Network Access Control via Per-Device PSK Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current wireless network access control mechanisms, such as Open and Pre-Shared Key (PSK) models, are inadequate for managing access in IoT environments due to security concerns and scalability issues, particularly in networks with thousands or millions of devices, where revoking access for compromised devices is difficult and IoT devices often lack support for complex authentication methods like IEEE 802.1X.
Innovation Solution
Implementing a per-user, per-device or per-group PSK management system using a RADIUS server, where client devices are dynamically assigned to isolated groups based on multiple criteria, allowing for better lifecycle management and conditional profiles, and utilizing a centralized AAA architecture to manage network access and traffic characteristics.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If Pre-Shared Key (PSK) authentication is used for wireless network access, then ease of operation is improved, but security is worsened due to inability to control individual devices and difficulty in revoking access for compromised devices
Solution Approach 1:
The patent segments the single PSK into multiple individual PSKs, one for each client device. The authentication server stores and manages separate PSKs for different clients, allowing individual control and revocation of access rights without affecting other devices in the network
Solution Approach 2:
The patent introduces an authentication server as an intermediary between clients and the wireless network. This server acts as a mediator that verifies client credentials against stored PSKs and grants or denies access accordingly, enabling centralized security management while maintaining simple client-side operation
2Reliability
If IEEE 802.1X authentication is used to improve security, then security is improved, but device complexity increases making it unsuitable for constrained IoT devices
Solution Approach 1:
The patent changes the authentication parameter from complex 802.1X mutual authentication to simpler PSK-based authentication. By modifying the authentication mechanism to use pre-shared keys verified by a centralized server, the solution maintains security while reducing the computational and implementation complexity required in constrained IoT devices
3Ease of operation
If Open authentication model is used to improve ease of operation, then ease of operation is improved, but security is worsened due to lack of authentication
Solution Approach 1:
The patent implements automatic authentication where client devices independently present their PSK credentials to the authentication server without requiring manual intervention or complex setup. The server automatically verifies credentials and grants access, providing secure authentication as transparent as open access to the client device
Data Source
AI summary
A network controller configured to provide network access to client devices, receives a network access request from a client device. The network access request includes a media access control (MAC) address of the client device and information about a first private key. The network controller sends to a server an authentication request, which includes the MAC address of the client device. The network controller receives an authentication response from the server, which includes a second private key. The network controller determines whether the first private key is the same as the second private key. In response to determining that the first private key is different from the second private key, network access is denied to the client device, and in response to determining that the first private key is the same as the second private key, network access is granted to the client device.