Access Point Authentication Fallback During RADIUS Server Unavailability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network authentication systems, particularly in enterprise wireless networks, face issues such as RADIUS server overload and unavailability leading to delayed or failed IEEE 802.1x authentication, causing user frustration and network access barriers.
Innovation Solution
Electronic devices, like access points, perform authentication independently using predefined hash functions and parameters stored locally, generating encryption keys, and conducting four-way handshakes to establish secure communication, offloading authentication processes from centralized servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IEEE 802.1x authentication is forwarded to a remote RADIUS server for processing, then authentication can be centralized and managed, but the RADIUS server may become overloaded resulting in authentication delays or failures
Solution Approach 1:
The patent introduces a local cache memory as an intermediary between the authentication processor and the remote RADIUS server. This cache stores authentication data locally, allowing the system to mediate between centralized authentication management and local rapid verification, reducing server load and authentication delays
Solution Approach 2:
The system performs preliminary authentication actions by caching authentication data from the RADIUS server before actual connection requests occur. When connections are made, the cached data is readily available for rapid verification without requiring real-time server communication, thus preventing server overload
2Ease of operation
If authentication is centralized on a remote server, then authentication management is simplified, but when the server is unavailable clients cannot join the network
Solution Approach 1:
Authentication data is preliminarily obtained and cached from the RADIUS server before network connection needs occur. This preliminary action ensures that when the server becomes unavailable, the cached authentication information can still be used to allow network access
Solution Approach 2:
The system provides beforehand cushioning by storing backup authentication data in local cache memory. This cushioning mechanism protects against server unavailability, ensuring continuous network access even when the centralized authentication server is down
3Productivity
If authentication data is cached locally, then authentication speed improves, but security requirements must be maintained
Solution Approach 1:
The cache memory acts as a secure intermediary that stores authentication data in an protected manner. It enables rapid local authentication verification while maintaining security through controlled access and proper data protection mechanisms
Solution Approach 2:
Instead of storing sensitive raw authentication credentials, the system creates secure copies or hashes of authentication data in the cache. These copies enable verification without exposing the original sensitive information, thus maintaining security while enabling fast authentication
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An electronic device (such as an access point) that selectively performs authentication to a network is described. During operation, the electronic device provides an identity request addressed to the second electronic device. Then, the electronic device receives, associated with the second electronic device, an identity response. In response, when the authentication computer is unavailable, the electronic device accesses, in memory, a predefined hash function and associated authentication parameters for an authentication technique. Next, the electronic device performs authentication with the second electronic device based at least in part on the predefined hash function, where the authentication is compatible with the authentication technique (a type of EAP). Moreover, the electronic device generates an encryption key, and establishes secure communication with the second electronic device by performing a four-way handshake with the second electronic device based at least in part on the encryption key.