DHCP Server Authentication via Timestamped Force Renew Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Dynamic Host Configuration Protocol (DHCP) configurations, clients lack effective authentication mechanisms to verify the legitimacy of force renew messages from servers, potentially leading to false server impersonation and configuration updates.
Innovation Solution
An authentication system using time stamps and asymmetric encryption, where the server generates and encrypts multiple force renew messages with a private key, and the client decrypts them using a public key to verify the server's authenticity based on time stamp consistency and differences.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the server sends force renew messages without authentication, then the client can update DHCP configuration quickly, but the system becomes vulnerable to false server impersonation
Solution Approach 1:
The client pre-stores the server's public key and authentication information before the DHCP configuration update process. This preliminary preparation enables the client to verify the server's identity when the force renew message arrives, preventing false server impersonation while maintaining quick configuration updates.
Solution Approach 2:
The patent introduces cryptographic authentication mechanisms (public key infrastructure, digital signatures, and authentication tokens) as intermediaries between the server and client. These intermediaries enable secure verification of the force renew message without significantly delaying the DHCP configuration update process.
2Reliability
If the client verifies server authentication, then security against false servers is improved, but the authentication process complexity increases
Solution Approach 1:
The patent extracts the authentication verification logic into a separate, standardized module that operates independently from the main DHCP configuration update process. This extraction simplifies the overall system architecture by isolating the complex authentication mechanisms into a dedicated component that can be implemented using standard cryptographic libraries.
Solution Approach 2:
The patent transforms the authentication process by changing parameters such as using pre-shared public keys, implementing time-limited authentication tokens, and establishing predetermined verification thresholds. These parameter changes convert a potentially complex continuous verification process into a series of simple parameter comparisons against pre-established criteria.
3Reliability
If multiple force renew messages are sent for authentication, then false server impersonation is prevented, but the time required for configuration update increases
Solution Approach 1:
The client performs preliminary caching of the server's public key and authentication credentials before the force renew message exchange. This preliminary action eliminates the need for real-time key exchange and multiple verification rounds, allowing the client to quickly verify incoming force renew messages against pre-stored authentication data.
Solution Approach 2:
The patent implements periodic authentication verification where the client checks the force renew message against pre-stored authentication information at predetermined intervals rather than performing continuous or multiple sequential verifications. This periodic approach maintains security while significantly reducing the total time required for configuration updates.
Data Source
AI summary
An authentication method based on a time stamp is executed by at least one processor of a server. At least two force renew messages are generated in turn when a configuration of Dynamic Host Configuration Protocol (DHCP) of the server is changed. The at least two force renew messages are encrypted asymmetrically with a private key of the server. The encrypted force renew messages are sent to a client according to a generating order of the force renew messages. A reply message is sent to the client when receiving a renew message from the client.