Machine Authentication PAC for Network Access Without User Credentials
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IEEE 802.1x authentication during startup prevents network access for hosts until user credentials are provided, leading to issues with machine domain logging and network service access, and managing additional machine authentication credentials complicates server management, especially with multiple vendors involved.
Innovation Solution
A Machine Authentication PAC is generated during initial user authentication, comprising a randomly generated device key and encrypted ticket, allowing machines to access limited network services without user input by validating the device key and ticket, which does not require servers to maintain per-machine credentials, thus reducing exposure to attacks and simplifying credential management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IEEE 802.1x authentication is implemented during host startup, then network security is improved, but network access for machines before user login is blocked
Solution Approach 1:
The patent implements machine authentication that occurs before user login during host startup. The supplicant authenticates the machine to the authentication server using machine credentials stored in the operating system, establishing network access rights prior to user interaction. This preliminary authentication ensures security requirements are met while enabling necessary network services.
Solution Approach 2:
The patent separates machine authentication from user authentication into distinct processes. Machine credentials and user credentials are managed independently, with machine authentication handling network access rights for system services, and user authentication handling individual user access. This segmentation allows machines to access necessary network services without requiring user presence.
2Adaptability or versatility
If additional machine credentials are maintained on the authentication server, then machine authentication capability is improved, but server management complexity increases
Solution Approach 1:
The patent extracts machine credential management from the authentication server by utilizing credentials already stored in the operating system. Instead of maintaining separate machine credential databases on the server, the system leverages existing machine account credentials that are part of the OS authentication infrastructure, thereby avoiding additional server management burden.
Solution Approach 2:
The patent makes the existing operating system machine credentials serve dual purposes: they function both as local system authentication credentials and as network authentication credentials. The same machine credentials used for local logon also authenticate machine network access, eliminating the need for separate credential sets and simplifying server management.
3Adaptability or versatility
If multiple vendor supplicants are installed on the same machine, then authentication option flexibility is improved, but credential access problems worsen
Solution Approach 1:
The patent implements a supplicant interface that automatically retrieves machine credentials from the operating system without requiring manual configuration or vendor-specific credential storage. The supplicant self-services by accessing credentials through standard OS authentication mechanisms, eliminating the need for administrators to manually manage credentials across multiple vendor implementations.
Data Source
AI summary
A Machine Authentication PAC (Protected Access Credential) serves as machine credentials to obtain network access without requiring server storage and management of the additional set of credentials. The first time authentication is performed, user authentication is executed. After the supplicant and server have mutually authenticated each other and satisfied other validations, the supplicant requests a Machine Authentication PAC from the server. The Server randomly generates a cryptographic key (Device Key) and sends it to the supplicant along with an encrypted ticket, comprising the Device Key and other information and encrypted with a key only known to the Server. The supplicant caches the Machine Authentication PAC in its non-volatile memory for future use. When the machine needs to access certain network services before a user is available, the supplicant uses the Machine Authentication PAC to gain authorization for the machine to limited access on the network, without requiring user input.