Per-Flow Network Access Using Proxy-Mediated Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network communication systems face challenges in efficiently managing time-sensitive processes like DNS queries and TCP handshake requests, which can time out before user authentication is complete, leading to inefficiencies and increased computational load.
Innovation Solution
Implementing a proxy server that enforces conditional access based on per-flow authorization statuses, using techniques such as synthesizing artificial CNAME records for DNS queries, establishing partial TCP connections for handshake requests, and dropping unauthorized UDP packets, to give users additional time for authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional network access control is implemented, then security is improved, but time-sensitive processes like DNS queries and TCP handshakes timeout before authentication completes
Solution Approach 1:
The system performs preliminary authentication setup by establishing a placeholder or pre-authenticated session state before the actual authentication process begins. This allows DNS queries and TCP handshakes to proceed without timeout while the user completes authentication, resolving the contradiction between security enforcement and time-sensitive process completion.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism that decouples the authentication process from the network access control. The intermediary allows time-sensitive processes to bypass traditional authentication timeouts by using a separate authentication channel, enabling both security and timely process completion.
2Reliability
If authentication is required for all network flows, then security is improved, but computational load and processing time increase
Solution Approach 1:
The patent segments network flows into different categories (time-sensitive vs. non-time-sensitive, authenticated vs. unauthenticated). By segmenting authentication requirements by flow type, the system applies authentication only where necessary, reducing overall computational load while maintaining security for critical flows.
Solution Approach 2:
Different authentication policies are applied to different network flows based on their characteristics. Time-sensitive flows receive preferential treatment with relaxed authentication timing, while other flows undergo full authentication. This local differentiation optimizes processing efficiency without compromising security.
Data Source
AI summary
This disclosure describes techniques for enforcing conditional access to network services. In an example method, a first computing device detects a second device operating in a per-flow authorization mode. The first device receives a first request from a second computing device to communicate with a third computing device using a first network flow and determines that the first flow is authorized (e.g., because of an active past authentication and/or the third device's authentication exemption). Data associated with the first request is transmitted to the third device. The first device then receives a second request to communicate with a fourth computing device using a second network flow and determines that the second flow is not authorized (e.g., because it is not associated with an active past authentication and/or the fourth device is not exempt from authentication). Data associated with the second request is not transmitted to the fourth device.