Session Authentication Reuse in Network Security Management

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In existing network security management systems, terminal device authentication is inefficient and resource-intensive due to repeated secondary authentication for each PDU session establishment, especially when multiple sessions are required with the same or different data networks.

Innovation Solution

A network security management method where a first network device, acting as an identity authenticator, utilizes stored authentication information from previous sessions to determine if fast authentication is possible for new sessions, allowing direct authorization when conditions match, thereby reducing redundant authentication processes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If secondary authentication is performed on a per session basis, then network security is ensured for each session, but authentication efficiency deteriorates and resource consumption increases

Engineering Contradiction:

Improvenetwork securityVSAvoidauthentication efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent performs secondary authentication in advance when a terminal device first accesses a data network, and stores the authentication result. For subsequent sessions with the same data network, the stored authentication result is reused, eliminating the need to repeat authentication. This preliminary action resolves the contradiction by ensuring security through initial authentication while improving efficiency through result reuse.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent creates a grouping relationship between authentication servers and data networks, where one authentication server group can serve multiple data networks. The authentication result obtained from one data network can be reused for accessing other data networks within the same authentication server group, making the authentication mechanism universal across multiple networks and sessions.

Inventive Principle:

Principle #6Universality (Multi-functionality)

2Reliability

If secondary authentication is performed for each PDU session establishment, then session security is guaranteed, but resource consumption increases significantly

Engineering Contradiction:

Improvesession securityVSAvoidresource consumption

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The patent performs secondary authentication in advance during the first session establishment with a data network, stores the authentication result, and reuses it for subsequent sessions. This preliminary authentication action ensures session security while avoiding repeated authentication resource consumption.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

Instead of discarding authentication results after each session, the patent recovers and reuses the stored authentication results for subsequent sessions with the same or related data networks, thereby reducing resource consumption while maintaining security.

Inventive Principle:

Principle #34Discarding and recovering

3Reliability

If authentication is repeated for multiple sessions with the same data network, then each session is securely authenticated, but authentication time increases

Engineering Contradiction:

Improveauthentication reliabilityVSAvoidauthentication time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent performs secondary authentication in advance and stores the result. When the terminal device needs to establish subsequent sessions with the same data network, the stored authentication result is directly reused, eliminating the need to repeat the authentication process and thereby reducing authentication time while maintaining reliability.

Inventive Principle:

Principle #10Preliminary action

4Reliability

If per-session secondary authentication is implemented, then security management is thorough, but system complexity increases

Engineering Contradiction:

Improvesecurity managementVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent establishes a grouping relationship between authentication servers and data networks, creating a universal authentication mechanism. One authentication server group can manage multiple data networks, and authentication results can be reused across networks within the same group, simplifying the overall system architecture while maintaining thorough security management.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS12549606B2Network security management method, and apparatus

Publication Date: 2026.02.10 HUAWEI INT PTE LTD

AI summary

Embodiments of this application provide a network security management method and an apparatus. The method includes: receiving, by a first network device, a session request sent by a terminal device, where the session request is used to request establishment of a first session with a first data network, the session request includes first authentication information for the first session, and the first authentication information includes identifier information of the first data network; obtaining, by the first network device, second authentication information for a second session of the terminal device, where the second authentication information includes identifier information of a second data network to which the second session is connected; and if the identifier information of the first data network is the same as the identifier information of the second data network, authorizing the terminal device to establish the first session with the first data network.