Proxy KDC Translates Kerberos Tickets for Unmodified Components
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant computing environments, existing security protocols like Kerberos struggle when software components, such as virtualized desktop services, cannot be modified to recognize Kerberos tickets, leading to security issues due to the exposure of user passwords across multiple components.
Innovation Solution
A modified Key Distribution Center (KDC) generates multiple instances of password information, including temporary passwords, which can be used to authenticate users, even in systems that only accept traditional passwords, and a proxy KDC can translate ticket encryption to facilitate access to unmodifiable KDCs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Kerberos authentication protocol is used with unmodified components, then secure authentication can be achieved, but compatibility issues arise when components cannot be modified to recognize Kerberos tickets
Solution Approach 1:
A proxy KDC is introduced as an intermediary between the client and the unmodified KDC. The proxy KDC receives Kerberos service tickets from the client, translates them into password information that the unmodified KDC can understand, and forwards the authentication process. This mediator enables secure Kerberos authentication while maintaining compatibility with components that cannot be modified.
2Adaptability or versatility
If password is exposed to multiple components for authentication, then access to various systems can be granted, but security problems such as data misrouting occur
Solution Approach 1:
The actual user password is extracted from the authentication flow and replaced with Kerberos service tickets. Instead of exposing the password to multiple components, the system uses ticket-based authentication where the password is never transmitted or stored in the distributed system. The KDC maintains the password securely and issues tickets that convey authentication information without exposing the underlying credential.
Solution Approach 2:
The patent creates a copy of the authentication mechanism using service tickets instead of the original password-based authentication. The service ticket is a derived credential that contains authentication information but is not the actual password. This copy allows authentication across multiple components without exposing the original password, thereby maintaining security while providing access flexibility.
3Stability of the object's composition
If unmodified components are used, then system stability is maintained, but authentication functionality is limited to credential-based login
Solution Approach 1:
The proxy KDC serves as a mediator that translates between Kerberos service tickets and the credential-based authentication mechanism of unmodified components. This allows users to authenticate using convenient Kerberos tickets while the unmodified components remain stable and unchanged. The intermediary handles the translation overhead, maintaining both stability and ease of operation.
Data Source
AI summary
Techniques are described for enabling a Kerberos-based authentication system to provide a client with access to a plurality of unmodifiable components that require plain text passwords. Such an approach enables a user to sign into a distributed computer system using a single password, and access multiple components that require different passwords without the need to enter a second password. By using Kerberos based authentication, passwords are not unnecessarily sent throughout distributed computing system where they may be vulnerable. A proxy key distribution center can be used to manage passwords or other credentials on behalf of various clients, which can be used with various processes discussed herein.