Secure Computing Device Virtualization via User and Device Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems lack secure methods to establish connections and provide virtualization on secure devices, particularly in ensuring only approved applications and devices can execute functions and access network connections.
Innovation Solution
A method for establishing a secure connection between computing systems involves authenticating users and devices, creating a device claim, and implementing an application blocking service to only allow whitelisted applications, while also configuring a networking policy to restrict inbound connections, thereby ensuring the secure execution of functions on a secure computing device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication and device approval mechanisms are implemented to ensure secure function execution, then system security is improved, but connection establishment complexity increases
Solution Approach 1:
The system performs authentication of user credentials and verification of device claims before establishing connections or executing functions. This preliminary validation ensures that only authorized users and approved devices can access system resources, thereby improving security without requiring complex checks during actual operation
Solution Approach 2:
The system introduces an intermediary authentication mechanism that mediates between the client device and the target system. This intermediary layer verifies device claims and user credentials, providing a structured security framework that manages complexity by centralizing authentication logic
2Reliability
If application blocking services and whitelisting mechanisms are implemented to allow only approved applications, then system security is improved, but device functionality is restricted
Solution Approach 1:
The system applies different security policies to different applications through whitelisting mechanisms. Approved applications on the whitelist are granted execution permissions with appropriate security contexts, while non-whitelisted applications are blocked. This localized quality control allows the system to maintain security while permitting necessary application functionality
Solution Approach 2:
The system implements partial action by allowing only specific approved applications to execute rather than blocking all applications. The whitelist contains precisely the applications that need to run, providing sufficient security control without excessive restriction of system functionality
3Reliability
If networking policies are configured to prevent inbound connections to secure devices, then device security is improved, but network accessibility is reduced
Solution Approach 1:
The system extracts and isolates the secure computing device from general network traffic by implementing networking policies that prevent inbound connections. This extraction protects the device from unauthorized access while maintaining its security isolation, and authorized communication occurs through controlled outbound connections or approved channels
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments are directed to establishing a secure connection between computing systems (101A, 101B) and to providing computer system virtualization on a secure computing device. In one scenario, a computer system receives a request (116) that at least one specified function (117) be initiated. The request (116) includes user credentials (106) and a device claim (118) that identifies the computing device (101A). The computer system authenticates the user using the received user credentials (106) and determines, based on the device claim (118), that the computing device (101A) is an approved computing device that has been approved to initiate performance of the specified function (117). Then, upon determining that the user has been authenticated and that the computing device (101A) is approved to initiate performance the specified function, the computer system initiates performance of the specified function.