Synchronizing radius server databases using distributed ledger network

Patent metadata

Field	Value
Publication number	US-11240027-B2
Application number	US-201916266812-A
Country	US
Kind code	B2
Filing date	Feb 4, 2019
Priority date	Feb 4, 2019
Publication date	Feb 1, 2022
Grant date	Feb 1, 2022

Abstract

Implementations of the disclosure are directed to using a distributed ledger network to synchronize configuration changes across a network of servers that provide authentication, authorization, and accounting (AAA). In some implementations, a method includes: receiving, at a first server that provides AAA of users that access a network, a user request to update a configuration of a database of the first server, the database including authentication credentials for users that access the network, in response to receiving the user request, transmitting a transaction to the distributed ledger network for validation, the transaction comprising a request by the first server for each server of the distributed ledger network to update their respective database configuration in accordance with the user request; and after the transaction is validated by the distributed ledger network, the first server updating its database configuration in response to receiving the update comprising the validation of the transaction.

First claim

What is claimed is:

1. A method, comprising:
receiving, at a first server that provides authentication, authorization, and accounting (AAA) of users that access a network, a user request to update a configuration of a database of the first server, the database comprising authentication credentials for users that access the network, wherein the first server and least one other server that provides AAA of users that access the network communicate over a distributed ledger network including a distributed ledger;
in response to receiving the user request, transmitting a transaction to the distributed ledger network for validation, the transaction comprising a request by the first server for each of the servers of the distributed ledger network to update their respective database configuration in accordance with the user request;
receiving at the first server, an update to the distributed ledger from the distributed ledger network, the update comprising a validation of the transaction that was transmitted to the distributed ledger network; and
the first server updating its database configuration in response to receiving the update comprising the validation of the transaction;
receiving, at the first server, over the distributed ledger network, a second message from a second server, the second message comprising a second request to update a database configuration in accordance with a second user request, wherein the second request to update the configuration of the database comprises: a request to update one or more of: user credentials, user privileges, and an accounting of user access;
decrypting the received second message using a public key of the second server;
validating the second message, including the second request to update the database configuration in accordance with the second user request;
updating the distributed ledger with the validated second message; and
transmitting the update to the distributed ledger to the distributed ledger network.

2. The method of claim 1 , wherein the request to update the configuration of the database comprises: a request to update one or more of: user credentials, user privileges, and an accounting of user access.

3. The method of claim 2 , wherein the first server and the at least one other servers maintain a respective copy of the distributed ledger, the respective copy of the distributed ledger comprising a history of database configuration updates made by the servers.

4. The method of claim 2 , wherein the first server and the at least one other server are configured to maintain synchronized databases by updating their database configurations in response to validation by the distributed ledger network of requests to update database configurations.

5. The method of claim 1 , wherein the first server updating its database configuration in accordance with the user request, comprises: the first server updating a configuration file comprising one or more of: user credentials and user privileges.

6. The method of claim 5 , wherein the first server and the least one other server are Remote Authentication Dial-In User Service (RADIUS) servers.

7. The method of claim 1 , wherein the distributed ledger network is a blockchain network, wherein the distributed ledger is a blockchain, wherein the update to the distributed ledger from the distributed ledger network comprises a block, the block comprising a validation of the request to update the database in accordance with the user request.

8. The method of claim 1 , wherein a server of the distributed ledger validates the transaction by checking its database to determine that the configuration update can be made.

9. A non-transitory computer readable medium having executable instructions stored thereon, that, when executed by a processor, performs operations of:
receiving, at a first server that provides authentication, authorization, and accounting (AAA) of users that access a network, a user request to update a configuration of a database of the first server, the database comprising authentication credentials for users that access the network, wherein the first server and least one other server that provides AAA of users that access the network communicate over a blockchain network including a blockchain;
in response to receiving the user request, transmitting a transaction to the blockchain network for validation, the transaction comprising a request by the first server for each of the servers of the blockchain network to update their respective database configuration in accordance with the user request;
after the transaction is validated by the blockchain network, the first server updating its database configuration in accordance with the user request;
receiving, at the first server, over the distributed ledger network, a second message from a second server, the second message comprising a second request to update a database configuration in accordance with a second user request, wherein the second request to update the configuration of the database comprises: a request to update one or more of: user credentials, user privileges, and an accounting of user access;
decrypting the received second message using a public key of the second server;
validating the second message, including the second request to update the database configuration in accordance with the second user request;
updating the distributed ledger with the validated second message; and
transmitting the update to the distributed ledger to the distributed ledger network.

10. The non-transitory computer readable medium of claim 9 , wherein the first server and the least one other server are Remote Authentication Dial-In User Service (RADIUS) servers.

11. The non-transitory computer readable medium of claim 10 , wherein the request to update the configuration of the database comprises: a request to update one or more of: user credentials, user privileges, and an accounting of user access.

12. The non-transitory computer readable medium of claim 11 , wherein the first server and the at least one other server maintain a respective copy of the blockchain, the respective copy of the blockchain comprising a history of database configuration updates made by the servers.

13. The non-transitory computer readable medium of claim 11 , wherein the first server and the at least one other server are configured to maintain synchronized databases by updating their database configurations in response to validation by the blockchain network of requests to update database configurations.

14. The non-transitory computer readable medium of claim 10 , wherein the first server updating its database configuration in accordance with the user request, comprises: the first server updating a configuration file comprising one or more of: user credentials and user privileges.

15. The non-transitory computer readable medium of claim 10 , wherein a server of the distributed ledger validates the transaction by checking its database to determine that the configuration update can be made.

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Vijayan Renjith
• Sebastian Celestian K
• Raj Anil

Classifications

• H04L9/50

  using hash chains, e.g. blockchains or hash trees · CPC title

• H04L63/0892

  by using authentication-authorization-accounting [AAA] servers or protocols · CPC title

• G06F16/275

  Synchronous replication · CPC title

• H04L9/30

  Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy · CPC title

• H04L9/3239 Primary

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title