Host Authentication via Non-Addressable Domain Controller Tunneling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data management systems face challenges in authenticating non-addressable hosts within private networks due to the inability to directly access domain controllers, leading to issues with creating machine accounts and routing connections, as the domain name system servers and domain controllers are also non-addressable.
Innovation Solution
A virtual machine is instantiated within the network to create a tunnel for communication, allowing the data management system to obtain a list of available domain controllers and configure demultiplexing components to differentiate between incoming and outgoing traffic, enabling account creation and authentication requests without interception.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a data management system attempts to directly access domain controllers for host authentication, then authentication can be performed, but the system cannot access non-addressable hosts within private networks
Solution Approach 1:
The patent introduces an intermediary component (such as a proxy server or gateway) that acts as a mediator between the data management system and non-addressable hosts within private networks. This intermediary enables the system to access hosts that would otherwise be unreachable, resolving the contradiction by providing network accessibility while maintaining authentication capability through the intermediary's coordination with domain controllers
2Ease of operation
If the data management system uses traditional authentication methods with non-addressable domain controllers, then authentication requests can be sent, but machine accounts cannot be created and connections cannot be routed
Solution Approach 1:
The patent applies preliminary action by pre-configuring authentication parameters, machine account templates, and routing rules before the actual authentication process. This allows the system to send authentication requests successfully while ensuring that machine accounts can be created and connections routed properly, as the necessary infrastructure is already in place to handle the complete authentication workflow
3Reliability
If the data management system attempts to access domain controllers directly, then authentication can occur, but the system cannot differentiate between incoming and outgoing traffic
Solution Approach 1:
The patent applies local quality by implementing traffic differentiation mechanisms at specific local points within the network architecture. The system introduces localized components (such as demultiplexers or traffic managers) that can distinguish between incoming and outgoing traffic based on local characteristics like source/destination addresses, ports, or protocol signatures, enabling reliable authentication while managing traffic complexity through targeted local differentiation rather than system-wide complexity
Data Source
AI summary
A data management system (DMS) may support authentication of a host using a non-addressable domain controller within a network. The DMS may obtain a list of domain controllers within the network and create an account at a domain controller on the list via a virtual machine instantiated within the network and used to create a tunnel between the DMS and the virtual machine The DMS may receive, via a port, a packet from a host within the network and route the packet, using a demultiplexer configured to monitor the port, to a storage entity. The storage entity may transmit, via the port to the domain controller, a request to authenticate the host, the request bypassing the demultiplexer that is configured not to monitor the port when the storage entity operates in a client mode. The DMS may receive an indication of whether the host is authenticated from the domain controller.