IPv6 Access Authentication for Dynamic Policy Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The frequent changes in temporary IPv6 addresses of terminal devices cause network access interruptions and challenges in configuring authorization policies, leading to security risks and service disruptions.
Innovation Solution
An access management method involving an authenticator and authentication server that identifies new IPv6 addresses and configures real-time authorization policies using MAC addresses, ensuring seamless network access by transmitting packets with MAC and IPv6 information to enforce policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If a temporary IPv6 address is used to improve communication privacy, then address predictability is reduced, but network access control and policy configuration become difficult
Solution Approach 1:
The patent introduces an authentication server as an intermediary between the terminal device and the network. The authentication server receives packets from the authenticator containing the temporary IPv6 address and MAC address, determines the corresponding authorization policy, and forwards it to the policy enforcement point. This mediator enables network access control despite the use of temporary addresses by linking them to authorized users through authentication.
2Reliability
If the temporary IPv6 address changes frequently to enhance security, then address uniqueness is improved, but service continuity is disrupted
Solution Approach 1:
The patent implements a feedback mechanism where the authenticator continuously monitors for packets containing temporary IPv6 addresses from terminal devices. When a new temporary address is detected, the authentication server receives notification, determines the corresponding authorization policy, and updates the policy enforcement point. This continuous feedback loop ensures service continuity by automatically adapting to address changes without interrupting user service.
3Measurement precision
If manual policy configuration is used for each IPv6 address, then authorization accuracy is improved, but system complexity increases
Solution Approach 1:
The patent enables the system to automatically manage authorization policies without manual configuration for each IPv6 address. The authentication server automatically receives packets containing temporary addresses, determines the corresponding authorization policies based on the terminal device identity, and configures them on the policy enforcement point. This self-service mechanism maintains high authorization accuracy while eliminating the need for complex manual configuration.
Data Source
AI summary
This application discloses an access management method, an authenticator, and an authentication server, applied to a scenario in which a terminal device accesses a network. After completing authentication, a terminal device sends a first packet to an authenticator, where the first packet carries a first IPV6 address of the terminal device and a MAC address of the terminal device. When determining that the first IPV6 address is a new IPV6 address, the authenticator sends, to an authentication server, a second packet carrying the first IPV6 address and the MAC address, so as to indicate the authentication server to send a first authorization policy to a policy enforcement point based on the first IPV6 address.