Trusted Service Receiver Gateway for Secure IoT Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Secure accessibility of services residing within a secure computing environment from requests originating from outside that environment is challenging, especially in IoT devices with limited resources and vulnerable to malicious attacks, where unauthorized access must be prevented and obscured.
Innovation Solution
A Trusted Service Receiver (TSR) within the secure environment acts as a gateway, receiving encrypted data bundles from unsecure environments, decrypting and processing requests, applying security policies, and invoking trusted services while obscuring the interface, ensuring only permitted and complete requests are executed, with results encrypted back to the requester.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secure areas are configured to be invisible and undetectable to unauthorized parties, then security is improved, but accessibility to permitted users becomes more difficult
Solution Approach 1:
The patent introduces a gateway service as an intermediary component that resides in the trusted computing environment. This gateway acts as a mediator between untrusted external requestors and trusted internal services. The gateway receives requests from external sources, validates them against security policies, and forwards approved requests to the appropriate trusted services. This resolves the contradiction by maintaining the invisibility of trusted services to unauthorized parties while providing controlled access to permitted users through the gateway interface.
2Reliability
If all services are placed in secure environments inaccessible to unauthorized parties, then security is improved, but service discovery and access management complexity increases
Solution Approach 1:
The gateway service serves as a centralized intermediary that manages all access requests to trusted services. It maintains knowledge of available services, their interfaces, and access policies, thereby centralizing access management complexity in a single controllable component rather than distributing it across multiple access points. This reduces overall system complexity while maintaining security.
Solution Approach 2:
The gateway service performs multiple functions: it acts as a service registry, an authentication authority, a request router, and a policy enforcement point. By consolidating these diverse functions into a single universal component, the system reduces access management complexity while maintaining comprehensive security control over all trusted services.
3Reliability
If secure areas are completely separate from the main operating system, then security is improved, but resource sharing and communication efficiency decreases
Solution Approach 1:
The gateway service acts as an efficient intermediary that enables communication between the trusted and untrusted environments without compromising security isolation. It provides standardized interfaces and protocols for request submission, response retrieval, and status checking, thereby maintaining productive communication channels while preserving the security benefits of environment separation.
Data Source
AI summary
A system and method for secure access to computing services in trusted computing environments. The present invention facilitates the execution of services in a secure environment by unsecure requestors where the requestor has no visibility into the secure environment. A remote service creates an encrypted data bundle (EDB) consisting of the request and associated data and transmits the EDB to the unsecure requestor. The EDB is then transmitted to the Trusted Service Receiver (TSR) in the secure environment that decrypts the EDB and determines if the request is valid and permissible. If valid and permissible, the TSR determines what secure service will be required and Trusted Services (TS) are invoked. TSR then collects results from each TS invoked and transmits the result according to the instructions in the request.