Enterprise IdP SSH Certificate Access Across Multiple Servers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise data infrastructures with multiple servers face challenges in managing complex credential governance and auditing, especially with scalability, as each server may require different login information, leading to tedious and time-consuming processes and increased security risks.
Innovation Solution
Leveraging enterprise Identity Provider (IdP) functionality for Single Sign-On (SSO) across Secure Shell (SSH) access, using a user's unique SSO identity and SSH certificates with a Time to Live (TTL) to streamline access and authentication, eliminating the need for local accounts and reducing security risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If each server requires different login credentials, then server access control is achieved, but credential management complexity increases
Solution Approach 1:
The patent implements a universal credential system where a single enterprise-issued credential can authenticate a user across multiple different servers. Instead of requiring separate credentials for each server, the system uses a centralized credential store that maps enterprise user identities to server access rights, allowing one credential to serve multiple authentication purposes across the infrastructure.
Solution Approach 2:
The patent introduces an intermediary credential store and authentication service that sits between the user and the servers. This intermediary component maintains the mappings between enterprise user identities and server credentials, and handles the authentication logic, thereby simplifying the credential management burden on both users and servers while maintaining granular access control.
2Reliability
If multiple credentials are maintained for different servers, then server-specific access rights are enforced, but user authentication time increases
Solution Approach 1:
The patent performs preliminary actions by pre-establishing credential mappings between enterprise user identities and server credentials during credential issuance or update events. When a user is granted access to a server or has their credentials updated in the enterprise system, these mappings are automatically updated in the credential store in advance, so that during authentication the system can quickly resolve the appropriate server credentials without requiring real-time computation or user intervention.
3Reliability
If credentials are updated or users leave/enter the enterprise, then access control accuracy is maintained, but credential mapping updates become more frequent and complex
Solution Approach 1:
The patent implements feedback mechanisms that automatically detect and respond to credential updates or user status changes in the enterprise system. When the enterprise directory service or identity management system is updated with new user information, revoked credentials, or changed access rights, the system receives feedback about these changes and automatically updates the corresponding credential mappings in the credential store, ensuring access control accuracy without manual intervention.
4Reliability
If traditional SSH certificates are used, then secure access is provided, but user identity visibility and auditing capability are reduced
Solution Approach 1:
The patent creates and uses copies of traditional SSH certificates that are embedded within the enterprise-issued credentials. Instead of relying on standalone SSH certificates that obscure user identity, the system generates certificate copies that contain or are associated with the enterprise user's identity information, allowing the authentication process to maintain SSH security while simultaneously providing visibility into which specific enterprise user is accessing which server for auditing purposes.
Data Source
AI summary
The disclosed technology provides for authenticating server access using enterprise credentials. A method can include authenticating, by a client computing device operating within an enterprise environment, a user with an enterprise identity provider (“IdP”) system that authenticates based on user enterprise credentials, receiving, in response to the user being authenticated, a bearer token from the system, transmitting the bearer token to a certificate service for use in obtaining a secure shell (“SSH”) certificate signed by an SSH certificate authority (“CA”) within the enterprise, receiving, at the client computing device, the signed SSH certificate, updating an SSH agent on the client computing device to use the SSH certificate with the enterprise identifier for the user, and remotely accessing any of a group of servers within the enterprise using the SSH certificate and enterprise identifier, where each server authenticates the remote access based on the SSH certificate signed by the SSH CA.