Silent Network Device Authentication via Discovery Wake-Up
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Certain network devices, known as silent network devices, fail to initiate authentication processes due to their static IP configuration and lack of automatic MAC address provision, leading to incomplete network security.
Innovation Solution
An access network device transmits silent device discovery messages, such as ICMP echo requests, to trigger silent network devices to provide their MAC addresses, facilitating authentication through a client-server model with Layer-3 network devices and RADIUS servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If port authentication is implemented to block unauthenticated devices, then network security is improved, but silent network devices with static IP configuration cannot be authenticated because they do not initiate DHCP or MAC address handshakes
Solution Approach 1:
Instead of waiting for the client device to initiate authentication requests (traditional approach), the access network device actively sends discovery messages to silent devices to trigger their response. This inverts the initiation direction, allowing silent devices with static IP configuration to be authenticated without requiring them to start the authentication process.
Solution Approach 2:
The patent introduces an intermediary discovery message mechanism between the access network device and silent devices. The access network device sends ICMP echo requests or other discovery messages that act as intermediaries to wake up silent devices and prompt them to provide their MAC addresses, enabling authentication without direct client initiation.
2Ease of manufacture
If silent network devices use static IP configuration without DHCP, then device simplicity and legacy compatibility are maintained, but authentication cannot be initiated because the devices do not provide MAC addresses automatically
Solution Approach 1:
The silent network device responds to discovery messages by providing its own MAC address information in the reply message. The device serves itself by automatically including authentication credentials in response to the access network device's inquiry, eliminating the need for manual configuration or external assistance.
3Device complexity
If access network devices wait for client-initiated authentication requests, then authentication process simplicity is maintained, but silent devices that do not send requests remain unauthenticated and blocked
Solution Approach 1:
The access network device performs preliminary actions by sending discovery messages before authentication can occur. This proactive approach wakes up silent devices and prompts them to provide authentication information, ensuring authentication completion before network access is granted, rather than waiting passively for requests.
Data Source
AI summary
In certain implementations, a computer system includes a processor and a non-transitory computer-readable storage medium storing programming for execution by the processor. The programming includes instructions to detect a connection, associated with a second network device, to a first of multiple ports of a first network device. The second network device may be a silent network device in an unauthenticated state. The programming includes instructions to transmit automatically, in response to failure to receive a physical address of the second network device, a silent device discovery message to the second network device via the first port, and to receive, from the second network device in response to the silent device discovery message, a device discovery reply message associated with the physical address of the second network device. The programming includes instructions to initiate authentication of the second network device using the physical address of the second network device.