Cloud Auth for Layer 2 Devices via Active Intermediary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network devices with only Layer 2 connectivity to a stacking system cannot directly communicate with cloud-based management platforms for authentication and authorization, as existing techniques require direct IP connectivity to the cloud.
Innovation Solution
Implementing a cryptography-based message exchange using an IP-connected active device as an intermediary, where the member device requests authentication, receives an encrypted nonce, decrypts it, and uses a self-verifiable token (SVT) for subsequent re-authentication and re-authorization without re-establishing communication with the cloud platform.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If member devices use direct IP connectivity to communicate with cloud management platforms for authentication, then authentication reliability is improved, but device complexity increases as all devices must have IP connectivity capabilities
Solution Approach 1:
The patent introduces an active device as an intermediary between Layer 2-connected member devices and the cloud management platform. The active device receives authentication requests from member devices, establishes IP connectivity with the cloud platform, and relays authentication messages between them. This allows member devices to authenticate through the intermediary without requiring direct IP connectivity, thus maintaining authentication reliability while reducing device complexity.
2Speed
If all devices maintain direct IP connectivity to the cloud platform for authentication, then authentication speed is improved, but loss of time occurs when connectivity is interrupted and re-establishment is needed
Solution Approach 1:
The patent implements preliminary action by having the active device establish and maintain a persistent IP connection with the cloud management platform in advance. Authentication credentials and cryptographic materials are pre-configured and cached on the active device. When member devices need authentication, the active device can immediately relay requests through the pre-established connection without requiring each member device to have its own persistent connection, thus reducing time loss during connectivity interruptions.
3Measurement precision
If member devices have direct communication channels with the cloud platform, then measurement precision of device identity verification is improved, but device complexity and security management difficulty increase
Solution Approach 1:
The active device serves as a security intermediary that centralizes the management of cryptographic materials and authentication protocols. It maintains secure cached copies of member device credentials and performs cryptographic operations locally. This intermediary approach allows the cloud platform to verify device identities with high precision through the active device without each member device needing direct secure communication channels, thus simplifying security management while maintaining verification precision.
Data Source
AI summary
Techniques for enabling cloud authentication of Layer 2-connected member devices via an IP-connected active device are provided. In one set of embodiments, the member device can transmit, to the active device, a request to authenticate the member device with a cloud management platform. The member device can further receive, from the active device, an encrypted nonce generated by the cloud management platform in response to the request, where the encrypted nonce is encrypted using a public key of the member device. The member device can decrypt the encrypted nonce using a private key of the member device to generate a decrypted nonce and can transmit the decrypted nonce to the active device. The member device can then receive, from the active device, a token generated by the cloud management platform indicating that the member device has been authenticated by the platform.