Hybrid Cloud Credential Encryption via Segmented Paths
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In hybrid cloud services, user credentials are vulnerable to exposure as they are transmitted externally, leading to potential unauthorized access and a poor user experience due to redundant authentication requirements across different cloud service providers.
Innovation Solution
A workspace cloud connector intercepts user identity credentials, encrypts them using AES, and generates a hash of the encryption key using SHA-2, transmitting the encrypted credentials and hash through an external cloud service while maintaining security by ensuring the external provider does not access plaintext credentials, and subsequently decrypts them using a virtual delivery agent for internal application access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If user credentials are transmitted through external cloud service for access to internal applications, then cloud service accessibility is improved, but credential security deteriorates due to potential exposure to cloud service provider and unintended recipients
Solution Approach 1:
The credential transmission process is segmented into multiple independent components: a workspace cloud connector that encrypts credentials locally, a hash of the encryption key that is transmitted through the cloud, and the actual encrypted credentials that are routed to a virtual delivery agent. This segmentation ensures that no single component has access to both the encryption key and the credentials, preventing credential exposure while maintaining cloud accessibility.
Solution Approach 2:
A workspace cloud connector acts as an intermediary between the user and the cloud service provider. It encrypts credentials using a locally-generated encryption key before transmission, and only a hash of this key is sent through the cloud. The actual credentials are delivered through a separate path to a virtual delivery agent, ensuring the cloud service provider never has access to plaintext credentials.
2Ease of operation
If cloud service provider relays communications to enable access to internal resources, then remote access capability is improved, but credential security deteriorates due to potential interception by unintended recipients
Solution Approach 1:
The workspace cloud connector performs preliminary encryption of credentials using a locally-generated encryption key before the credentials are transmitted through the cloud service provider's relay system. Additionally, a hash of the encryption key is transmitted through the cloud to a virtual delivery agent, which uses it to decrypt the credentials. This preliminary action ensures that even if communications are relayed or intercepted, the credentials remain encrypted and secure.
3Reliability
If user credentials are requested multiple times by different systems (login gateway and internal application), then security verification is improved, but user experience deteriorates due to redundant authentication
Solution Approach 1:
The authentication processes of the login gateway and the internal application are merged into a single unified authentication flow. The workspace cloud connector encrypts the user's credentials once using a locally-generated encryption key, and this single encrypted credential set is then used by both the login gateway and the internal application. The virtual delivery agent distributes the encrypted credentials to both systems, eliminating the need for users to authenticate multiple times while maintaining security verification through the encrypted credential validation by both systems.
Data Source
AI summary
Methods, systems, computer-readable media, and apparatuses may provide password encryption for hybrid cloud services. A workspace cloud connector internally residing with an entity may intercept user credentials associated with an internal application being transmitted to an external cloud service. The workspace cloud connector may generate an encryption key and encrypt the user credentials via a reversible encryption methodology. The workspace cloud connector may encrypt the encryption key using an irreversible encryption methodology (e.g., use a hashing function to produce a first hash). The workspace cloud connector may transmit the encrypted user credentials and the first hash to a virtual delivery agent via a first path (e.g., via the external cloud service). In response, the workspace cloud connector may receive an address of the virtual delivery agent and, using the address, may send the encryption key to the virtual delivery agent via a second path different from the first path.