Client Device Ticket for Captive Portal Reauthentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Captive portal systems require users to reauthenticate upon reconnecting to a network after disconnection or inactivity, leading to increased user inconvenience and system overhead due to the need for repeated authentication.
Innovation Solution
A client device ticket system is introduced, where a ticket containing user context information is created and stored on the client device upon initial authentication, allowing for quick reconnection without redirecting the user to the captive portal page, by encrypting the ticket with a secret key and storing it on the client device, which the network can decrypt to verify previous authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If captive portal systems require reauthentication upon reconnection, then network security is maintained, but user convenience and system efficiency deteriorate due to repeated authentication requirements
Solution Approach 1:
The system performs authentication in advance and stores the authentication result (ticket) on the client device. When the device reconnects to the network, the pre-stored ticket is used for rapid reauthentication without requiring the user to go through the full authentication process again, thus maintaining security while improving convenience
Solution Approach 2:
The authentication result is copied from the authentication server to the client device in the form of a ticket. This copy contains the necessary authentication information and can be presented again upon reconnection, eliminating the need for repeated authentication while maintaining security verification
2Reliability
If captive portal systems require reauthentication upon reconnection, then authentication validity is ensured, but system overhead increases due to repeated authentication processes
Solution Approach 1:
The authentication process is performed in advance and the result is cached on both the server and client sides. Upon reconnection, the system uses the pre-computed authentication result rather than repeating the entire authentication process, reducing server load and improving system efficiency while maintaining authentication validity
Solution Approach 2:
The authentication result is copied and stored as a ticket on the client device. This allows the server to quickly verify authentication status without repeating the computationally intensive authentication process, thereby reducing system overhead while ensuring authentication validity through ticket verification
3Ease of operation
If user context is stored on the network, then reconnection is facilitated, but security risks increase due to potential unauthorized access
Solution Approach 1:
The authentication information is extracted from the server and stored locally on the client device in the form of a ticket. This removes the security risk of storing sensitive user context on the network while still enabling facilitated reconnection through the use of the locally stored ticket
Solution Approach 2:
A copy of the authentication result is created and stored on the client device rather than storing the actual user context on the network. This copy (ticket) contains sufficient information for reauthentication without exposing sensitive user data, thus facilitating reconnection while minimizing security risks
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system may include a client device to connect to a network and a network device communicatively coupled to the client device. The network device may determine that the client device has been authenticated to the network via a captive portal page. The network device may further create a ticket corresponding to the client device. Possession of the ticket by the client device may indicate authentication of the client device to the network. The network device may then transmit the ticket to the client device for storage on the client device. The stored ticket may enable the client device to remain authenticated to the network after a period of inactivity.