RADIUS Authentication Server Approver Selection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current additional authentication procedures for accessing restricted data resources, such as VPNs, are insecure when relying on a single pre-registered approver and become less secure with multiple approvers, while also being cumbersome and incompatible with standardized protocols like RADIUS.

Innovation Solution

The authentication server prompts the user to select an approver ID during the initial login, which is then verified and used to send an approval request to the approver's device, allowing multiple authorized approvers to approve access without compromising security, all while maintaining compatibility with the RADIUS protocol.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If a single pre-registered approver is used for additional authentication, then the authentication procedure is simple, but the security is compromised when the approver is not present and the system becomes cumbersome

Engineering Contradiction:

Improveauthentication procedure simplicityVSAvoidauthentication reliability

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The system dynamically selects which approver to contact based on user input at authentication time, rather than relying on a fixed single approver. This allows the authentication process to adapt to availability of different approvers while maintaining security through user-selected approver assignment.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system changes the parameter of approver selection from a static pre-assigned approver to a dynamic user-selected approver from a registered list. This parameter change enables flexibility in approver availability while maintaining security through controlled selection from authorized approvers only.

Inventive Principle:

Principle #35Parameter changes

2Productivity

If multiple pre-registered approvers are used to handle authentication when the primary approver is unavailable, then the authentication availability is improved, but the security level is lowered

Engineering Contradiction:

Improveauthentication availabilityVSAvoidsecurity level

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The system performs preliminary registration of multiple authorized approvers before the authentication event. This preliminary action establishes a controlled list of trusted approvers, allowing the system to contact multiple approvers when needed while maintaining security through pre-authorized selection.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The authentication server acts as an intermediary that manages the list of registered approvers and routes approval requests appropriately. This intermediary role allows multiple approvers to be involved in the authentication process while maintaining security through centralized control and verification of approver identities.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If an additional authentication procedure with approver approval is implemented, then the security is strengthened, but the ease of use is reduced and compatibility with standardized protocols is compromised

Engineering Contradiction:

Improveauthentication securityVSAvoidease of use

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The authentication system is designed to perform multiple functions: it can handle traditional username/password authentication, OTP-based authentication, and approver-based authentication all through the same RADIUS protocol infrastructure. This multi-functionality allows the system to implement enhanced security while maintaining compatibility with standardized protocols and existing systems.

Inventive Principle:

Principle #6Universality (Multi-functionality)

4Reliability

If an additional authentication procedure with approver approval is implemented, then the security is strengthened, but the complexity of the system increases

Engineering Contradiction:

Improveauthentication securityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The authentication server serves as an intermediary that manages the complexity of multiple authentication methods and approver coordination. By centralizing the logic for handling different authentication types and approver selection in the authentication server, the system maintains security through enhanced procedures while keeping the overall system architecture relatively simple and compatible with existing RADIUS infrastructure.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11777941B2Methods and authentication server for authentication of users requesting access to a restricted data resource using authorized approvers

Publication Date: 2023.10.03 MIDEYE

AI summary

Disclosed is a method performed by an authentication server for authentication of users requesting access to a restricted data resource from a communication device, the authentication server being situated in the restricted data resource. After checking that a username and password received from a communication device matches a stored username and password, the authentication server sends, using the RADIUS protocol, a request to the communication device to enter an approver ID. After receiving an approver ID from the communication device in response to the request, via the RADIUS protocol, the authentication server sends an approval request including user ID to an approver device indicated by the approver ID, and if the approver approves the request, the authentication server receives an accept to the approval request and grants the user access to the restricted data resource.