Trusted Platform Module Network Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network access control methods do not effectively utilize trusted platform modules (TPMs) for authenticating users and platforms, lacking comprehensive integrity validation and secure network entry mechanisms.
Innovation Solution
Implementing TPMs to generate and transmit system integrity credentials using protocols like IEEE 802.1x, which extend EAP to ensure secure network access by validating the integrity of client machines during boot time and dynamically measuring software and hardware metrics for authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional network access control methods (user logins, passwords, MAC addresses) are used, then network access can be controlled, but the security is insufficient due to lack of comprehensive integrity validation
Solution Approach 1:
The patent performs integrity measurements of hardware and software components during the boot process before network access is granted. The TPM captures platform integrity metrics (PCR values) representing the system state at boot time, creating a trusted baseline before the system connects to the network. This preliminary validation ensures the system is in a known good state prior to network authentication.
Solution Approach 2:
The patent introduces a TPM as an intermediary trusted component that mediates between the platform integrity and the network authentication system. The TPM generates credentials based on measured integrity values and transmits these credentials to the authentication server, serving as a trusted mediator that proves the platform's integrity without exposing sensitive internal state. This intermediary approach strengthens security while maintaining manageable complexity.
2Reliability
If TPM-generated credentials are transmitted using NAC protocols like IEEE 802.1x, then additional authentication layers are provided, but the authentication process becomes more complex
Solution Approach 1:
The patent leverages the universality of the IEEE 802.1x NAC protocol framework, which is already widely deployed in network infrastructure. By mapping TPM credential transmission onto this existing standardized protocol, the patent provides additional authentication layers without requiring proprietary or custom protocol implementations. The TPM credentials integrate with the existing EAP authentication flow, allowing multi-functionality where the same protocol handles both traditional user authentication and platform integrity verification.
3Reliability
If dynamic measurement of software and hardware metrics is performed during boot time, then system integrity is validated, but the authentication process takes longer
Solution Approach 1:
The patent performs all integrity measurements of critical system components (firmware, bootloader, OS kernel, drivers) during the boot process itself, capturing PCR values that represent the system state. By completing these measurements preliminarily during boot before network connection is established, the system validates integrity once during initialization rather than continuously during operation, minimizing the time impact on subsequent network authentication.
Solution Approach 2:
The patent creates a copy of the system's integrity state in the form of TPM-protected credential data (PCR values and associated authentication credentials). Instead of performing continuous real-time measurements during network authentication, the system captures and stores a snapshot copy of the integrity metrics during boot. This copied integrity state is then used for rapid authentication verification without requiring repeated measurements, significantly reducing authentication time while maintaining validation accuracy.
Data Source
AI summary
In response to a request received at an authentication server from a client to enter a network, the authentication server transmits a network access control (NAC) request to the client using a NAC protocol. The NAC request includes an identifier (ID) identifying a trusted platform (TP) credential that represents integrity of at least a portion of software and hardware configurations of the client. In response to a NAC response from the client, the authentication server compares the first TP credential with a second TP credential stored in a storage associated with the authentication server. The authentication server allows the client to enter the network if the first and second TP credentials are matched; otherwise, the client is prevented from entering the network.