Hybrid Remote Desktop Logon Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing remote desktop solutions face challenges in allowing unauthenticated access to network resources without compromising security, as current methods either require additional credentials or create security vulnerabilities by granting broad access.
Innovation Solution
A hybrid logon method that combines local and domain credentials using a hybrid authentication package to create a local user identity linked to a domain logon session, enabling access to network resources without additional credentials while maintaining security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If unauthenticated local logon is used to access remote desktop, then ease of access is improved, but access to network resources is blocked
Solution Approach 1:
The patent combines local user account information with domain credentials into a hybrid authentication mechanism. The system merges the simplicity of local logon with the network access capabilities of domain credentials, allowing unauthenticated remote desktop access while simultaneously enabling network resource access through the integrated credential structure.
Solution Approach 2:
The hybrid authentication package creates a multi-functional logon mechanism that serves multiple purposes: it enables unauthenticated access to the remote desktop system, provides network resource access capabilities, and maintains session isolation. A single authentication structure fulfills multiple functions that previously required separate credential sets.
2Adaptability or versatility
If domain credentials are used to access network resources, then access to network resources is improved, but account management complexity increases
Solution Approach 1:
The patent extracts the credential management complexity from individual remote desktop hosts and centralizes it in the authentication package. Instead of managing domain accounts on each host, the system separates the authentication logic into a dedicated hybrid authentication package that handles credential integration, reducing the management burden on individual systems.
Solution Approach 2:
The hybrid authentication package acts as an intermediary between local user accounts and domain credentials. It mediates the authentication process by translating and integrating different credential types, eliminating the need for direct domain account management on each remote desktop host while still providing network resource access.
3Adaptability or versatility
If guest account with everyone permissions is used, then access to network resources is improved, but security is worsened
Solution Approach 1:
The patent applies local quality by creating unique local user identities for each remote desktop session while maintaining domain credential integration. Instead of using a universal guest account with broad permissions, each session receives tailored access rights through its own local user identity, providing network resource access while limiting the attack surface to session-specific permissions.
Solution Approach 2:
The system changes the authentication parameter from anonymous guest accounts to hybrid authenticated identities. By transforming the logon mechanism to use unique local user identities backed by domain credentials, the system maintains network resource accessibility while fundamentally altering the security model to prevent unauthorized access and information disclosure.
Data Source
AI summary
A hybrid account logon is disclosed for logging into remote desktops. In one embodiment, the hybrid logon combines local and domain accounts by building a local primary access token which provides credentials for local and domain-based accounts. In one embodiment, a credentials provider creates a serialized structure including both local account information and domain credentials and sends the serialized structure to a logon user interface (UI) process. The logon UI process calls a user authentication service that itself calls a hybrid authentication package which performs a domain logon, discards any identity associated with the domain logon session, and builds a local identity for the local account. The user authentication service then generates a primary access token including the local identity and the domain logon session data, thereby supporting interactive logon based on the local user identity which is also linked to network credentials for use in accessing network resources.