RADIUS Proxy Server Local Authentication via EAP Challenge
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current RADIUS protocol-based architectures for IP network access management are limited in their ability to perform local authentication and provide additional services, as they cannot independently initiate a challenge/response exchange with a RADIUS client for local authentication.
Innovation Solution
A method and system that includes a proxy server capable of determining whether local authentication is needed, transmitting a challenge message to the user terminal, and executing local authentication procedures, while also handling remote authentication through a remote authentication server, allowing for the assignment of access rights based on both local and remote authentication results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a RADIUS proxy server is used to route authentication requests between access servers and remote authentication servers, then the system can support roaming users and distribute authentication load, but the proxy server cannot independently initiate local authentication challenge/response exchanges with users
Solution Approach 1:
The patent combines the functions of the RADIUS proxy server and RADIUS client into a single integrated system. The proxy server is enhanced with client capabilities, allowing it to directly communicate with user terminals using EAP-Challenge/Response authentication while simultaneously performing its traditional proxy function of relaying authentication requests to remote authentication servers. This merging eliminates the limitation of being unable to initiate local authentication while maintaining the distributed authentication architecture.
Solution Approach 2:
The RADIUS proxy server is designed to perform multiple functions: it acts as a traditional proxy for relaying authentication requests, functions as a RADIUS client to initiate challenge/response exchanges with users, and coordinates with remote authentication servers. This multi-functionality allows the system to provide both local authentication capabilities and support for roaming users without requiring separate dedicated systems for each function.
2Adaptability or versatility
If only remote authentication is performed through RADIUS protocol, then the system architecture remains simple and standardized, but additional local services and customized authentication procedures cannot be provided
Solution Approach 1:
The authentication process is segmented into distinct phases: local authentication through EAP-Challenge/Response exchange between the proxy server and user terminal, and remote authentication through RADIUS protocol exchange between the proxy server and remote authentication server. This segmentation allows each phase to be optimized independently - the local phase can provide customized services and procedures while the remote phase maintains standardized RADIUS protocol operation.
Solution Approach 2:
The RADIUS proxy server acts as an intermediary between the user terminal and the remote authentication server. It first performs local authentication directly with the user using EAP-Challenge/Response, then uses the result of this local authentication to initiate or influence the remote authentication process through standard RADIUS protocols. This intermediary role enables the system to provide additional local services while maintaining compatibility with standardized remote authentication procedures.
3Reliability
If the RADIUS protocol is strictly followed without modifications, then interoperability and standardization are maintained, but the system cannot perform tightened inspection on signaling or activate local authentication independently
Solution Approach 1:
The system implements dynamic authentication procedures where the proxy server can adapt its behavior based on the authentication context. It dynamically decides whether to perform local EAP-Challenge/Response authentication, how to coordinate with remote authentication servers, and what level of signaling inspection to apply. This dynamic approach allows the system to enhance security through optional tightened inspection and local authentication while maintaining flexibility in protocol implementation.
Solution Approach 2:
The proxy server modifies authentication parameters and procedures based on local policies and requirements. It can change the authentication flow by inserting local EAP-Challenge/Response exchanges, adjust signaling inspection levels, and modify how authentication results are processed and forwarded to remote servers. These parameter changes enable enhanced security and local service provision while maintaining overall RADIUS protocol compatibility.
Data Source
AI summary
In order to control the authorisation of a user during an attempt to access an IP transport network (5) by means of an access network (1, 2), a user terminal (11, 12, 13) emits an access request to an access supplier (6, 7, 8), containing data for authenticating the user to the access supplier, and said request is then transmitted to an access server (9) of the access network (1, 2) in view of being addressed to a remote authentication server (15) of the access supplier. On reception of the access request, the access server (9) emits a RADIUS request to a proxy server (10) of the access network (1, 2) which determines whether the user must be locally authenticated, and if this is the case, the proxy server transmits, to the access server (9), a request for authentication data to be addressed to the terminal of the user, and carries out a local procedure to authenticate the user, on the basis of the authentication data supplied by the user.