Distributed Authentication Control in Bridged Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Ethernet network authentication systems are vulnerable to denial-of-service attacks due to localized approaches that fail to detect and mitigate distributed authentication request flooding, leading to network overload and service denial.
Innovation Solution
A distributed network system with bridge nodes and a central resource that limits authentication sessions, allowing for real-time monitoring and adjustment of thresholds across multiple nodes to prevent overload, using circuitry to manage and control authentication requests effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a centralized authentication server is used to verify all authentication requests, then authentication security is improved, but the network becomes vulnerable to denial-of-service attacks when the server is overwhelmed by excessive requests
Solution Approach 1:
The patent divides the authentication control function into two parts: local bridge nodes perform initial authentication request filtering and counting, while the centralized server performs actual authentication verification. This segmentation prevents the server from being overwhelmed by all authentication requests, including malicious flooding attacks.
Solution Approach 2:
Bridge nodes perform preliminary filtering of authentication requests by maintaining counts of authentication requests from each source IP address and comparing them against thresholds before forwarding requests to the authentication server. This preliminary action prevents malicious requests from reaching the server.
2Object-affected harmful factors
If authentication request filtering is performed locally at each bridge node, then the authentication server is protected from overload, but distributed flooding attacks across multiple bridges can still overwhelm the server
Solution Approach 1:
The patent combines local bridge node filtering with centralized server-side tracking of authentication requests. The server maintains counts of authentication requests from each source IP across all bridges and enforces rate limiting globally, preventing distributed flooding attacks that bypass individual bridge filters.
Solution Approach 2:
The system implements feedback mechanisms where bridge nodes report authentication request counts to the server, and the server adjusts rate limiting thresholds based on observed network conditions and attack patterns. This dynamic feedback allows the system to adapt to evolving attack strategies.
3Object-affected harmful factors
If rate limiting thresholds are set low to prevent flooding attacks, then server protection is improved, but legitimate authentication requests may be blocked
Solution Approach 1:
The patent implements dynamic threshold adjustment where rate limiting thresholds are not fixed but adapt based on network conditions, time of day, and observed authentication patterns. This allows the system to be more permissive during normal operation and more restrictive during attack conditions.
Solution Approach 2:
The system changes rate limiting parameters dynamically based on the type of attack detected and network conditions. Different thresholds are applied for different source IP addresses, different time periods, and different authentication methods, allowing fine-grained control that protects against attacks while maintaining legitimate service.
Data Source
AI summary
A bridged network system (10). The system comprises at least one network server (NS) for receiving and responding to authentication session requests. The system also comprises a plurality of bridge nodes (BRNx). Each bridge node in the plurality of bridge nodes is connected to communicate with at least one other neighboring bridge node in the plurality of nodes, and each bridge node comprises at least one port (BPx), circuitry for communicating with at least one of either another bridge node in the plurality of nodes or the at least one network server, and circuitry for limiting (40, 42) a number of authentication sessions active at a same time through the at least one port. The system also comprises a central resource (e.g., BRN0). The central resource comprises circuitry for directing (74) the circuitry for limiting, for at least two bridge nodes in the plurality of bridge nodes, in response to a number of authentication sessions active at a same time through two or more bridge nodes in the plurality of bridge nodes.