Connection Broker SSO for Remote Desktop Authentication

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Users face inconvenience in repeatedly entering credentials for accessing remote desktop sessions, as existing authentication protocols like Kerberos only confirm identity but require re-entering passwords for remote desktop access.

Innovation Solution

A single sign-on (SSO) authentication method where a user enters credentials once, with a connection broker authenticating the user and securely forwarding these credentials to the service, allowing automatic access without re-entry.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If Kerberos authentication protocol is used to confirm user identity, then user identity verification is achieved, but user still needs to re-enter password for remote desktop access

Engineering Contradiction:

Improveuser identity verificationVSAvoidcredential entry frequency

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent performs preliminary authentication by having the user enter credentials once to obtain a Kerberos ticket-granting ticket, then uses this ticket to obtain service tickets that automatically authenticate the user to remote desktop services without requiring re-entry of credentials

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces Kerberos tickets as an intermediary mechanism between user identity verification and service access. The ticket-granting ticket and service tickets act as mediators that carry user authentication information, eliminating the need for repeated credential entry while maintaining security

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If multiple authentication points (client device, hosting machine, connection broker) are implemented, then security is enhanced, but user credential entry complexity increases

Engineering Contradiction:

Improveauthentication securityVSAvoidauthentication process complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent merges multiple authentication operations into a single credential entry event. By combining the authentication at the client device, connection broker, and hosting machine into one unified Kerberos authentication flow, the system maintains multi-point verification while reducing user interaction to a single credential entry

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The Kerberos ticket-granting ticket serves multiple authentication purposes across different system components (client device, connection broker, hosting machine). This single authentication artifact enables universal access verification across all authentication points without requiring separate credential entries for each

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS12107844B2Single sign on for a remote user session

Publication Date: 2024.10.01 OMNISSA LLC

AI summary

A user accesses a remote session, the connection to which is managed by a connection broker, according to a single sign-on (SSO) process. The SSO process includes the user entering his or her credentials and being authenticated to the connection broker. In addition to user authentication, the SSO process includes connection broker authentication to confirm that the connection broker is trustworthy. When the connection broker is authenticated, the user credentials are transmitted to the connection broker in a secure manner and the connection broker forwards them onto a machine hosting the remote session so that the user can be logged into the remote session without entering his or her credentials again.