Off-host Authentication System Segregating Host Processor Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional information handling systems face security issues due to unauthorized access to host processors during user authentication, allowing unauthorized persons to manipulate the authentication process and gain access to the system.
Innovation Solution
An off-host authentication system is implemented, where an off-host processing system provides an encrypted primary authentication item to an authentication IHS, receives and decrypts an encrypted secondary authentication token, and uses it to retrieve a tertiary authentication token, which is then provided to the host processing system, segregating access to prevent unauthorized control of the host processor.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication credentials are verified by a host processor in the IHS, then user authentication can be performed, but unauthorized persons may gain access to the host processor and manipulate the authentication process
Solution Approach 1:
The authentication system is segmented into multiple independent components: an authentication client that collects credentials, an authentication server that verifies credentials, and a host processor that receives authentication results. This segmentation prevents unauthorized access to the host processor by isolating the authentication verification process in a separate trusted authentication server, thereby resolving the contradiction between maintaining authentication functionality and preventing unauthorized host processor access.
2Ease of operation
If authentication credentials are verified by a host processor, then the authentication process can be completed, but the host processor may be compromised and allow unauthorized access
Solution Approach 1:
The critical authentication verification function is extracted from the host processor and placed in a separate authentication server. The host processor only needs to communicate with the authentication client and receive authentication results, while the complex credential verification process occurs in the dedicated authentication server. This extraction maintains ease of operation for the overall system while improving host processor security by removing the vulnerable verification process.
3Reliability
If the authentication system uses multiple encrypted tokens and off-host processing, then security is enhanced, but the system complexity increases
Solution Approach 1:
An authentication server acts as an intermediary between the authentication client and the host processor, managing the complex encrypted token exchanges. The client and host processor have simplified interfaces, while the intermediary authentication server handles the sophisticated multi-token verification process. This intermediary approach enhances security through complex authentication protocols while keeping the overall system structure manageable by centralizing complexity in a dedicated component.
Data Source
AI summary
An off-host authentication system includes an authentication information handling system (IHS) that is coupled to a network. The off-host authentication system also includes a host processing system. An off-host processing system in the off-host authentication system is coupled to the host processing system and is coupled to the authentication IHS through the network. The off-host processing system provides an encrypted primary authentication item to the authentication IHS through the network. The off-host processing system then receives an encrypted secondary authentication token from the authentication IHS through the network. The off-host processing system then decrypts the encrypted secondary authentication token to produce a decrypted secondary authentication token and uses the decrypted secondary authentication token to retrieve a tertiary authentication token. The off-host processing system then provides the tertiary authentication token to the host processing system for use in logging a user into a user IHS that includes the host processing system.