Out-of-band Network Access Control via Subnet Addressing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network access control systems face challenges with in-band control being uneconomical and out-of-band control being susceptible to hacking and requiring complex configuration, while also being infrastructure-dependent.
Innovation Solution
Implementing a DHCP server that uses subnet addressing to provide out-of-band network access control, allowing client devices to access network resources based on predefined policies by assigning IP addresses within specific subnets and managing client identifiers in lists associated with different access policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If in-band network access control is implemented using a secure controller, then network security is improved, but device complexity and cost increase
Solution Approach 1:
The patent extracts the access control logic from the data path by implementing out-of-band control through a management interface. The secure controller is removed from the critical data communication path, eliminating the need for complex in-band control devices while maintaining security functionality through separate management network control.
Solution Approach 2:
The patent introduces a management network as an intermediary channel for access control. Instead of controlling access directly within the data path, the system uses a separate management network to communicate control decisions to network devices, reducing the complexity of devices in the main data path.
2Device complexity
If out-of-band network access control is implemented, then device complexity is reduced, but security susceptibility increases due to API exposure
Solution Approach 1:
The patent merges the access control functionality directly into standard network devices (switches, routers) through their existing management interfaces. By combining the control plane and data plane in a coordinated manner and using standardized protocols, the system reduces the attack surface compared to exposing custom APIs while maintaining out-of-band control benefits.
3Ease of operation
If out-of-band control uses manufacturer-specific APIs, then device functionality is improved, but adaptability decreases
Solution Approach 1:
The patent implements universal access control by using standardized management interfaces (SNMP, CLI, REST APIs) that are commonly supported across different network device manufacturers. This allows a single out-of-band control system to manage multiple devices from different vendors, achieving infrastructure-agnostic control while maintaining full functionality.
Data Source
AI summary
A server responds to a DHCP request for an IP address by setting a subnet in accordance with whether the client's MAC address is recognized as previously having been authenticated or otherwise associated with a policy. If the client has not been authenticated, the server provides a captive portal to enforce authentication. A routing device positioned in the network between clients and the server controls access to network resources by routing communications from clients in accordance with subnet addressing, where each subnet is associated with a policy.