Segment Security for Multi-Host Port Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The use of per-port access control lists (ACLs) in network devices limits scalability and disrupts traffic when multiple hosts connect to the same port, as each host's authentication requires updating the ACL, affecting already authenticated hosts.
Innovation Solution
Implementing segment security by configuring network devices to use segments with their own access levels, identified by segment IDs, allowing multiple hosts to connect to a single port without impacting each other, using MAC address or IP address to segment ID mappings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If per-port access control lists (ACLs) are used to authenticate hosts, then authentication security is improved, but scalability deteriorates and traffic disruption occurs when multiple hosts connect to the same port
Solution Approach 1:
The patent divides the port-level ACL security model into host-level segments. Each host receives a unique host ID that maps to its MAC address, allowing individual host authentication and ACL management. This segmentation enables multiple hosts on the same port to have independent security policies without disrupting each other's traffic, resolving the scalability issue while maintaining authentication security.
2Ease of operation
If per-port ACLs are updated for each host authentication, then authentication control is improved, but traffic disruption to already authenticated hosts occurs
Solution Approach 1:
The patent implements local quality by creating host-specific ACL entries tied to unique host IDs rather than port-level ACLs. When a new host authenticates, only that host's specific ACL entry is created or updated, leaving other hosts' ACL entries unchanged. This localized approach maintains authentication control while preventing traffic disruption to already authenticated hosts.
3Adaptability or versatility
If multiple hosts connect to a single port, then port utilization is improved, but authentication process interference increases
Solution Approach 1:
The patent introduces host ID as an intermediary between the host's MAC address and the ACL system. The host ID uniquely identifies each host and serves as the key for mapping authentication credentials to specific ACL entries. This intermediary mechanism allows multiple hosts on a single port to be managed independently, improving port utilization while reducing authentication process interference through clear host identification and isolation.
Data Source
AI summary
In general, embodiments relate to a method for managing a network device, including receiving an incoming frame originating from a host, where the incoming frame includes IP address of the host and a payload specifying information associated with an external server. The further includes determining, using the IP address of the host and an IP address to segment identifier (ID) mapping, that the host is associated with a first segment, in response to the determining, forwarding the incoming frame towards a redirection server executing on the network device, where the first segment is associated with a first policy and where the first policy specifies that the incoming frame is to be forwarded to the redirection server. The method further includes receiving a redirection frame including a uniform resource locator (URL) of a captive portal, transmitting the redirection frame towards the host, wherein the user of the host is authenticated by the captive portal based, at least in part, on the redirection frame, and associating, after the user of the host has been authenticated by the captive portal, the host with a second segment, where the segment second permits the host to access the external server.