Authority Center for Portable LAN Access Rule Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions fail to portably apply user-defined internet access rules across different local area networks (LANs), and they do not preserve the anonymity of user terminals while enforcing these rules.
Innovation Solution
A method where an authority center receives and stores sets of rules from a master terminal, generates a unique identifier and cryptographic function for a user terminal, and sends these to the terminal. The user terminal then generates a one-time identifier using the cryptographic function and unique identifier, which is used to retrieve the appropriate set of rules from the authority center when connecting to a new LAN.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If DNS server is used to control internet access, then access control is enabled, but only limited to grant or deny access to certain websites without time limits or duration control
Solution Approach 1:
The patent introduces an authority center as an intermediary between the user terminal and LANs. The authority center stores rule sets and cryptographic functions, and mediates the verification process by generating one-time identifiers that LANs can use to enforce comprehensive access control rules without exposing user identity or requiring complex local storage of rules.
2Object-affected harmful factors
If MAC address randomization is used for privacy protection, then user anonymity is preserved, but user terminal cannot be identified by router or gateway
Solution Approach 1:
The authority center acts as a trusted intermediary that enables identification without exposing user identity. It stores the binding between user terminals and rule sets, and provides one-time identifiers to LANs that allow rule enforcement without revealing the actual user terminal identity, thus resolving the conflict between anonymity and identification.
Solution Approach 2:
Instead of directly using the user terminal's MAC address for identification, the system creates a one-time identifier copy that represents the user terminal for the purpose of rule verification. This copy can be shared with LANs without exposing the original identifying information, enabling identification while preserving privacy.
3Reliability
If rules are defined locally in home router, then access control is enforced, but rules do not apply when user terminal accesses internet from other LANs
Solution Approach 1:
The authority center provides a universal service that enables rule enforcement across multiple different LANs. By storing rule sets centrally and providing one-time identifiers that work with any LAN, the system makes the access control rules portable and applicable in diverse environments (home, school, internet café, etc.) without requiring local rule configuration at each LAN.
Solution Approach 2:
The system performs preliminary action by pre-storing rule sets and cryptographic functions in the authority center before the user terminal needs to access different LANs. This advance preparation enables seamless rule enforcement at any LAN without requiring real-time rule distribution or configuration, thus ensuring both reliability and portability.
Data Source
Figure 1~3
Figure 4~5
AI summary
A method is proposed for defining, in an authority center, at least one set of rules defining access conditions to internet services for a user terminal. Such method comprises: - receiving, from a master terminal, the at least one set of rules; - identifying the user terminal for which the set of rules applies; - obtaining a unique identifier for said user terminal and a cryptographic function; and - sending the cryptographic function and the unique identifier to the identified user terminal. The method additionally comprises: - receiving a connection request at the communications network from the user terminal; - receiving, from the user terminal, a one-time identifier generated using a cryptographic function and the unique identifier, the cryptographic function and the unique identifier being known from the authority center; - transmitting the one-time identifier to the authority center; - receiving, from the authority center, the set of rules associated to the unique identifier extracted from the one-time identifier; - applying the set of rules while the user terminal is accessing internet services.