Wireless Key Management Onboarding for Infrastructure Devices

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing information handling systems face challenges in securely onboarding infrastructure devices due to the need for manual credential re-provisioning and the risk of man-in-the-middle attacks, especially when devices are initially provided with default factory settings and accessed via public networks.

Innovation Solution

An Information Handling System (IHS) with a key management onboarding engine that performs wireless key management system discovery operations, validates infrastructure devices using certificates and validation keys, and transmits credential generation keys for secure authentication credential generation, enabling secure, automated, and autonomous onboarding.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If manual credential re-provisioning is used to secure devices during onboarding, then security is improved, but the onboarding process becomes time-consuming and labor-intensive

Engineering Contradiction:

ImprovesecurityVSAvoidonboarding time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary actions by pre-configuring devices with secure boot credentials and enrollment certificates before they reach the onboarding stage. The key management system pre-generates and distributes cryptographic keys to authorized devices, so that when onboarding occurs, the devices are already in a secure state and can automatically authenticate without requiring manual credential provisioning.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The onboarding system enables self-service through automated authentication mechanisms where devices independently prove their identity using pre-configured credentials. The key management system automatically validates device certificates and provisions necessary security policies without human intervention, allowing devices to onboard themselves securely and efficiently.

Inventive Principle:

Principle #25Self-service

2Ease of manufacture

If default factory credentials are used on devices, then device setup is simplified, but security is compromised due to potential man-in-the-middle attacks

Engineering Contradiction:

Improvedevice setupVSAvoidman-in-the-middle attacks

Core Design Contradiction:

Ease of manufactureVSObject-affected harmful factors

Solution Approach 1:

Instead of relying on vulnerable default credentials, the system performs preliminary secure configuration by embedding unique cryptographic identities and enrollment certificates in devices during manufacturing. This preliminary action establishes a secure foundation that prevents man-in-the-middle attacks while maintaining ease of setup, as devices can automatically authenticate using their pre-configured secure credentials.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The key management system acts as a trusted intermediary that verifies device identities through cryptographic certificates during the onboarding process. This intermediary mechanism replaces vulnerable default credential verification with secure certificate-based authentication, preventing man-in-the-middle attacks while maintaining automated, simple onboarding procedures.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Productivity

If automated discovery protocols are used to onboard devices, then onboarding efficiency is improved, but security risks increase due to potential attacks on the discovery process

Engineering Contradiction:

Improveonboarding efficiencyVSAvoiddiscovery attack risks

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The key management system serves as a trusted intermediary that mediates the discovery and authentication process between devices and the network. Instead of devices directly discovering and trusting each other (which creates security vulnerabilities), the key management system verifies identities and establishes secure connections, maintaining automated efficiency while preventing discovery-based attacks.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system implements secure feedback mechanisms where the key management system continuously validates device credentials and security policies during the automated discovery and onboarding process. This feedback loop ensures that only authenticated, authorized devices are onboarded, preventing attackers from exploiting the discovery process while maintaining high onboarding efficiency through automation.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS11496892B2Secure infrastructure onboarding system

Publication Date: 2022.11.08 DELL PROD LP

AI summary

A secure infrastructure onboarding system includes an infrastructure device with an infrastructure device wireless subsystem that it may use to perform wireless key management system discovery operations in response to initialization. A key management system includes a key management system wireless subsystem it uses to perform the wireless key management system discovery operations with the infrastructure device. The key management subsystem may then wirelessly receive an infrastructure device certificate along with an infrastructure device validation key from the infrastructure device, and validate the first infrastructure device based on the first infrastructure device certificate and the first infrastructure device validation key. In response, the key management system may wirelessly transmit a first credential generation key that is configured for use by the first infrastructure device to generate first authentication credentials.