MFA Token Caching for Offline Session Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing desktop virtualization systems face challenges in enforcing multi-factor authentication (MFA) during offline conditions and cloud outages, as connection leases (CLs) are designed for longer validity periods but MFA services are typically available only when internet and identity provider cloud services are online.
Innovation Solution
A token generated during MFA is cached on the client device to verify previous MFA completion, allowing connection to a computing session even during offline conditions, with mechanisms to extend access and request new MFA authentication before token expiration, and adjust access levels when the identity provider is offline.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If connection leases are designed for longer validity periods to ensure continuous access, then availability is improved, but security is worsened because MFA services are unavailable during offline conditions
Solution Approach 1:
The system performs MFA authentication in advance before the offline period begins, obtaining and caching the authentication token while the identity provider is still available. This preliminary action ensures that security verification is completed before connectivity is lost, allowing the connection lease to remain valid during offline conditions without compromising security.
Solution Approach 2:
The authentication token acts as an intermediary that bridges the gap between the unavailable identity provider and the need for security verification. The token encapsulates the MFA verification result and can be validated locally by the computing device during offline conditions, eliminating the need for real-time connection to the identity provider while maintaining security.
2Object-affected harmful factors
If MFA authentication is enforced during every connection attempt, then security is improved, but availability is worsened during offline conditions when identity providers are unavailable
Solution Approach 1:
Instead of requiring real-time connection to the identity provider for MFA verification, the system creates a copy of the authentication proof in the form of a cached token. This token contains the necessary verification data to prove MFA completion without requiring the original identity provider system to be online, thus maintaining security while ensuring availability during offline conditions.
3Reliability
If connection leases are extended during offline conditions, then availability is improved, but MFA compliance is worsened
Solution Approach 1:
MFA authentication is performed in advance before the offline period begins, and the authentication result is cached in the form of a token. This preliminary MFA compliance action ensures that security requirements are met before connectivity is lost, allowing the connection lease to be extended during offline conditions while maintaining MFA compliance through the cached verification.
Data Source
AI summary
A computing device includes a memory and a processor configured to cooperate with the memory to receive a connection lease and a token from a client device, with the token being generated responsive to the client device completing multi-factor authentication (MFA) with a provider of MFA. The processor further verifies, responsive to unavailability of the provider of MFA, that the client device has previously performed MFA based upon the token, and connect the client device to a computing session with use of the connection lease and responsive to the verification that the client device has performed MFA.