Portable Access Token Bridging for VM-to-Web Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems require users to provide detailed configuration and security information to launch web services from virtual machines, complicating the authentication process due to differing authentication requirements between virtual machines and web services.
Innovation Solution
An integrated authentication system that generates a local authentication token for a virtual machine, which is exchanged for a portable access token recognizable by the web service, allowing seamless session launch through automated handshakes among the virtual machine, provisioning service, and web service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional authentication systems are used separately for virtual machines and web services, then each system can maintain its own security requirements, but users must provide detailed configuration and security information multiple times, increasing operational complexity
Solution Approach 1:
The patent merges separate authentication systems for virtual machines and web services into a unified authentication mechanism. The virtual machine authentication system and web service authentication system are combined such that a single authentication event generates credentials that work for both services, eliminating the need for users to provide authentication information separately to each system while maintaining both security requirements
Solution Approach 2:
The authentication token generated by the virtual machine authentication system is designed to be universal, serving multiple functions: it authenticates the user to the virtual machine, validates the application's request to launch web services, and provides authorization for the web service session. This multi-functional token eliminates the need for separate authentication mechanisms
2Reliability
If separate authentication mechanisms are maintained for virtual machines and web services, then each service can enforce its own security policies, but the authentication process requires multiple steps and user inputs
Solution Approach 1:
The patent introduces an intermediary authentication token that mediates between the virtual machine authentication system and the web service authentication system. This token acts as a bridge, carrying authentication information from the virtual machine context to the web service context, thereby simplifying the authentication process while allowing both systems to enforce their security policies through the intermediary mechanism
3Reliability
If users manually provide authentication information for each service, then security requirements can be met, but user overhead and time consumption increase significantly
Solution Approach 1:
The patent implements preliminary authentication at the virtual machine level, where user credentials are verified in advance and an authentication token is generated before the user needs to access web services. This preliminary authentication action stores the security verification results in a form that can be reused for subsequent web service launches, eliminating the need for users to re-enter authentication information and significantly reducing authentication time while maintaining security
Data Source
AI summary
A method may include sending, to a provisioning service and by an application executing on a virtual machine, a local authentication token for a user of the virtual machine. The provisioning service may use the local authentication token to generate a portable access token. The method may further include receiving, from the provisioning service, the portable access token, and launching, by the application and for the user, a session in a web service by sending the portable access token to an application programming interface (API) of the web service.