Authentication Server State Distribution via Authenticator Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network authentication systems face scalability issues due to the need to maintain extensive state information for multiple authentication protocols, leading to increased storage requirements and complexity, especially in large-scale networks.
Innovation Solution
A method where state-related information is transmitted between network nodes during an authentication session, allowing the authentication server to reduce storage needs by deleting state information and having other nodes recreate it as needed, thereby distributing storage requirements across participating nodes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the authentication server maintains state information for multiple authentication protocols simultaneously, then authentication security and reliability are improved, but storage requirements and system complexity increase prohibitively
Solution Approach 1:
The patent divides the authentication system into three separate entities: the authentication server (which maintains minimal state), the authenticator (which maintains session state), and the communication device. By segmenting the state maintenance function from the authentication server to the authenticator, the server's storage requirements are reduced while authentication security is preserved through the authenticator's state management.
Solution Approach 2:
The patent extracts the state maintenance burden from the authentication server and places it in the authenticator. The authentication server only maintains essential credential state, while the authenticator maintains the session state during authentication exchanges. This extraction reduces the server's storage requirements while maintaining the necessary security state.
2Reliability
If the authentication server maintains state information for all active authentication sessions, then authentication reliability is improved, but device complexity and storage requirements worsen in large-scale networks
Solution Approach 1:
The patent segments the authentication system into distinct functional components with separate state management responsibilities. The authentication server handles credential verification with minimal state, while the authenticator manages session state. This segmentation reduces overall system complexity by distributing state management rather than concentrating it in the server.
Solution Approach 2:
The authenticator acts as an intermediary between the authentication server and the communication device, maintaining session state locally. This intermediary role allows the server to remain simple while the authenticator handles the complexity of state management during authentication exchanges, reducing overall system complexity.
3Reliability
If state information is maintained during the complete authentication period, then security against replay attacks is improved, but storage requirements increase
Solution Approach 1:
The patent extracts the temporary state maintenance function from the authentication server and assigns it to the authenticator. The server only maintains permanent credential state, while the authenticator maintains temporary session state including challenge values and nonces needed to prevent replay attacks. This extraction reduces the server's storage requirements while maintaining security.
Solution Approach 2:
The patent implements dynamic state management where the authenticator maintains session state only for active authentication exchanges and discards it after completion. This dynamic approach ensures security state is available when needed while minimizing storage requirements by eliminating the need for the server to maintain temporary session state.
Data Source
Figure 1~8
Figure 2
Figure 3
AI summary
A method and arrangements for enabling authentication of a communication device is suggested, where a network node, capable of operating as an authentication server does not have to store all state related information relevant for a roundtrip of an authentication session. Instead of storing all this information, at least a part of it is provided to the authenticator or the communication unit, for later retrieval in a subsequent response. Based on the state related information provided in the response, the network node is capable of reproducing a state associated with a respective roundtrip. By repeating the mentioned process for a required number of roundtrips, an authentication session can be executed, where less state related information need to be stored at the mentioned network node.