Switch Port Authentication Using Device Attributes Instead of MAC Lists
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional switch port security systems are inefficient and prone to errors due to the need for extensive lists of MAC addresses for device authorization, which is impractical and time-consuming, especially in dynamic and large-scale networks, and do not effectively restrict access to specific types or brands of devices.
Innovation Solution
A method and system that utilize a network device to receive authentication requests, compare device attributes with access policies, and transmit authorization instructions to switch ports, allowing or denying access based on policy matches, with optional confidence scoring and administrator intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If MAC address lists are used to control unauthorized access to network via a switch port, then network security is improved, but the system becomes time intensive and impractical to maintain and update extensive lists of MAC addresses
Solution Approach 1:
The patent changes the authorization parameters from static MAC addresses to dynamic device attributes (device type, make, model, operating system, application). This allows the system to automatically evaluate and authorize devices based on their characteristics rather than requiring manual MAC address management, resolving the contradiction between security and maintenance time
Solution Approach 2:
The system enables self-service authorization by automatically comparing device attributes against access policies and making authorization decisions without manual intervention. The network device autonomously evaluates device characteristics and grants or denies access, eliminating the need for administrators to manually maintain extensive MAC address lists
2Reliability
If MAC address lists are used to control access, then unauthorized devices can be blocked, but the system becomes complex and error-prone with extensive lists of MAC addresses
Solution Approach 1:
The patent transforms the access control mechanism from managing extensive MAC address lists to evaluating device attributes (type, make, model, OS, application). This parameter change simplifies the system by replacing complex manual list management with automated attribute-based policy evaluation, reducing errors while maintaining effective access control
Solution Approach 2:
The patent introduces device attributes as an intermediary layer between the device and the access control decision. Instead of directly comparing MAC addresses, the system uses device characteristics as mediators to automatically determine authorization, simplifying the control mechanism and reducing complexity
3Reliability
If conventional port security systems are used, then some access control is provided, but the system does not scale efficiently in large-scale network environments
Solution Approach 1:
The system implements self-service authorization by automatically comparing device attributes against access policies without requiring manual intervention. This automated process scales efficiently in large networks as it eliminates the need for administrators to manually manage authorization for each device, maintaining high productivity while providing reliable access control
Solution Approach 2:
The patent creates a universal authorization system that handles diverse device types (IoT devices, laptops, smartphones, tablets, wearables, medical devices) through a single attribute-based policy framework. This multi-functional approach allows the system to efficiently manage access across large-scale networks with varied devices, improving productivity while maintaining security
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method, device, and system for controlling access to switch ports in communication networks is disclosed. The method may include receiving an authentication request associated with an end-device requesting access to a switch port of a switch within a communication network; comparing at least one device attribute associated with the end-device with an access policy associated with an access policy associated with the switch port; transmitting an authentication instruction associated with the end-device and the switch port to the switch based on a result of comparing. The authentication instruction comprises one of allowing the end-device access to the switch port based on the access policy and denying the end-device access to the switch port based on the access policy.