Nested Virtualization SSO via Hypervisor Token Routing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing security arrangements for virtual machines in nested virtualization environments fail to implement single sign-on (SSO) effectively due to the lack of a two-way communication channel between the authentication server and nested virtual machines, leading to repetitive and time-consuming login processes.

Innovation Solution

The implementation of secure data communications tunnels between hypervisors and virtual machines to route authentication tokens, along with a key store and key controller to manage and transmit SSO tokens, ensuring seamless authentication across nested VMs.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If nested virtualization is implemented to enable multiple hypervisors on the same host server, then resource utilization and deployment flexibility are improved, but the complexity of authentication management increases due to the lack of two-way communication channels between authentication server and nested VMs

Engineering Contradiction:

Improvedeployment flexibilityVSAvoidauthentication management complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent introduces a hypervisor-level intermediary component that acts as a bridge between the authentication server and nested virtual machines. This intermediary establishes secure communication channels through the hypervisor layer, enabling the authentication server to send tokens to and receive status information from nested VMs without requiring direct two-way communication between the authentication server and individual nested VMs, thus resolving the complexity issue while maintaining deployment flexibility

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The authentication system is segmented into distinct functional components: an authentication server, a hypervisor-level communication layer, and individual nested VMs. Each component has a specific role, with the hypervisor layer handling token routing and the VMs handling local authentication. This segmentation allows the system to manage complexity by dividing the authentication management task across multiple independent components rather than requiring a monolithic solution

Inventive Principle:

Principle #1Segmentation

2Extent of automation

If traditional SSO is implemented in nested virtualization environments, then centralized authentication is improved, but the system fails because the host computer cannot forward authentication tokens to the correct nested VM

Engineering Contradiction:

Improvecentralized authenticationVSAvoidauthentication token delivery

Core Design Contradiction:

Extent of automationVSReliability

Solution Approach 1:

The hypervisor serves as a reliable intermediary that guarantees token delivery to the correct nested VM. The hypervisor maintains a mapping between authentication requests and nested VM instances, ensuring that tokens received from the authentication server are forwarded to the appropriate VM. This intermediary approach eliminates the reliability issue by providing a deterministic routing mechanism that traditional SSO lacks in nested virtualization environments

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary actions by establishing communication channels and token routing mechanisms before authentication occurs. The hypervisor pre-configures the pathways for token delivery and maintains state information about active authentication sessions, enabling reliable token forwarding when authentication requests are made. This preliminary setup ensures that when authentication is needed, the infrastructure is already in place to handle token delivery reliably

Inventive Principle:

Principle #10Preliminary action

3Reliability

If multiple login credentials are required for each nested VM, then security control is improved, but the time required for authentication increases due to repetitive login processes

Engineering Contradiction:

Improvesecurity controlVSAvoidauthentication time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent implements a universal authentication token that serves multiple nested VMs. Instead of requiring separate credentials for each VM, the system issues a single authentication token from the authentication server that can be used across multiple nested VMs. The hypervisor manages the distribution of this universal token to the appropriate VMs, enabling users to authenticate once and access multiple VMs without repeating the login process, thus reducing authentication time while maintaining security control

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS11805114B2Enhanced N-layer SSO controlled authentication for enterprise devices

Publication Date: 2023.10.31 DELL PROD LP

AI summary

A system, method, and computer-readable storage medium provide single sign-on (SSO) in a nested virtualization environment by routing authentication tokens received from an authentication server through the hierarchy of virtual machines (VMs) using secure data communications tunnels between each hypervisor and its respective VMs. A key store stores SSO authentication tokens for users of the nested VMs, and a key controller ensures that each login by a user to a separate VM is associated with its own token. Each login request is uniquely tagged to identify the particular VM requesting credentials, so that the responsive authentication token can be properly routed through the hierarchy. Moreover, session preferences may be associated with each user and/or each VM, enabling a rules evaluator to determine, for each login request, whether SSO functionality should be provided or whether the user should be required instead to provide new login credentials.