Authenticator for Network Client Device Authenticity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods are inadequate in addressing denial of service (DOS) attacks from rogue clients in network authentication, as rate limiting and waiting periods do not effectively prevent overloading when rogue clients are mobile and repeatedly move across ports.
Innovation Solution
Implementing a system that monitors client device activity to differentiate between rogue and legitimate clients, applying measures such as MAC lockout for rogue dynamic clients and cached re-authentication for valid dynamic clients, and adjusting re-authentication periods based on client behavior and mobility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If rate limiting is applied to authentication requests, then the burden on access switches is reduced, but DOS attacks from mobile rogue clients persist
Solution Approach 1:
The patent introduces an authenticator as an intermediary component that sits between the access switch and the authentication server. The authenticator handles the complex task of monitoring authentication requests, tracking client behavior, and making authorization decisions, thereby relieving the access switch of this burden while providing robust DOS attack protection through behaviorscore monitoring and mobility detection
2Productivity
If a waiting period is implemented after failed authentication attempts, then authentication overload is reduced, but mobile rogue clients can still attack by moving across ports
Solution Approach 1:
The patent implements a feedback mechanism where the authenticator continuously monitors authentication request patterns and client mobility behavior. When a client exhibits suspicious mobility patterns or excessive failed attempts, the authenticator adjusts the waiting period dynamically and communicates this to the access switch, creating a closed-loop system that adapts to threats while maintaining normal authentication flow for legitimate clients
3Reliability
If authentication monitoring is implemented to identify rogue clients, then network security is improved, but system complexity increases
Solution Approach 1:
The patent segments the authentication system into distinct functional components: the access switch that handles basic packet forwarding, the authenticator that performs behavioral monitoring and decision-making, and the authentication server that validates credentials. This segmentation allows complex security monitoring to be isolated in the authenticator without overwhelming the entire system, making the solution scalable and manageable
Data Source
AI summary
A system and device for determining authenticity of a client device transmitting a request to access a network that includes an authenticator to adjust authentication parameters for authentication requests to access a network from a client device, and access switches positioned within the authentication, each of the plurality of switches having an associated port for receiving the authentication requests. The authenticator monitors authentication requests received from the client device, determines whether a number of the monitored authentication requests that are failed authentication requests, and determines mobility of the client device during the monitored authentication requests. Authenticity of the client device is determined based on one of the determined number of failed authentication requests and the determined mobility of the client device.