Generic EAP Authentication Framework Decoupling Credential Acquisition
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication protocols, such as EAP methods, require specific credential management for each authentication method, complicating the process and user experience, especially in scenarios like Single Sign-on and network access.
Innovation Solution
A generic authentication framework that uses a credential interface to decouple credential acquisition from specific EAP methods, allowing applications to manage credentials independently and provide a unified interface for credential collection and provisioning, enabling Single Sign-on and network authentication before user logon.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If each EAP method uses its own specific credential management, then authentication protocol requirements are met, but credential management complexity increases and user experience deteriorates
Solution Approach 1:
The patent implements a universal credential management framework that serves multiple EAP methods through a single unified interface. The credential interface can be invoked by any EAP method (MS-CHAPv2, EAP-TLS, PEAP, etc.) without requiring method-specific credential handling code, thereby reducing complexity while maintaining protocol compliance through the standardized interface contract
Solution Approach 2:
The credential interface acts as an intermediary layer between the authentication framework and individual EAP methods. It mediates credential acquisition, storage, and retrieval operations, allowing EAP methods to interact with credentials through a standardized abstraction rather than direct method-specific implementations, thus simplifying the overall system architecture
2Reliability
If credentials are managed inside each EAP method, then protocol-specific requirements are satisfied, but user experience and Single Sign-on capability are limited
Solution Approach 1:
The credential interface provides universal access to credential management functionality across all EAP methods. Applications can use the same interface to retrieve credentials for different authentication methods, enabling Single Sign-on scenarios where a single credential retrieval operation serves multiple authentication purposes without compromising protocol-specific requirements
Solution Approach 2:
The patent segments credential management into a separate, reusable interface layer that is independent of specific EAP methods. This segmentation allows the credential interface to handle user experience concerns uniformly while EAP methods maintain their protocol-specific authentication logic, separating concerns to improve both usability and protocol compliance
3Reliability
If network authentication requires user logon first, then user authentication is ensured, but network access processes and group policy updates are delayed
Solution Approach 1:
The credential interface enables preliminary credential retrieval and network authentication before the user completes the full logon process. Applications can invoke the credential interface to obtain necessary credentials and complete network authentication setup in advance, allowing network resources to be prepared beforehand without waiting for user logon completion
Solution Approach 2:
The patent introduces dynamic credential acquisition where the credential interface can retrieve credentials at different stages of the authentication process. It allows flexible timing of credential retrieval - either before or during user logon - adapting to different authentication scenarios and enabling parallel processing of network setup operations
Data Source
AI summary
An EAP-based authentication framework is provided that decouples credential acquisition from EAP methods that use credentials for authentication. An application may request from an EAP method parameters of credentials required by the EAP method. In response, the EAP method provides credential parameters, which may then be used by the application to acquire credentials consistent with the parameters from the user or other entity. The framework enables an application to request credentials in a context specific way. In addition, the application may simultaneously obtain credentials used in multiple authentication operations through a single user interface, or retain credentials for later use without further prompting a user such that a Single Sign-on user experience may be implemented. Additionally, the application can obtain credentials from a device so that the device may gain network access without requiring a user logon.