Network Access Control via Dual-Session Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication methods are insufficient in preventing malicious users from accessing networks, as they do not verify the health of computers, which can be compromised by viruses or security holes.
Innovation Solution
A method involving two separate communication sessions: one for authenticating the computer's identity and another for authenticating its health, with a health credential issued upon successful health check, which can be reused for subsequent network access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional authentication is used to verify computer identity, then network access control is achieved, but computers with viruses or security holes can still access the network
Solution Approach 1:
The authentication process is segmented into two independent components: identity authentication (verifying who the computer is) and health authentication (verifying the computer's security state). This is achieved through separate communication sessions - a first session for identity verification and a second session for health status verification using a health credential server. By dividing the authentication process, the system comprehensively verifies both identity and security state without overly complicating the overall architecture.
Solution Approach 2:
A health credential server is introduced as an intermediary component between the network access device and the computer. This intermediary专门负责 verifying the computer's health status by conducting a separate communication session and issuing health credentials. This mediator approach allows health verification to be performed independently from identity authentication, enabling comprehensive security checks while maintaining system modularity and avoiding direct coupling between different authentication functions.
2Reliability
If health authentication is conducted for every network access attempt, then security is enhanced, but processing overhead increases
Solution Approach 1:
The computer's health status is authenticated in advance during the initial connection process, and a health credential is issued. This credential can then be reused in subsequent network access sessions, eliminating the need to perform full health verification for every access attempt. The preliminary health check and credential issuance reduces processing overhead for recurring access requests while maintaining security through the reusable credential system.
Solution Approach 2:
Instead of repeatedly performing complete health verification for each network access attempt, the system creates a copy of the health verification result in the form of a health credential. This credential serves as a reusable proof of the computer's healthy state, allowing subsequent access requests to be validated more efficiently without repeating the entire health authentication process, thus reducing processing overhead while maintaining security.
Data Source
AI summary
One embodiment of the invention is directed to managing access of a host computer to a network. A first communication session with the host computer may be conducted to authenticate the host computer's identity. A second communication session with the host computer may be conducted to determine the health status of the host computer.