Token-Based Requester Authentication for TACACS+ and RADIUS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing centralized authentication and authorization protocols like TACACS+ and RADIUS rely on usernames and passwords, which are vulnerable to security threats and expose sensitive information to interception and decryption, compromising network security.
Innovation Solution
Implement a custom authentication and authorization apparatus that uses multi-factor authentication and generates tokens for secure access, eliminating the need to transmit real credentials, and employs a lookup table to verify token validity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If username and password authentication is used in centralized authentication protocols, then ease of operation is improved, but network security deteriorates due to vulnerability to interception and decryption
Solution Approach 1:
The patent creates a copy of the authentication protocol that mimics the structure and format of TACACS+ or RADIUS protocols but replaces the authentication mechanism. Instead of transmitting actual usernames and passwords, the custom protocol transmits tokens that look like protocol credentials but are secured through multi-factor authentication. This allows the system to maintain protocol compatibility while eliminating the security vulnerability of transmitting real credentials.
Solution Approach 2:
The patent introduces a custom authentication protocol as an intermediary layer between the network device and the centralized authentication server. This intermediary protocol translates secure multi-factor authentication into a format compatible with existing TACACS+ or RADIUS infrastructure, allowing secure authentication without exposing credentials to the vulnerable transmission channel.
2Reliability
If real credentials are transmitted over the network, then authentication functionality is achieved, but loss of information increases due to exposure of sensitive data
Solution Approach 1:
The system creates a functional copy of credential transmission where tokens replace actual usernames and passwords. These tokens are generated through secure multi-factor authentication and are designed to look like protocol credentials but contain no sensitive information. The lookup table stores token-credential mappings locally, allowing authentication to proceed without transmitting real credentials over the network.
Solution Approach 2:
The patent extracts the sensitive credential verification process from the network transmission channel. Instead of sending credentials over the network, the system verifies credentials locally through multi-factor authentication, extracts only the necessary authentication result, and transmits a secure token instead of the actual credentials. This removes the vulnerable element from the transmission path.
3Object-affected harmful factors
If a custom authentication protocol is implemented, then network security is improved, but device complexity increases
Solution Approach 1:
The custom authentication protocol is designed to be universally compatible with existing TACACS+ and RADIUS infrastructure. It maintains the same message formats, packet structures, and communication protocols, allowing a single authentication server to serve multiple network devices without requiring separate custom implementations for each device type. The protocol handles both traditional username/password authentication and secure token-based authentication through a unified interface.
Solution Approach 2:
The authentication system performs self-verification through the lookup table mechanism. When a token is received, the authentication server automatically checks it against the stored token-credential mappings and returns the appropriate authentication result without requiring manual intervention or complex external verification processes. This automates the security verification and reduces operational complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
According to examples, an apparatus includes a processor that receives a request from a requester apparatus to access a target apparatus. The processor may provide a token valid to the requester apparatus upon determining that the requester apparatus is authenticated to access the target apparatus, in which the token complies with and is sent via a centralized authentication and authorization protocol. The processor may also receive an access check message from the target apparatus, in which the access check message includes the token and the identity of the requester apparatus. In addition, the processor may enable the target apparatus to control access to the requester apparatus. The apparatus disclosed herein enable for the retrofitting of secure multi-factor or one-time password authentication into systems that rely on a centralized authentication and authorization protocol, such as the TACACS+ or the RADIUS protocol.