TACACS+ Session Tracking via Attribute Value Registration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing TACACS+ packet tracking methods are inefficient and unreliable due to the lack of required information in response packets, such as user account, IP address, and port details, which hinders quick problem identification in commercial environments.
Innovation Solution
A method and device for processing and tracking TACACS+ sessions by registering attribute values in packets, analyzing request packets to save Session_id values, and comparing them with response packets to determine session status, ensuring accurate tracking of specific sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all TACACS+ packets are tracked to locate problems, then problem identification capability is improved, but system processing efficiency deteriorates
Solution Approach 1:
The patent extracts only the necessary tracking information (Session_id, attribute values) from TACACS+ packets rather than tracking all packet contents. This selective extraction approach maintains problem identification capability while significantly reducing the processing burden on the system.
Solution Approach 2:
The patent applies different processing quality to different packets: packets with matching attribute values receive full tracking attention, while other packets are processed minimally. This local quality differentiation ensures reliable problem identification for relevant sessions without uniformly impacting all packet processing.
2Reliability
If TACACS+ response packets contain complete information for tracking, then tracking reliability is improved, but packet size and transmission overhead increase
Solution Approach 1:
The patent performs preliminary action by embedding attribute values and Session_id in request packets before the actual authentication process. This allows the tracking system to have all necessary information available in advance, eliminating the need to add extensive information to response packets later.
Solution Approach 2:
The patent uses Session_id as a compact copy or reference that uniquely identifies a TACACS+ session without duplicating all session attributes in every packet. This single identifier enables reliable tracking while keeping packet sizes minimal.
3Measurement precision
If attribute values are embedded in TACACS+ packets for tracking, then session identification accuracy is improved, but packet structure complexity increases
Solution Approach 1:
The patent makes the TACACS+ packet structure multi-functional by incorporating attribute values that serve both their original authentication purposes and the additional function of session tracking. This eliminates the need for separate tracking structures, maintaining packet simplicity while enabling precise session identification.
Data Source
AI summary
A method and device for processing and tracking a TACACS+ session, wherein, the method includes: registering an attribute value in a TACACS+ packet of a TACACS+ session to be tracked; when a TACACS+ client receives a TACACS+ request packet, analyzing the TACACS+ request packet to judge whether an attribute value in the TACACS+ request packet is the same as the registered attribute value or not; if the two are the same, saving the Session_id value in the TACACS+ request packet; when the TACACS+ client receives a TACACS+ response packet, comparing the Session_id value in the TACACS+ response packet with a saved Session_id value, and if the two Session_id values are the same, setting the status of the corresponding TACACS+ session as successful. The embodiments of the present document track the TACACS+ response packet, so as to implement the function of tracking the whole TACACS+ session that conforms to specific conditions.