Proxy SSH Public Key Authentication in Cloud Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
SSH public-key management is complex in large organizations due to the need for users to upload their SSH public-keys to each server they need to access, and this process becomes cumbersome for key renewal or removal from login.
Innovation Solution
A system and method for providing proxy SSH sessions on a data communication network, where an SSH public key from a client device is received, an endpoint management server is queried for registration confirmation, and an authentication certificate is generated to initiate an SSH session on behalf of the client device, submitting the certificate and SSH public key to an external server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If each end-user uploads their SSH public-key to each server they need to access, then passwordless login and better security are achieved, but SSH public-key management becomes complex and cumbersome
Solution Approach 1:
The patent introduces an intermediary authentication service that acts as a mediator between end-users and multiple servers. This service stores and manages SSH public-keys centrally, generating authentication certificates that allow users to access multiple servers without manually uploading keys to each server, thus reducing management complexity while maintaining security
Solution Approach 2:
The authentication service provides a universal solution that works across multiple servers and cloud environments. By implementing a standardized authentication mechanism that accepts certificates from the intermediary service, the system enables single-key management to provide access to multiple servers, reducing the need for server-specific key management
2Ease of operation
If each end-user uploads their SSH public-key to each server they need to access, then authentication capability is provided, but key renewal and removal processes become cumbersome
Solution Approach 1:
The intermediary authentication service centralizes the management of SSH keys, allowing users to renew or remove keys through a single interface rather than accessing each server individually. The service automatically updates or revokes authentication certificates across all connected servers, significantly reducing the time required for key maintenance operations
Solution Approach 2:
The system performs preliminary actions by pre-generating and distributing authentication certificates to users before they need to access servers. When keys are renewed or removed, the intermediary service proactively updates all relevant servers in advance, preventing authentication issues and eliminating the need for users to manually reconfigure each server
Data Source
AI summary
A SSH (secure shell) public key is received from a client device 120 120 on the enterprise network, and an EMS device 140 is queried based on the SSH public key. Responsive to confirmation of registration from the EMS server, an authentication certificate based on a user and the client device 120 120 is generated. An SSH session is initiated on behalf of the client device 120 120 including submitting the certificate and the SSH public key from the client device 120 120 to the external server.