Hybrid Network Access Broker for Legacy and Cloud Host Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In hybrid computer networks, managing access to hosts with varying types, such as legacy and cloud hosts, is challenging due to the complexity of authenticators like certificates and key pairs, especially in virtualized environments where old or unused authenticators can lead to security vulnerabilities and inefficient access management.
Innovation Solution
An intermediate apparatus determines the type of host and selectively uses appropriate authenticators, such as certificates for cloud hosts and principal key pairs for legacy hosts, to manage access securely and efficiently, with features like ephemeral key pairs and short validity periods to enhance security and reduce key management complexity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If certificates are used for accessing hosts in a hybrid network, then security is improved, but device complexity and key management burden increase
Solution Approach 1:
The patent segments the authentication approach by host type, using certificates for cloud hosts and principal key pairs for legacy hosts. This segmentation allows each host type to use the most appropriate authentication method, reducing overall management complexity while maintaining security where needed.
Solution Approach 2:
The system provides a universal access mechanism that works across both legacy and cloud hosts through a common interface. The access broker translates between different authentication types (certificates and key pairs), allowing a single client implementation to access multiple host types without needing separate authentication logic for each.
2Ease of operation
If certificates with long validity periods are used, then ease of operation is improved, but security deteriorates due to persistent access rights
Solution Approach 1:
The patent implements dynamic session management where communication sessions are temporarily established based on authentication credentials, but the sessions themselves have limited duration. This dynamic approach allows easy access during authorized periods while automatically revoking access when sessions expire, resolving the contradiction between operational ease and security.
Solution Approach 2:
The system uses short-lived communication sessions instead of long-term persistent connections. Each session is created when access is needed and automatically terminates after use, similar to disposable objects. This eliminates the security risk of persistent access rights while maintaining ease of operation through automated session management.
3Reliability
If comprehensive scanning is performed to detect old or unused certificates, then security is improved, but loss of time increases
Solution Approach 1:
The patent performs preliminary authentication by verifying credentials before establishing communication sessions. This preliminary check ensures that only valid, authorized credentials are used without requiring comprehensive system-wide scanning. The authentication process itself serves as an efficient verification mechanism that avoids time-consuming full system scans.
Solution Approach 2:
The system implements self-service through automated session management and credential verification. The access broker automatically manages the lifecycle of authentication credentials and sessions, eliminating the need for manual scanning and management. This self-service approach maintains security while avoiding the time loss associated with comprehensive manual scanning.
4Adaptability or versatility
If multiple types of authenticators are used for different host types, then adaptability is improved, but device complexity increases
Solution Approach 1:
The patent introduces an access broker as an intermediary between clients and hosts. This mediator handles the complexity of different authentication types (certificates for cloud hosts, principal key pairs for legacy hosts) by translating and managing them centrally. The intermediary absorbs the management complexity while providing a simple interface to clients, resolving the contradiction between adaptability and complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A hybrid computer network environment can comprise a first type of hosts and a second type of hosts. An apparatus adapted to receive requests for access to hosts obtains authenticators for accessing the hosts. The apparatus can further determine the type of the hosts and process the requests for access using a first type of authenticator for access to the first type of hosts and a second type of authenticators for access to the second type of hosts.