Wireless Device Credential Provisioning Using Stored Public Key
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security protocols for wireless devices, such as those in the IoT, face challenges in securely provisioning credentials due to resource constraints and the need for lightweight solutions that prevent tampering and man-in-the-middle attacks, especially during bootstrapping.
Innovation Solution
A method where the wireless device uses its stored device public key as a shared secret for secure credential provisioning from a server, eliminating the need for additional cryptographic material and reducing memory usage, while ensuring secure communication with both manufacturer and enterprise servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional DTLS modes with pre-shared keys or certificates are used for secure credential provisioning, then security is improved, but device complexity and memory usage increase due to additional cryptographic material
Solution Approach 1:
The patent extracts the shared secret generation from traditional pre-shared key provisioning by using the device public key (already present in the device) as the basis for generating the shared secret through an elliptic curve point multiplication operation. This eliminates the need for separate pre-shared keys or certificate-based authentication, reducing cryptographic material while maintaining security.
Solution Approach 2:
The device uses its own stored public key to generate the shared secret for credential provisioning, making the process self-service rather than requiring external provisioning of additional cryptographic material. The device autonomously derives the shared secret from its existing public key through cryptographic operations.
2Reliability
If manual configuration of credentials is performed for each wireless device, then security is improved, but productivity decreases due to time-consuming configuration
Solution Approach 1:
The device automatically generates the shared secret and completes credential provisioning without requiring manual configuration. The device receives only its public key from the server, then autonomously derives the shared secret through cryptographic operations, enabling automated bulk provisioning while maintaining security.
3Adaptability or versatility
If device public key is exposed during provisioning, then flexibility is improved, but security worsens due to potential attacks
Solution Approach 1:
The shared secret is generated and used for securing the credential provisioning channel before the device public key is exposed to the server. The preliminary establishment of this secure channel ensures that subsequent public key exposure does not compromise security, as the authentication and encryption are already in place.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
This disclosure provides a method, performed in a wireless device (60), for enabling a secure provisioning of a credential from a server (70). The wireless device (60) stores a device public key and a device private key. The server (70) stores the device public key. The method comprises receiving (S1) an authentication request from the server (70); generating (S2) a device authentication and integrity, DAI, indicator; and transmitting (S3) an authentication response to the (server70). The authentication response comprises the DAI indicator. The method comprises receiving (S4) a credential message from the server (70), the credential message comprising a server authentication and integrity, SAI, indicator. The SAI indicator provides a proof of the server's possession of the device public key. The method comprises verifying (S5) the received credential message using the device public key.