Authentication of network devices using access control protocols
Systems, methods, and computer-readable media for authenticating access control messages include receiving, at a first node, access control messages from a second node. The first node and the second node including network devices and the access control messages can be based on RADIUS or TACACS+ protocols among others. The first node can obtain attestation information from one or more fields of the access control messages determine whether the second node is authentic and trustworthy based on the attestation information. The first node can also determine reliability or freshness of the access control messages based on the attestation information. The first node can be a server and the second node can be a client, or the first node can be a client and the second node can be a server. The attestation information can include Proof of Integrity based on a hardware fingerprint, device identifier, or Canary Stamp.
1. A method comprising:
receiving, at a first node, one or more messages associated with a second node, the first node and the second node including network devices configured to communicate in a network;
obtaining, by the first node, attestation information from one or more fields of the one or more messages, the attestation information comprising at least one of proof of integrity data associated with the second node and proof-of-transit (POT) data identifying each hop traversed by the one or more messages and indicating an integrity of each hop traversed by the one or more messages; and
based on the attestation information, determining, by the first node, at least one of a reliability of the one or more messages, an integrity associated with the second node, and the integrity of each hop traversed by the one or more messages.
2. The method of claim 1 , wherein the integrity indicated by the POT data comprises an indication of at least one of an authenticity of each hop traversed by the one or more messages and a trustworthiness of each hop traversed by the one or more messages.
3. The method of claim 1 , wherein determining the integrity associated with the second node comprises determining at least one of an authenticity of the second node and a trustworthiness of the second node.
4. The method of claim 1 , further comprising:
receiving one or more responses from one or more network devices, each of the one or more responses comprising a random number;
combining a set of random numbers from the one or more responses into a single nonce; and
based on the single nonce, generating a signed result comprising the single nonce signed by the crypto-processor.
5. The method of claim 4 , further comprising: determining a freshness of the signed result based on the single nonce.
6. The method of claim 1 , wherein the one or more messages are based on a remote authentication dial-in user service (RADIUS) protocol, wherein the first node comprises one of a client or a server, and wherein the second node comprises a different one of the client or the server.
7. The method of claim 1 , wherein the one or more messages are based on a terminal access controller access control system plus (TACACS+) protocol, wherein the first node comprises one of a client or a server, and wherein the second node comprises a different one of the client or the server.
8. The method of claim 1 , wherein the attestation information comprises proof-of-integrity data based on at least one of metadata comprising a canary stamp, a hardware fingerprint, a proof-of-freshness of the one or more messages, a device identifier of the second node, and an attestation key.
9. The method of claim 1 , wherein the one or more fields comprise at least one of a type-length-value (TLV) field, an extension, and a modification to the one or more messages.
10. A system comprising:
one or more processors; and
at least one non-transitory computer-readable storage medium containing instructions which, when executed by the one or more processors, cause the one or more processors to:
receiving one or more messages associated with a node in a network;
obtain attestation information from one or more fields of the one or more messages, the attestation information comprising at least one of proof of integrity data associated with the node and proof-of-transit (POT) data identifying each hop traversed by the one or more messages and indicating an integrity of each hop traversed by the one or more messages; and
based on the attestation information, determine at least one of a reliability of the one or more messages, an integrity associated with the node, and the integrity of each hop traversed by the one or more messages.
11. The system of claim 10 , wherein the integrity indicated by the POT data comprises an indication of at least one of an authenticity of each hop traversed by the one or more messages and a trustworthiness of each hop traversed by the one or more messages.
12. The system of claim 10 , wherein determining the integrity associated with the node comprises determining at least one of an authenticity of the node and a trustworthiness of the node.
13. The system of claim 10 , wherein the at least one non-transitory computer-readable storage medium contains instructions which, when executed by the one or more processors, cause the one or more processors to:
receive one or more responses from one or more network devices, each of the one or more responses comprising a random number;
combine a set of random numbers from the one or more responses into a single nonce; and
based on the single nonce, generate a signed result comprising the single nonce signed by a crypto-processor.
14. The system of claim 13 , wherein the at least one non-transitory computer-readable storage medium contains instructions which, when executed by the one or more processors, cause the one or more processors to: determine a freshness of the signed result based on the single nonce.
15. The system of claim 10 , wherein the one or more messages are based on a remote authentication dial-in user service (RADIUS) protocol, wherein the system comprises one of a client or a server, and wherein the node comprises a different one of the client or the server.
16. The system of claim 10 , wherein the one or more messages are based on a terminal access controller access control system plus (TACACS+) protocol, wherein the system comprises one of a client or a server, and wherein the node comprises a different one of the client or the server.
17. The system of claim 10 , wherein the attestation information comprises proof-of-integrity data based on at least one of metadata comprising a canary stamp, a hardware fingerprint, a proof-of-freshness of the one or more messages, a device identifier of the node, and an attestation key.
18. The system of claim 10 , wherein the one or more fields comprise at least one of a type-length-value (TLV) field, an extension, and a modification to the one or more messages.
19. At least one non-transitory machine-readable medium containing instructions which, when executed by one or more processors of a first node, cause the first node to:
receive one or more messages associated with a second node in a network, the first node and the second node including network devices configured to communicate in a network;
obtain attestation information from one or more fields of the one or more messages, the attestation information comprising at least one of proof of integrity data associated with the second node and proof-of-transit (POT) data identifying each hop traversed by the one or more messages and indicating an integrity of each hop traversed by the one or more messages; and
based on the attestation information, determine at least one of a reliability of the one or more messages, an integrity associated with the second node, and the integrity of each hop traversed by the one or more messages.
20. The at least one non-transitory machine-readable medium of claim 19 , wherein the integrity indicated by the POT data comprises an indication of at least one of an authenticity of each hop traversed by the one or more messages and a trustworthiness of each hop traversed by the one or more messages, and wherein determining the integrity associated with the second node comprises determining at least one of an authenticity of the second node and a trustworthiness of the second node.