Wildcard Authentication Realms for Dynamic Network Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Defining authentication realms in a network is often time-consuming and cumbersome, and existing systems have constraints on the number of realms that can be defined, making it difficult to dynamically segment networks and track login activity.
Innovation Solution
A computer system that performs flexible authentication by using a network, allowing for partial matching of authentication realms with wildcard elements, enabling dynamic definition of new realms without preconfiguration, and supporting a larger number of realms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional authentication realm definition methods are used, then network security policy can be enforced, but the process is time-consuming and cumbersome requiring reconfiguration of network controllers
Solution Approach 1:
The system enables self-service authentication realm definition by allowing any user or device to dynamically define new authentication realms without requiring manual reconfiguration of network controllers. The controller automatically processes login requests with realm names and computes matches against predefined realms including wildcard patterns, enabling autonomous realm creation and management.
Solution Approach 2:
The system performs preliminary configuration by pre-defining authentication realms with wildcard elements (such as asterisks) in the network controller before actual authentication needs arise. This allows the controller to be prepared to handle various authentication realm patterns without requiring ad-hoc reconfiguration when new realms need to be defined.
2Adaptability or versatility
If existing network infrastructure is used, then network authentication can be performed, but constraints exist on the maximum number of realms that can be defined
Solution Approach 1:
The system implements universality by enabling a single network controller to handle an unlimited number of authentication realms through wildcard pattern matching. Instead of requiring separate configurations for each realm, the controller uses predefined patterns with wildcards that can match multiple realm names, making the controller universally applicable to various authentication scenarios without increasing complexity.
Solution Approach 2:
The system changes the parameter approach from exact string matching to pattern-based matching with wildcard support. This allows the authentication realm definition to transition from fixed, predefined values to flexible patterns that can accommodate dynamic realm names, thereby increasing adaptability without proportionally increasing device complexity.
3Adaptability or versatility
If wildcard elements are used in authentication realm matching, then flexible and dynamic realm definition is enabled, but partial matching computation is required
Solution Approach 1:
The system replaces complex mechanical pattern-matching operations with simplified computational string comparison. The controller computes partial matches by comparing the authentication realm from login requests against predefined realms containing wildcard patterns using efficient string matching algorithms, substituting complex decision logic with straightforward computational operations that are easier to implement and maintain.
Data Source
AI summary
During operation, a computer system may receive, from an electronic device, a login request, where the login request includes or specifies an authentication realm in a network. Then, the computer system may compute whether the authentication realm at least partially matches a predefined authentication realm in the network, where the predefined authentication realm in the network includes at least one wildcard element, and where the partial match is for elements in the predefined authentication realm other than the at least one wildcard element. When there is a partial match, the computer system may provide, to a second computer system, an authentication request based at least in part on the login request. Next, the computer system may receive, from the second computer system, an authentication response. When the authentication response indicates successful authentication, the computer system may provide, to the electronic device, a login response.