Packet Relay Apparatus Selective MAC Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In network authentication systems, the packet relay apparatus performs unnecessary MAC address authentication on all packets, leading to an increased load on the CPU and inefficient use of resources, particularly when DHCP or IPx6 packets are involved before the IPv4 address is delivered.
Innovation Solution
A packet relay apparatus that selectively performs MAC address authentication by specifying authentication target packets based on criteria such as source MAC address, Ethernet type, destination IP address, and port numbers, allowing other authentication methods like Web authentication and IEEE802.1X to be used when appropriate, and transfers only relevant packets to the CPU for processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If MAC address authentication is performed on all packets from unauthenticated terminals, then authentication security is maintained, but CPU load increases significantly
Solution Approach 1:
The patent segments packet processing into two paths: authentication target packets are processed by the CPU through MAC address authentication, while non-authentication packets are processed by the packet processing unit without CPU involvement. This segmentation resolves the contradiction by applying authentication only where necessary, maintaining security for critical packets while improving overall CPU efficiency.
Solution Approach 2:
The patent applies different processing qualities to different packet types. Authentication target packets (such as DHCP, IPx6, and polling packets) receive full MAC address authentication processing, while other packets receive streamlined processing. This local quality approach maintains security where needed while reducing unnecessary CPU load on non-critical packets.
2Reliability
If MAC address authentication is attempted for all packet types, then comprehensive authentication coverage is achieved, but unnecessary authentication processing occurs
Solution Approach 1:
The patent applies partial action by performing MAC address authentication only on specific packet types that require it (authentication target packets), rather than on all packets. The packet processing unit identifies and handles non-authentication packets without subjecting them to full authentication processing, thereby eliminating unnecessary energy consumption while maintaining adequate authentication coverage.
Solution Approach 2:
The patent changes the parameter of authentication applicability by introducing packet type classification. Different packet types (DHCP, IPx6, polling, and other packets) are assigned different authentication requirements. This parameter change allows the system to adjust authentication processing based on packet characteristics, reducing unnecessary processing overhead.
3Reliability
If all packets are treated as authentication targets, then no authentication packets are missed, but DHCP and IPx6 packets consume authentication resources before IPv4 address delivery
Solution Approach 1:
The patent applies preliminary action by pre-classifying packets into authentication target and non-authentication categories before authentication processing begins. The packet processing unit identifies packet types (DHCP, IPx6, polling) that require authentication and routes them appropriately, preventing unnecessary authentication processing from occurring in the first place and reducing overall processing time.
Solution Approach 2:
The patent extracts non-authentication packets (such as certain DHCP and IPx6 packets) from the authentication processing flow and handles them through the packet processing unit. This extraction removes unnecessary packets from the authentication pipeline, reducing authentication processing time while maintaining detection accuracy for packets that genuinely require authentication.
Data Source
AI summary
A packet relay apparatus keeps only packets specified as authentication target packets of MAC address authentication, to reduce the number of packets to be transferred from H/W to a CPU. In addition to a source MAC address, the authentication target packet of MAC address authentication is specified by an Ethernet type, a destination IP address, a protocol, a source port number and a destination port number of TCP/UDP, and the like. In this way, the packet relay apparatus excludes a terminal not transmitting authentication target packets of MAC address authentication, from the MAC address authentication target, while allowing selection from other authentication methods such as Web authentication and IEEE802.1X authentication.