One-Time Password Cloud Engine for VM Enterprise Connection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing systems face security challenges when connecting virtual machines (VMs) in public clouds to enterprise resources, as persistently stored passwords or credentials can be stolen, allowing unauthorized access.
Innovation Solution
A method and system that uses a cloud engine to generate or acquire a one-time password (OTP) and machine ID, which are used to establish a secure connection via a virtual private network (VPN) between the VM and the enterprise environment, ensuring that the OTP is not reusable and remains valid only for the initial connection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If a password or credential is stored persistently within the VM to enable automatic connection, then the connection automation is improved, but the security is worsened because the stored credential can be stolen by intruders
Solution Approach 1:
The patent implements one-time passwords (OTPs) that are generated for each connection attempt and become invalid after use. Instead of storing persistent credentials in the VM, the system uses disposable authentication tokens that are transmitted through the cloud provider's control plane during VM initialization, eliminating the security risk of stored credentials while maintaining automatic connection capability
Solution Approach 2:
The cloud provider's control plane infrastructure serves as an intermediary that securely transmits authentication credentials from the enterprise environment to the VM without requiring persistent storage within the VM. The OTP is generated and delivered through this trusted intermediary channel, enabling automatic authentication while preventing credential theft
2Productivity
If a VM connects automatically to enterprise resources, then the productivity is improved, but the security risk increases due to potential unauthorized access
Solution Approach 1:
The system implements periodic re-authentication using fresh one-time passwords for each connection session. The OTP is generated anew for each VM initialization event, ensuring that even if one credential is compromised, it cannot be reused for subsequent connections. This periodic regeneration of credentials maintains both automation and security
Solution Approach 2:
The authentication mechanism transitions from static persistent credentials to dynamic one-time passwords that change with each connection attempt. The OTP is generated based on temporal factors and VM identity, making the credential valid only for a specific time window and single use, thereby enabling automatic connection while preventing unauthorized access
Data Source
AI summary
Securely connecting a virtual machine in a public cloud to corporate resources. A cloud computing system is coupled to an enterprise computing system via a network. The enterprise computing system includes a management server, an authentication server and a virtual private network (VPN) server. A cloud engine runs on the management server. The cloud engine starts an exchange with the authentication server that leads to a state in which both parties know a one-time password (OTP) and an identifier (ID) of a virtual machine (VM) hosted by the cloud computing system. The cloud engine sends the OTP and the ID to the VM. The VPN server then receives credentials from the VM. If the credentials are successfully authenticated against the OTP and the ID, a secure connection is established between the enterprise computing system and the VM.