Agentless Privileged Access With Ephemeral Network Credentials
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in managing privileged network resource access, particularly in large organizations, with persistent credentials leading to security vulnerabilities and difficulties in tracking user permissions, while just-in-time access solutions are cumbersome for end users and require agent installation.
Innovation Solution
A non-transitory computer readable medium provides agentless single sign-on for native access to secure network resources, using native clients and communication protocols, with multi-factor authentication and ephemeral credentials based on access policies, enabling secure, user-friendly access without requiring additional software installations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If persistent credentials are provided to users for accessing network resources, then ease of operation is improved, but security is worsened due to increased attack surfaces and difficulty in tracking permissions
Solution Approach 1:
The system transitions from static persistent credentials to dynamic ephemeral credentials that are automatically generated, distributed, and revoked. Access credentials have limited lifetimes and are renewed automatically, creating a dynamic security model that adapts to current access needs while minimizing long-term security risks
Solution Approach 2:
The patent introduces an intermediary credential management system that sits between users and network resources. This intermediary automatically manages credential distribution, validation, and revocation, eliminating the need for users to directly handle persistent credentials while maintaining ease of access
2Reliability
If just-in-time privileged access is implemented to minimize standing privileged accounts, then security is improved, but ease of operation is worsened due to requiring agent installation and use
Solution Approach 1:
The system implements self-service credential management where the credential management system automatically performs credential generation, distribution, validation, and revocation without requiring user intervention or agent installation. Users simply present their identity and the system handles the rest transparently
Solution Approach 2:
The patent creates a universal credential management system that works across multiple network resources and authentication protocols. The intermediary system provides a single interface that can manage credentials for various types of network resources without requiring resource-specific agents or modifications
3Reliability
If the number of standing privileged accounts is reduced through just-in-time access, then security is improved, but device complexity is worsened due to requiring additional access management infrastructure
Solution Approach 1:
The patent merges multiple access management functions into a single unified credential management system. By combining credential generation, distribution, validation, and revocation into one system, the overall device complexity is reduced compared to having separate systems for each function while maintaining strong security controls
Data Source
AI summary
Disclosed embodiments relate to providing dynamic and least-privilege access to network resources. Techniques include receiving a request from a network identity to access a network resource; authenticating the network identity using a native client and communication protocol; authorizing the network identity based on at least a first account of the network identity and according to one or more access policy; identifying a credential of an existing privileged account; creating a just-in-time session to the network resource to access the network resource using the retrieved existing privileged account; monitoring the just-in-time session; identifying, one or more action or command requested by the network identity within the native communication protocol; and continuously validating the one or more requested action or command according to the one or more access policy.