Network Switch Authentication for Native and Non-Native Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The complexity of security measures between different genres of devices (native and non-native) in networks poses a challenge, as existing technologies struggle to effectively authenticate and secure connections across diverse network devices.
Innovation Solution
A method is introduced that determines whether a device connected to a network switch is native or non-native based on LLDP and DHCP information, performing appropriate authentication (security certificate exchange for native devices or port-based Network Access Control messages for non-native devices) before allowing access to network resources, thereby securing the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If different authentication methods are used for native and non-native devices, then network security is improved, but device complexity increases
Solution Approach 1:
The authentication system is segmented into two distinct paths: one for native devices using certificate-based authentication and another for non-native devices using 802.1X authentication. The switch identifies device type and routes authentication requests accordingly, allowing each device genre to undergo appropriate authentication without interfering with the other, thus improving security while managing complexity through structured division
Solution Approach 2:
Different authentication qualities are applied locally to different device types. Native devices receive certificate-based authentication with full network access, while non-native devices receive 802.1X authentication with limited access. This local differentiation allows the system to optimize security measures for each device genre without imposing uniform complexity across all devices
2Reliability
If traffic limiting is implemented before authentication completion, then network security is improved, but productivity decreases
Solution Approach 1:
The system performs preliminary traffic limiting actions before authentication is complete by placing unauthenticated devices in a restricted VLAN. This preliminary constraint prevents potential security threats from accessing the network while still allowing the authentication process to proceed. Once authentication succeeds, the device is automatically moved to an appropriate VLAN, restoring full productivity
Solution Approach 2:
The system dynamically adjusts traffic flow based on authentication status. During authentication, traffic is limited to essential protocols only. Upon successful authentication, the system dynamically reconfigures the device's network access permissions, transitioning from restricted to full access. This dynamic approach maintains security during the vulnerable authentication period while ensuring productivity is restored immediately after authentication
Data Source
AI summary
Embodiments of a device and method are disclosed. In an embodiment, a method for network security involves determining whether a device connected to a network port of a switch of a network is a native device or a non-native device for the network and in response to determining whether the device is the native device or the non-native device for the network, performing native device authentication or non-native device authentication.