Captive Portal Decoupling Authentication for WLAN Throughput
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In public wireless networks, client devices often experience latency due to repeated authentication requests when accessing WiFi hotspots, leading to network congestion, especially in crowded areas.
Innovation Solution
The implementation of a captive portal system that redirects client requests for network access, initiates associations between clients and wireless controllers, receives authentication credentials, negotiates authorization using the RFC 5176 protocol, and maps captive portal IP addresses to authorize clients, thereby reducing the workload on WLAN controllers and improving network efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If client devices transmit repeated authentication requests to access WiFi hotspots, then network access is attempted, but network congestion and latency occur
Solution Approach 1:
The system performs preliminary authentication and authorization actions before allowing full network access. Clients must first authenticate through a captive portal, receiving a token that enables subsequent network operations without requiring repeated authentication requests, thus preventing network congestion while maintaining secure access control
2Reliability
If WLAN controllers handle all authentication and authorization processes, then security is maintained, but controller workload increases reducing operational efficiency
Solution Approach 1:
The authentication and authorization processes are segmented into distinct phases handled by different system components. The captive portal handles initial authentication and token issuance, while the WLAN controller manages authorized network operations using pre-validated tokens. This segmentation reduces the WLAN controller's workload while maintaining security through distributed validation
Solution Approach 2:
A captive portal acts as an intermediary between clients and the WLAN controller. It pre-processes authentication requests, validates credentials, and issues authorization tokens before clients connect to the wireless network. This intermediary approach filters and prepares requests, reducing the processing burden on WLAN controllers while maintaining centralized security control
3Reliability
If HTTPS is enabled immediately upon client connection, then secure communication is established, but unnecessary processing occurs before authorization
Solution Approach 1:
The system performs preliminary authentication through the captive portal before enabling HTTPS on the client connection. The authentication token is obtained in advance, allowing HTTPS to be enabled only after successful authorization. This preliminary action prevents unnecessary SSL/TLS handshakes and cryptographic processing for unauthorized clients, reducing wasted processing time and resources
Data Source
AI summary
Embodiments of the present technology provide out-of-band captive portal devices, networks, and methods. An example of a method includes executing a redirection of a client request for network access to a captive portal login, initiating an association between the wireless controller and the client, receiving authentication credentials of client from the captive portal login, negotiating a change of authorization with a wireless controller in accordance with RFC 5176 protocol, wherein the controller includes a mapping to a captive portal Internet Protocol (IP) address, and redirecting the client to a URL specified in the client request for network access.