ML Microsegmented VDI Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtual desktop infrastructure (VDI) systems face challenges in securing user authentication, as unauthorized entities can access virtual desktops by stealing usernames and passwords, necessitating additional authentication methods to prevent unauthorized access.
Innovation Solution
Implementing a method that uses machine learning models, including supervised and unsupervised models, to authenticate users by analyzing device features and providing access to virtual desktops within a virtual computing instance, with an optional secondary authentication step and micro-segmentation for restricted access if primary authentication fails.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional username and password authentication is used for virtual desktop access, then ease of operation is improved, but security deteriorates as unauthorized entities can steal credentials and gain access
Solution Approach 1:
The authentication process is segmented into multiple independent verification stages: initial credential verification, device feature extraction, machine learning model evaluation, and secondary authentication if needed. Each segment performs a specific function, transforming single-factor authentication into a multi-layered security approach that maintains ease of use while dramatically improving security.
Solution Approach 2:
A machine learning model acts as an intermediary between the authentication credentials and the virtual desktop access decision. This intermediary analyzes device features and behavioral patterns to determine whether the authenticated user is legitimate, adding a layer of intelligent verification that blocks credential theft while allowing legitimate users seamless access.
2Reliability
If machine learning models are added to the authentication process, then security is improved, but device complexity increases
Solution Approach 1:
The machine learning model performs self-service by automatically analyzing device features and making authentication decisions without requiring manual intervention from administrators or users. The system self-adjusts by learning from authentication patterns, reducing the operational complexity despite the advanced algorithms employed.
Solution Approach 2:
The system applies partial action by only invoking the machine learning model when authentication credentials are initially verified, not for every single access attempt. Secondary authentication is triggered only when the ML model detects suspicious patterns, reducing overall system complexity while maintaining high security for legitimate users.
3Reliability
If microsegmentation is implemented for restricted access, then security is improved, but ease of operation deteriorates due to additional access restrictions
Solution Approach 1:
Microsegmentation applies local quality by granting different access permissions to different users based on their specific roles and requirements. Instead of a blanket restriction or full access policy, each user receives precisely the access level needed for their function, making security restrictions feel natural and necessary rather than arbitrary obstacles.
Solution Approach 2:
Access permissions are dynamic rather than static, adjusting in real-time based on the user's authentication status, device characteristics, and current security context. The system dynamically grants or restricts access to specific virtual desktops or resources based on the evaluated risk level, maintaining ease of operation for legitimate users while providing granular security control.
Data Source
AI summary
The disclosure provides an approach for authenticating a user of a computer system, wherein the computer system implements a virtual desktop infrastructure (VDI), the method comprising connecting to a computing device through a network, receiving from the computing device authentication credentials, and determining whether the authentication credentials match an authorized user of the computer system. The approach further comprises extracting from the computing device features of the computing device, retrieving a machine learning (ML) model associated with the authorized user, wherein the ML model is at least one of (a) a supervised ML model or (b) an unsupervised ML model, and executing the ML model to authenticate the features of the computing device.