Remote Access Credential Encryption via Public Key Infrastructure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional VPN systems are vulnerable to credential theft due to unsecured transmission of login credentials during remote access authentication, and they bypass corporate network security measures when establishing remote connections, posing risks to network security.
Innovation Solution
Encrypting user credentials with an encryption algorithm and using a passcode instead of passwords, along with two-factor authentication and one-time tokens, to secure remote access and verify client compliance with policies before connecting, while ensuring secure transmission over public networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional RA authentication protocols (PAP, CHAP, RADIUS) are used to transmit user credentials, then remote access authentication can be performed, but the credentials are transmitted in clear text or with weak encryption making them vulnerable to theft
Solution Approach 1:
The patent introduces an intermediary encryption layer between the RA client and authentication server. Credentials are encrypted using a key derived from the user's public key before transmission. This intermediary encryption mechanism protects credentials during transmission without fundamentally changing the authentication workflow, resolving the contradiction between security and ease of operation.
Solution Approach 2:
The patent transforms the authentication parameter from plain-text credentials to encrypted credentials using public key cryptography. By changing the parameter format (from clear text to encrypted form) and using key derivation functions, the system maintains authentication functionality while dramatically improving credential security during transmission.
2Ease of operation
If VPN clients use identical login credentials for both RA authentication and VPN authentication, then user convenience is improved, but the VPN security is compromised if RA credentials are stolen
Solution Approach 1:
The patent segments the authentication security into two independent layers: RA authentication (using encrypted credentials via public key infrastructure) and VPN authentication (using separate credentials). This segmentation allows users to maintain convenience by using the same credentials while protecting VPN security through the additional encryption layer and separate credential storage in the VPN client.
Solution Approach 2:
The patent adds a new dimension of security by introducing public key cryptography as an additional layer beyond traditional password-based authentication. This dimensional addition creates a security hierarchy where even if the password layer is compromised, the public key encryption layer remains intact, allowing the system to maintain both convenience and security.
3Productivity
If corporate network security measures are bypassed to allow remote access, then remote connectivity is improved, but the risk of unauthorized access and data breaches increases
Solution Approach 1:
The patent performs preliminary security verification by encrypting credentials before they leave the client system and verifying the client's compliance with security policies before granting network access. This preliminary action ensures that remote access is established only after security checks, allowing productivity improvement while mitigating security risks through advance verification.
Solution Approach 2:
The patent implements feedback mechanisms where the authentication server verifies not only the credentials but also the client's security compliance status. This feedback loop allows the system to dynamically control access based on security conditions, enabling remote productivity while maintaining security through continuous monitoring and verification.
Data Source
AI summary
A computer-implemented method and apparatus prevents unsecured access to a computer over a network by a client running on a remote computer. In one aspect of the present invention, a client policy is stored on the remote computer. The client policy includes a configuration of the remote computer that reduces the likelihood of a security breach of the computer as a result of the remote computer accessing the computer. A request is received from a user for access to the computer. It is verified that the remote computer conforms with the client policy, and the client is connected to said computer.