SNPN Access Control via External Credential Configuration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Communications devices without network credentials cannot access standalone non-public networks (SNPNs) for authentication, leading to authentication-related information unavailability and potential security risks.
Innovation Solution
A method involving sending index, vendor, and address-related information to a target end to request credentials or indicate restricted access types, along with operations based on obtained information to authenticate and configure devices, utilizing external authentication servers and configuration servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If communications devices without network credentials attempt to access SNPN, then device connectivity is enabled, but authentication information becomes unavailable and security risks increase
Solution Approach 1:
The patent applies preliminary action by pre-configuring credentials in communications devices before they are deployed to the network. The credential configuration server prepares authentication credentials in advance and delivers them to devices through a data channel established before actual network access attempts, ensuring authentication information is available when needed.
Solution Approach 2:
The patent introduces a credential configuration server as an intermediary between the SNPN and communications devices. This server acts as a mediator that receives authentication credentials from the network, stores them, and delivers them to devices that need to authenticate, resolving the information availability problem without compromising security.
2Ease of operation
If credentials are pre-configured in devices, then authentication becomes possible, but device complexity and credential management overhead increase
Solution Approach 1:
The patent implements self-service by enabling communications devices to autonomously obtain and configure their own credentials without manual intervention. The device initiates the credential acquisition process by establishing a data channel to the credential configuration server, which then automatically delivers the appropriate credentials, reducing operational complexity.
Solution Approach 2:
The patent merges the credential storage and management functions into the device's existing configuration management infrastructure. Rather than creating separate complex credential management systems, the solution integrates credential handling with the device's standard configuration processes, simplifying overall system complexity.
3Productivity
If all devices are allowed to access the network, then connectivity is maximized, but security attacks and unauthorized access increase
Solution Approach 1:
The patent applies preliminary anti-action by implementing a credential verification mechanism before devices are allowed to access the SNPN. The credential configuration server verifies device legitimacy and pre-configures valid credentials, preventing unauthorized devices from attempting network access in the first place, thus countering security threats before they can materialize.
Solution Approach 2:
The patent implements feedback by establishing a two-way communication channel between the credential configuration server and communications devices. The server receives requests from devices, verifies their legitimacy, provides appropriate credentials, and can update or revoke credentials as needed, creating a dynamic security system that responds to actual network conditions and threat levels.
Data Source
AI summary
An access control method and a communications device are provided. The method includes: sending first information and/or first indication information to a first target end, where the first information includes at least one of the following: index information of a second authentication server, vendor-related information of the first communications device, and address-related information of the second authentication server; and the first indication information is used for requesting to obtain a credential related to a first network, or used to indicate that an access type is a restricted service.