DHCP Authentication Using EAP Challenge-Response
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing approaches to migrate Point to Point Protocol (PPP) functions to IP over Ethernet infrastructure face challenges such as increased network resource consumption, lack of user authentication and authorization, and inability to deny access to unauthorized users, particularly in large service provider networks.
Innovation Solution
The solution involves migrating PPP authentication functionality to DHCP, using new challenge and response DHCP processes and message types, and integrating the Extensible Authentication Protocol (EAP) to perform user authentication and authorization, ensuring secure and efficient access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If PPP authentication functionality is migrated to DHCP, then IP-based infrastructure security is improved, but DHCP protocol complexity increases
Solution Approach 1:
The patent combines PPP authentication functionality with DHCP protocol by integrating Extensible Authentication Protocol (EAP) into DHCP message exchanges. This merging allows authentication security to be maintained while using a single protocol (DHCP) instead of multiple protocols (PPP + EAP), thereby reducing overall system complexity despite adding authentication capabilities to DHCP
Solution Approach 2:
The patent introduces EAP as an intermediary authentication mechanism that operates within the DHCP framework. EAP serves as a mediator between the authentication requirements (originally from PPP) and the DHCP protocol, enabling secure authentication without requiring DHCP to become inherently complex, as EAP handles the authentication logic separately
2Device complexity
If PPP functions are eliminated in favor of IP-based functions, then network infrastructure simplicity is improved, but user authentication and authorization capabilities deteriorate
Solution Approach 1:
The patent makes DHCP a multi-functional protocol by enabling it to perform both its original function (IP address assignment and configuration) and PPP authentication function simultaneously. This universality eliminates the need for separate PPP infrastructure while maintaining authentication capabilities, thereby simplifying network infrastructure without sacrificing security functions
Solution Approach 2:
The patent merges the authentication function into the DHCP protocol framework, allowing a single protocol to handle both IP configuration and user authentication. This consolidation eliminates the need for separate PPP infrastructure while preserving authentication capabilities through the integrated EAP mechanism
3Reliability
If PPP authentication is used, then user authorization is ensured, but network resource consumption increases
Solution Approach 1:
The patent combines authentication and IP configuration into a single DHCP interaction sequence, eliminating the need for separate PPP negotiation phases. This merging reduces the total number of message exchanges and protocol handshakes required, thereby reducing network resource consumption while maintaining authorization capabilities through EAP integration
Data Source
Figure 1
Figure 2~3
Figure 4~5
AI summary
Techniques for authenticating a user for access to an IP network include receiving from the user's host a DHCP request which includes user identifier data. A random challenge value is determined and sent to the user's host in a DHCP message format. A response message that includes a response value is received from the user's host in DHCP format. A verification value is determined based on a password value associated with the user identifier value in an AAA server and the current challenge value using a secure process that renders impractical an attempt to derive the password. If it is determined that the response value does not match the verification value, then a DHCP offer is prevented from being sent to the user's host in response to the DHCP request. Thus, a user is authenticated using DHCP instead of PPP.