AAA Token Mediation for Secure Legacy Network Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing centralized authentication and authorization protocols like TACACS+ and RADIUS rely on usernames and passwords, which are vulnerable to security threats such as network eavesdropping and snooping, exposing sensitive information and risking system compromise.
Innovation Solution
Implement a custom authentication and authorization apparatus that uses multi-factor authentication and generates cryptographically strong tokens for secure network environments, eliminating the need to transmit real credentials over communication networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TACACS+ protocol is used for centralized authentication, then encryption of all packets is improved, but device compatibility deteriorates (only works with Cisco devices)
Solution Approach 1:
The patent introduces a custom authentication and authorization apparatus that acts as an intermediary between requester apparatuses and target apparatuses. This intermediary implements a custom protocol that combines the security features of TACACS+ with the broad compatibility of RADIUS, allowing it to communicate with various network devices without being limited to Cisco equipment while maintaining strong encryption for all packets including credentials
2Adaptability or versatility
If RADIUS protocol is used for widespread compatibility, then device compatibility is improved, but security deteriorates (only encrypts passwords, leaves other information unencrypted)
Solution Approach 1:
The patent changes the encryption parameter from selective encryption (as in RADIUS) to comprehensive encryption. The custom protocol encrypts all packets including usernames, passwords, and other authentication data, transforming the security parameter from partial to complete encryption coverage while maintaining broad device compatibility through standard AAA message structures
3Ease of operation
If usernames and passwords are transmitted over network, then authentication functionality is improved, but security deteriorates (vulnerable to eavesdropping, sniffing, and snooping attacks)
Solution Approach 1:
The patent applies preliminary anti-action by encrypting authentication credentials before they are transmitted over the network. The custom protocol establishes encryption as the first line of defense, preventing eavesdropping, sniffing, and snooping attacks from compromising usernames and passwords during transmission, while still maintaining full authentication functionality
Data Source
AI summary
According to examples, an apparatus includes a processor that receives a request from a requester apparatus to access a target apparatus. The processor may provide a token valid to the requester apparatus upon determining that the requester apparatus is authenticated to access the target apparatus, in which the token complies with and is sent via a centralized authentication and authorization protocol. The processor may also receive an access check message from the target apparatus, in which the access check message includes the token and the identity of the requester apparatus. In addition, the processor may enable the target apparatus to control access to the requester apparatus. The apparatus disclosed herein enable for the retrofitting of secure multi-factor or one-time password authentication into systems that rely on a centralized authentication and authorization protocol, such as the TACACS+ or the RADIUS protocol.