PKI Session Authentication Metadata for Router Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network systems lack efficient and secure methods for verifying the identity of devices participating in sessions, particularly in environments with limited connectivity or restricted access, leading to potential security vulnerabilities and inefficient access decision-making.
Innovation Solution
Implementing public key infrastructure (PKI) based session authentication, where devices provide identity context information and PKI information as metadata, allowing routers to cryptographically verify the identity and apply policy rules, eliminating the need for external queries and enhancing security within the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If routers query external devices for access decisions, then access control decisions can be made, but network connectivity requirements increase and security is compromised in restricted environments
Solution Approach 1:
The system performs preliminary authentication by embedding identity context information and digital signatures in packet metadata before packets traverse the network. Routers can make access decisions using pre-verified metadata without querying external devices, eliminating the need for continuous network connectivity to external authentication servers.
Solution Approach 2:
The patent introduces metadata as an intermediary carrier that transports identity context information and digital signatures between source devices and routers. This metadata serves as a self-contained authentication credential that routers can verify locally using public keys, replacing the need for direct communication with external authentication devices.
2Reliability
If PKI verification is implemented at routers, then security is improved, but device complexity increases
Solution Approach 1:
The system extracts authentication verification from external authentication servers and relocates it to routers. By embedding digital signatures and public keys directly in packet metadata, the verification process is simplified to local cryptographic operations at routers, reducing dependency on complex external authentication infrastructure.
Solution Approach 2:
Source devices self-authenticate by signing their own identity context information with private keys before transmission. This self-service authentication mechanism eliminates the need for routers to maintain complex authentication state or communicate with external authentication servers, simplifying router functionality to verification only.
3Reliability
If identity verification is performed for each packet, then security is enhanced, but processing time increases
Solution Approach 1:
The system establishes continuous authentication context by embedding identity information in metadata that persists throughout the packet's journey through the network. Once authenticated at the source, the same metadata is continuously verified at each router hop, eliminating repeated full authentication processes and maintaining security while reducing processing overhead.
Solution Approach 2:
Instead of performing complete authentication verification at every router, the system performs partial verification by checking digital signatures only once at the source and then validating the signature's authenticity at subsequent hops. This partial action approach maintains security while significantly reducing processing time at intermediate routers.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques are disclosed for public key infrastructure (PKI) based session authentication. An example network device includes one or more processors and memory coupled to the one or more processors. The memory stores instructions that, upon execution, cause one or more processors to: receive, from a source client device, a packet including a header for routing the packet to a destination client device specified within the header and metadata distinct from the header, the metadata specifying public key infrastructure (PKI) information and identity context information identifying a user or device participating in a session between the source client device and the destination client device; verify, based on the PKI information within the metadata, the metadata; and in response to verifying the metadata, apply, based on the identity context information, one or more policy rules for the session associated with the packet.