Network Device Secure Authentication with Keep-Alive
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network gateway devices face challenges in securely authenticating remote devices without incurring significant processing overhead, especially when providing access to unencrypted data over networks that may be compromised by unauthorized access.
Innovation Solution
Implementing a secure authentication method where a network device receives a challenge from an authentication server, responds with a device-based authentication certificate and identification information, and maintains a communication channel through periodic keep-alive messages, allowing non-secure data exchange without encrypting all content, thus reducing processing burdens.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all data is encrypted for secure transmission, then security is improved, but processing overhead increases significantly
Solution Approach 1:
The patent applies different security measures to different parts of the data transmission system. Authentication certificates and encryption are applied only to the control plane (authentication messages, channel establishment), while the data plane (actual content transmission) uses less intensive security measures like MAC addresses and IP addresses for identification. This local differentiation of security quality resolves the contradiction by providing adequate security where needed without overwhelming processing overhead for all data.
Solution Approach 2:
The patent segments the communication into distinct phases: authentication phase with full cryptographic verification, channel establishment phase with certificate exchange, and data transmission phase with lighter security measures. This temporal and functional segmentation allows intensive security processing only when necessary, reducing overall processing overhead while maintaining security for the critical authentication and channel setup portions.
2Reliability
If authentication certificates are verified for every data transmission, then authentication reliability is improved, but communication speed decreases
Solution Approach 1:
The patent performs comprehensive authentication and certificate verification in advance, during the channel establishment phase, before actual data transmission begins. Once the authenticated channel is established, the verification process is completed and cached, allowing subsequent data transmissions to proceed without repeating the full authentication ceremony. This preliminary action ensures authentication reliability is established upfront while enabling faster communication during the data transfer phase.
Solution Approach 2:
The patent implements periodic authentication refreshes at predetermined intervals during the data transmission phase, rather than verifying certificates with every single data packet. This periodic re-authentication maintains authentication reliability over extended communication sessions while significantly reducing the frequency of intensive verification operations, thereby improving overall communication speed.
Data Source
AI summary
An authentication server may use secure messaging with a remote device prior to authorizing non-secure communications between the remote device and a content server, thereby preventing unauthorized access to the content server. The secure messaging uses such security features as encryption, signatures with authentication certificates, a realm, and/or a nonce. Once non-secure communication is authorized, the remote device may act as a proxy between the content server and a user device connected to the remote device. The authentication server sends timeout notices to the remote device containing an interval and a key. To continue non-secure communications with the content server, the remote device must respond prior to the expiration of the interval by sending a keep-alive message containing the key to the authentication server.