Device Authentication via Disposable MAC Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In industrial environments like fulfillment centers, the lack of a secure network access control methodology for devices from different vendors leads to increased risks of unauthorized access, as many devices do not support advanced protocols like IEEE 802.1X, causing operational and resource overhead in implementing secure identification and authentication.
Innovation Solution
A lightweight secure network protocol using one-way hash functions to identify and authenticate devices by generating and verifying unique hash values, with a network management server and vendor server collaborating to ensure only trusted devices are allowed on the network, without exposing vendor keys or requiring advanced networking capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If advanced authentication protocols like IEEE 802.1X are implemented, then network security is improved, but device complexity and operational overhead increase
Solution Approach 1:
The patent uses disposable MAC addresses generated through hash functions instead of permanent, complex authentication credentials. Each device generates a unique MAC address by hashing its hardware address with a shared secret, creating a simple, single-use authentication token that avoids the complexity of persistent certificate-based systems like IEEE 802.1X
Solution Approach 2:
The patent replaces the mechanical complexity of hardware-based authentication (physical keys, certificates) with a computational approach using hash functions. The authentication mechanism substitutes complex cryptographic certificate verification with simple hash computation and comparison, reducing processing requirements while maintaining security
2Reliability
If comprehensive device identification and authentication is implemented, then unauthorized access is reduced, but network bandwidth and compute resources are consumed
Solution Approach 1:
The patent extracts the essential authentication information into a compact hash value that can be transmitted and verified efficiently. By taking only the necessary authentication data (hardware address and shared secret) and transforming it into a concise MAC address through hashing, the system reduces the amount of data that needs to be processed and transmitted during authentication
Solution Approach 2:
The patent changes the parameter representation from complex authentication data (certificates, public keys) to a simplified hash-based MAC address. This parameter transformation reduces the computational burden and network overhead while maintaining the security function, as the hash operation is computationally inexpensive compared to full cryptographic authentication
Data Source
AI summary
A network protocol is provided to identify and authenticate devices from different vendors that are deployed in a network. Each vendor is provided a vendor key unique to the vendor by a network management server. A vendor server associated with the vendor provisions a device with a first hash value generated using the vendor key among other device attributes. When the device is deployed in the network, the network management server queries the device. The device generates a second hash value using the first hash value and sends it in a response to the network management server. The network management server computes a local hash value using the vendor key and the attributes received from the response. The network management server authenticates the device if the local hash value matches with the second hash value.