Network Relay Terminal Status Management via Confirmation Packets

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current network authentication methods, such as Web authentication, lack the capability to effectively manage the connection status of terminal devices, leading to potential security vulnerabilities when authenticated devices are detached from the network, allowing fraudulent devices to connect using the same MAC address.

Innovation Solution

A network relay device equipped with a communication unit, authentication processing unit, DHCP snooping processing unit, and terminal search processing unit, which manages the connection status by sending confirmation data to authenticated terminal devices and cancels authentication if no response is received, preventing unauthorized access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If Web authentication is used to authenticate terminal devices, then authentication versatility is improved, but the ability to detect detached terminal devices is lost

Engineering Contradiction:

Improveauthentication versatilityVSAvoiddetection of detached terminal devices

Core Design Contradiction:

Adaptability or versatilityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent implements a feedback mechanism where the authentication switch actively sends confirmation packets to authenticated terminal devices and processes their responses. This feedback loop enables the switch to detect whether terminal devices are still connected to the network, resolving the detection capability loss while maintaining Web authentication versatility.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent performs preliminary actions by maintaining authentication information in the authentication management table even after terminal devices detach. The switch proactively sends confirmation packets before completely removing authentication records, allowing it to detect detached devices and prevent fraudulent connections in advance.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If authentication information is maintained after terminal detachment, then security is improved, but fraudulent MAC address usage can occur

Engineering Contradiction:

Improvenetwork securityVSAvoidfraudulent connection risk

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The authentication switch uses feedback through confirmation packet exchanges to continuously verify terminal device presence. When no response is received, the switch deletes authentication information from the management table, preventing fraudulent MAC address usage while maintaining security for actively connected devices.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent implements dynamic authentication information management where authentication records are not statically maintained but dynamically updated based on terminal response status. The system transitions authentication states from active to detached based on real-time confirmation packet responses, eliminating fraudulent connection risks while preserving security.

Inventive Principle:

Principle #15Dynamics

3Measurement precision

If confirmation packets are sent to all authenticated terminals, then connection status detection is improved, but network traffic increases

Engineering Contradiction:

Improveconnection status detection accuracyVSAvoidnetwork traffic volume

Core Design Contradiction:

Measurement precisionVSQuantity of substance

Solution Approach 1:

The patent applies partial action by sending confirmation packets selectively rather than continuously to all authenticated terminals. The system sends confirmation packets at appropriate intervals and only to terminals that require status verification, achieving adequate detection accuracy while minimizing unnecessary network traffic.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS8910248B2Terminal connection status management with network authentication

Publication Date: 2014.12.09 ALAXALA NETWORKS

AI summary

A network relay device includes a communication unit, an authentication processing unit, a DHCP snooping processing unit, and a terminal search processing unit. The authentication processing unit creates first information specifying an authenticated terminal device according to web authentication, and manages whether relay of communication data between a terminal device and a node on the specified network is permissible based on the first information. The DHCP snooping processing unit executes snooping of DHCP communication data between a terminal device and a DHCP server, and creates second information specifying a layer 3 address allocated to each terminal device. The terminal search processing unit specifies an authenticated terminal device based on the first information, specifies a layer 3 address allocated to the specified authenticated terminal device based on the second information, and causes the communication unit to send, to the specified layer 3 address, confirmation communication data.