Gateway Authentication Insertion for Secure Network Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network access control systems are vulnerable to unauthorized access and identity theft due to the exposure of identification information during communication, particularly when nodes are infected with malware or stealers, and token-based authentication methods are also susceptible to sophisticated attacks.
Innovation Solution
A system and method that utilize a gateway with a communication circuit, memory, and processor to generate and insert authentication information into service requests, and a server with a communication circuit, memory, and processor to manage authentication and update data flows, ensuring secure and authorized access by identifying and updating data flows based on authentication information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If identification information is inserted into layer 7 protocol for authentication, then user identification capability is improved, but security vulnerability increases due to exposure during communication
Solution Approach 1:
The patent introduces a gateway as an intermediary component between the node and service server. The gateway generates authentication information based on data flow identification information and inserts it into layer 7 protocols, rather than having nodes directly insert their own identification information. This mediator approach protects nodes from exposure while maintaining authentication capability.
Solution Approach 2:
The patent creates authentication information as a copy or representation of the original data flow identification information. Instead of transmitting actual node identification information, the system generates authentication tokens that replicate the necessary verification function without exposing sensitive original identifiers, thereby reducing security risks.
2Reliability
If token-based authentication is used instead of fixed identification information, then security against stealing is improved, but vulnerability to sophisticated attacks increases
Solution Approach 1:
The patent implements dynamic authentication information generation based on data flow identification information. Rather than using static tokens, the authentication information is generated fresh for each data flow, making it dynamic and adaptive. This dynamic approach prevents reuse attacks while maintaining security against sophisticated threats.
Solution Approach 2:
The system changes the parameters of authentication information by deriving it from data flow identification information rather than using fixed tokens. This parameter transformation creates authentication credentials that are specific to each communication context, enhancing security against sophisticated attacks while maintaining reliability.
3Measurement precision
If authentication information is generated and inserted into service requests, then access control precision is improved, but system complexity increases
Solution Approach 1:
The patent merges the authentication information generation function into the gateway that already handles data flow management. By combining these functions in a single component, the system achieves precise access control without proportionally increasing overall system complexity. The gateway integrates multiple responsibilities including authentication, data flow management, and protocol handling.
Data Source
AI summary
Disclosed is a gateway which a communication circuit, a memory, and a processor operatively connected with the communication circuit and the memory. The processor receives a service request from a node, identifies whether the service request is received through at least any one of a tunnel authorized by an external server, a security session, or a logical connection, identifies whether there is data flow corresponding to the service request and authorized by the external server, generates authentication information to be inserted into the service request, based on authentication information included in the data flow, and inserts and forwards the authentication information to be inserted into the service request and information associated with the node into the service request to a service server.