Flexible Authentication Server Using Dynamic Attribute Profiles
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional RADIUS servers have inflexible authentication procedures, leading to potential revenue loss and issues, such as unauthorized access when multiple devices share the same residential gateway MAC address, limiting their ability to authenticate based on various service-specific attributes.
Innovation Solution
An authentication server method that receives a request message with attributes, retrieves a profile object to identify relevant attribute names, generates a subscription identifier, and authenticates based on subscriber profiles, allowing flexible definition of authentication behavior by specifying which attributes to use for authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional RADIUS servers use fixed authentication procedures based on MAC addresses, then the authentication process is simple and standardized, but the system lacks flexibility to handle diverse service-specific attributes and allows unauthorized access when multiple devices share the same gateway
Solution Approach 1:
The patent implements dynamic authentication by allowing the authentication server to select different attributes (such as MAC address, IP address, device identifier, or service-specific attributes) based on the service type and subscriber profile. The profile object dynamically specifies which attributes to use for authentication, enabling the system to adapt to different authentication requirements without following a fixed procedure.
Solution Approach 2:
The system changes the authentication parameters by using different attributes for authentication depending on the service and subscriber. Instead of always using MAC address, the system can switch to IP address, device identifier, or other service-specific attributes. The profile object contains configuration that determines which parameter (attribute) to use, allowing flexible parameter selection.
2Reliability
If the authentication server uses multiple attributes for authentication, then the system can prevent unauthorized access and enhance security, but the authentication process becomes more complex and requires more processing
Solution Approach 1:
The patent applies preliminary action by pre-configuring profile objects that specify which attributes to use for authentication. The profile object is retrieved before the authentication decision is made, and the attribute selection is determined in advance based on the service type and subscriber profile. This preliminary configuration reduces the processing time during actual authentication by avoiding complex real-time analysis of multiple attributes.
Solution Approach 2:
The system extracts only the necessary attribute for authentication from the available multiple attributes. Instead of processing all possible attributes, the profile object specifies which single attribute (or combination) to extract and use for authentication. This extraction approach reduces processing complexity while maintaining authentication accuracy by focusing on the most relevant attribute.
3Reliability
If the system authenticates based on service-specific attributes rather than just MAC addresses, then revenue protection is enhanced and unauthorized access is prevented, but the authentication system requires more sophisticated attribute management and profile configuration
Solution Approach 1:
The patent implements universality by creating a profile object structure that can handle multiple service types and attribute combinations through a single unified mechanism. The profile object serves multiple functions: it identifies which attributes to use, specifies the authentication method, and can be applied to different service types. This multi-functional approach reduces the need for separate authentication systems for different services while maintaining sophisticated attribute management.
Data Source
AI summary
Various exemplary embodiments relate to a method, network node, and non-transitory machine-readable storage medium including one or more of the following: receiving, at an authentication server, a request message including a plurality of attributes having respective attribute names and respective attribute values; retrieving a profile object that identifies a first attribute name; reading a first attribute value from a first attribute of the plurality of attribute values, wherein the first attribute carries the first attribute name; generating a first subscription identifier that carries the first attribute value; identifying a first subscriber profile that stores the first subscription identifier; and authenticating the request message based on the first subscriber profile.