security vulnerabilities increase

Engineering Contradiction:

Improvenetwork accessVSAvoidsecurity attacks

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The sensitive Wi-Fi network credentials (SSID and password) are extracted from the wireless device and stored securely in the provisioner device instead. The wireless device only receives temporary access tokens rather than storing actual network credentials, removing the security vulnerability of credential storage on potentially compromised devices.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The authentication mechanism changes from static credential verification to dynamic TOTP-based authentication. Instead of verifying stored passwords, the system uses time-varying TOTPs that expire after use, transforming the security model from static to dynamic and preventing replay attacks and credential theft.

Inventive Principle:

Principle #35Parameter changes

4Reliability

If multiple devices are onboarded sequentially with manual intervention, then each device connects securely, but total onboarding time increases

Engineering Contradiction:

Improvesecure connectionVSAvoidtotal setup time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The provisioner device serves multiple functions: it generates TOTPs for multiple devices, stores network credentials, manages the onboarding process, and verifies authentication. This universal provisioner can handle multiple device onboardings simultaneously or in rapid succession without requiring separate credential management for each device, significantly reducing total setup time while maintaining security.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS11431483B2Timestamp based onboarding process for wireless devices

Publication Date: 2022.08.30 INFINEON TECHNOLOGIES AMERICAS CORP

AI summary

A method, apparatus, and system for provisioning a device onto a network using a non-secure communication channel between the device and a provisioner is described. The provisioner receives a timestamp-based on-time password (TOTP), and a universal resource identifier (URI) from the device and provides the TOTP and an out-of-band (OOB) UUID to a remote server over a secure communication channel identified by the URI. The device is then provisioned onto a network based on comparisons of the UUID and the TOTP.