Hardware-Assisted RPC Client Authentication for Virtual Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face security issues in remote procedure communication (RPC) processes, such as identifying legitimate clients and preventing unauthorized access to virtual processing units, which can lead to data tampering and hijacking.
Innovation Solution
Implementing a key slot and key management system that verifies the authenticity of clients by matching inserted keys with stored key pairs, using a blocker to control communication access, and managing key registration and de-registration based on security levels and usage thresholds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a key verification system is implemented to authenticate clients, then security is improved, but device complexity increases
Solution Approach 1:
The patent introduces a key slot as an intermediary component between the RPC interface and the processing unit. This key slot receives and verifies authentication keys from clients before allowing communication to proceed, acting as a mediator that enhances security without requiring complex integration throughout the entire system architecture.
Solution Approach 2:
The authentication system is segmented into distinct functional components: the key slot for key reception and storage, the verifier for key validation, and the blocker for access control. This segmentation allows each component to perform its specific function independently, managing complexity through modular design while collectively providing robust security.
2Reliability
If a blocker is introduced to control communication access, then security is improved, but ease of operation deteriorates
Solution Approach 1:
The blocker is configured to automatically enable or disable based on key verification results before communication occurs. This preliminary action ensures that security checks are performed in advance, and the blocker's state is automatically adjusted according to authentication outcomes, reducing manual intervention while maintaining security.
Solution Approach 2:
The system implements self-service authentication where the key slot and verifier automatically manage the blocker's state based on key verification. The system serves itself by automatically enabling communication when keys match and disabling when they don't, without requiring external control logic, thereby maintaining ease of operation despite the added security layer.
3Reliability
If key verification is performed for each RPC communication, then security is improved, but productivity decreases
Solution Approach 1:
Authentication keys are verified in advance during the initial connection phase, and the blocker's state is determined before RPC communications begin. This preliminary verification allows subsequent communications to proceed without repeated key checking, reducing overhead and maintaining productivity while ensuring security.
Solution Approach 2:
Once authentication is successful and the blocker is enabled, communication can continue continuously without interruption or repeated verification. The blocker maintains its enabled state for the duration of authenticated sessions, allowing uninterrupted RPC communications and maintaining high productivity while security is preserved through the initial authentication barrier.
Data Source
AI summary
A device can include a remote protocol communication (RPC) slot configured to receive a message package generated from an entity during an RPC process, a processing unit configured to process the message package and return a result via the RPC slot to the entity, a blocker configured to be enabled to block or disabled to allow communication between the RPC slot and the processing unit, a key slot corresponding to the RPC slot and configured to receive a key from the entity, a key pool configured to store key slot and key pairs, and a verifier configured to disable the blocker when the key matches a key contained in one of the key slot and key pairs that contains the key slot and enable the blocker when the key does not match the key contained in any one of the key slot and key pairs that contains the key slot.