Non-Addressable Domain Controller Authentication Using Virtual Machine Tunnels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data management systems face challenges in authenticating non-addressable computing entities within private networks due to the inability to directly access domain controllers, leading to issues with creating machine accounts and routing connections, as the domain name system servers and domain controllers are also non-addressable.
Innovation Solution
A virtual machine is instantiated within the private network to create a tunnel for communication, allowing the data management system to obtain a list of available domain controllers and configure demultiplexing components to differentiate between incoming and outgoing traffic, enabling account creation and authentication requests without interception.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a data management system attempts to directly access domain controllers in a private network to authenticate non-addressable hosts, then authentication can be performed, but the system cannot establish direct connections because the domain controllers are non-addressable
Solution Approach 1:
The patent introduces an intermediary component (envoy virtual machine or network address translator) that mediates between the data management system and the non-addressable domain controllers. This intermediary translates external connection requests into internal network addresses, enabling the data management system to authenticate hosts without direct access to the private network's domain controllers.
2Ease of operation
If demultiplexing components monitor all ports to route packets, then incoming traffic can be properly directed, but outgoing authentication requests are intercepted and dropped
Solution Approach 1:
The patent segments the network communication into distinct pathways: incoming traffic continues to be monitored by the demultiplexer for proper routing, while outgoing authentication requests are routed through a separate path that bypasses the demultiplexer's interception point. This segmentation allows both functions to coexist without conflict.
Solution Approach 2:
An intermediary routing mechanism is introduced that identifies outgoing authentication requests and directs them through a bypass path that avoids the demultiplexer's monitoring and dropping behavior, while maintaining the demultiplexer's ability to handle incoming traffic routing.
3Reliability
If the data management system creates machine accounts at domain controllers, then authentication can proceed, but account creation fails because the domain controllers are non-addressable and inaccessible
Solution Approach 1:
The patent employs an intermediary (envoy virtual machine or network address translator) that enables the data management system to create machine accounts at domain controllers despite the domain controllers being non-addressable. The intermediary handles the complexity of private network access, translating external requests into internal network operations for account creation.
Solution Approach 2:
The system creates a virtual representation (copy) of the domain controller access pathway through the envoy virtual machine or network address translator, allowing account creation operations to be performed indirectly without requiring direct physical or network access to the actual domain controllers.
Data Source
AI summary
A data management system (DMS) may support authentication of a host using a non-addressable domain controller within a network. The DMS may obtain a list of domain controllers within the network and create an account at a domain controller on the list via a virtual machine instantiated within the network and used to create a tunnel between the DMS and the virtual machine The DMS may receive, via a port, a packet from a host within the network and route the packet, using a demultiplexer configured to monitor the port, to a storage entity. The storage entity may transmit, via the port to the domain controller, a request to authenticate the host, the request bypassing the demultiplexer that is configured not to monitor the port when the storage entity operates in a client mode. The DMS may receive an indication of whether the host is authenticated from the domain controller.