Network Authentication via MAC-Hash Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods for Internet access at distributed locations, such as hotels and coffee shops, are either inconvenient for devices with limited user input capabilities or insecure, as they rely on MAC address identification which can be compromised.
Innovation Solution
A method involving a computing device transmitting a request to a network, intercepting it with an access controller, determining redirection, and using a shared secret combined with a one-way hash function to authenticate and authorize access, ensuring secure and manageable authentication across various devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If MAC address identification is used for authentication, then convenience is improved (no user input required), but security deteriorates (MAC address can be spoofed)
Solution Approach 1:
The authentication credentials are segmented into two parts: a device-specific component (MAC address or device identifier) and a user-specific component (password or authentication code). This segmentation allows the system to maintain device-specific automatic authentication while adding a secure user-specific layer that cannot be easily spoofed, thus resolving the contradiction between convenience and security.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism that bridges MAC address identification and secure user verification. The system uses the MAC address to automatically identify the device and retrieve pre-configured authentication credentials, then verifies these credentials through a secure challenge-response mechanism or by comparing against stored passwords, thus maintaining both convenience and security.
2Reliability
If certificate-based authentication is used, then security is improved, but device complexity increases (certificate management for millions of devices)
Solution Approach 1:
The patent merges the device identification function (MAC address) with authentication credential storage. Instead of requiring separate certificate management on each device, the system stores authentication credentials associated with device MAC addresses in a centralized authentication server, eliminating the need for complex certificate management on individual devices while maintaining security.
Solution Approach 2:
The system enables automatic authentication where the device's MAC address serves as its own identifier for retrieving credentials, eliminating the need for manual certificate installation and management. The authentication server automatically retrieves and verifies credentials based on the device's MAC address, providing self-service authentication that reduces complexity.
3Reliability
If web browser interface with keyboard input is used for authentication, then security is improved (user can enter credentials), but ease of operation deteriorates (inconvenient for devices with limited input capabilities)
Solution Approach 1:
The patent implements dynamic authentication methods that adapt to the device's input capabilities. For devices with limited input capabilities, the system can present authentication options such as selecting from pre-displayed credentials, using biometric authentication, or receiving credentials through alternative interfaces, thus maintaining security while improving ease of operation for different device types.
Data Source
AI summary
A method includes receiving authentication information for a client device at a server. The authentication information includes a geographic location of the client device and a first result of a one-way hash function based on a combination including an authentication seed and a first secret. The method includes computing, at the server, a second result of the one-way hash function based on a combination including the authentication seed and a second secret. The method also includes enabling the client device to access a second network in response to a determination by the server that the first result matches the second result and a determination by the server that the client device is authorized to access the second network based on the geographic location.