Secure External Access to Collaborative Design Systems via VPN and Kerberos
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing collaborative design systems face challenges in securely allowing external partners to access a manufacturer's design systems without compromising intellectual property, particularly due to complex authentication processes and the need for file replication, which complicates system administration and increases costs.
Innovation Solution
A collaborative design system that establishes a virtual private network (VPN) tunnel between an engagement virtual machine and an external computer system, using user IDs and passwords for authorization, issuing security tickets for authentication, and employing Kerberos security for user-specific access to intranet-based network file systems, thereby enabling secure and efficient sharing of files and data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If external users are allowed to access the manufacturer's design system, then collaboration efficiency is improved, but intellectual property security deteriorates
Solution Approach 1:
The system segments access control by creating separate authentication mechanisms for different access scenarios: VPN-based authentication for network access and Kerberos ticket-based authentication for file system access. This segmentation allows external users to collaborate efficiently while maintaining intellectual property security through layered authentication barriers.
2Adaptability or versatility
If file replication is implemented for external access, then access flexibility is improved, but system administration complexity increases
Solution Approach 1:
The patent extracts the authentication mechanism from the file access mechanism by implementing Kerberos ticket-based authentication. This separation allows the system to maintain centralized file storage on the intranet while providing secure external access through ticket validation, eliminating the need for complex file replication infrastructure.
3Reliability
If multiple authentication steps are required, then security is improved, but authentication time increases
Solution Approach 1:
The system performs preliminary authentication actions by establishing VPN connections and obtaining Kerberos tickets before actual file access operations. This preliminary authentication ensures security requirements are met upfront, allowing subsequent file access operations to proceed without repeated authentication delays.
Data Source
AI summary
A method for secure external access to a collaborative design system is provided that includes establishing a virtual private network (VPN) tunnel between an engagement virtual machine and an external computer system, wherein the external user provides a user id and password for authorization to establish the VPN tunnel, receiving the user id and password in a web interface of the collaborative design system and identifying the engagement virtual machine the external user is allowed to access based on the user id and password, prompting the external user to log into the engagement virtual machine, wherein the user id and password are again received from the external user, issuing a security ticket to the external user when the user logs into the engagement virtual machine, and using the security ticket to authenticate accesses initiated by the external user to engagement files stored in a file system in an intranet.