Service Processor VM Access Using Broadcast Key Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for connecting users to virtual machines in distributed computing environments require intermediary applications that store unnecessary operational layers and lack direct security mechanisms to authenticate user connections, leading to inefficiencies and potential security vulnerabilities.
Innovation Solution
A method that eliminates the need for intermediary applications by using a service processor to establish secure connections based on broadcasted identifiers and keys, ensuring that only appropriate users gain access to virtual machines through a secure shell (SSH) and universal asynchronous receiver-transmitter (UART) connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an intermediary application is used to establish connection between service processor and virtual machine, then connection can be established, but system complexity increases and security is compromised
Solution Approach 1:
The patent extracts and removes the intermediary application layer from the connection architecture. By directly pairing service processors with virtual machines using cryptographic keys stored in secure elements, the intermediary application that added complexity and security vulnerabilities is eliminated, while maintaining reliable authenticated connections
Solution Approach 2:
The patent introduces cryptographic key pairs as a secure intermediary mechanism. Instead of using a complex software intermediary application, simple cryptographic keys stored in secure elements mediate the authentication between service processors and virtual machines, providing security without adding system layer complexity
2Ease of operation
If intermediary application stores virtual machine information, then connection management is enabled, but extraneous information is added that is not needed by users
Solution Approach 1:
The patent extracts only the essential authentication information (cryptographic keys) from the intermediary application, removing extraneous virtual machine information storage. The secure element stores only the minimum necessary data (key pairs) for authentication, eliminating privacy risks associated with storing unnecessary information
3Device complexity
If direct secure connection is established without intermediary, then security is improved and complexity is reduced, but authentication mechanism must be implemented
Solution Approach 1:
The patent implements preliminary action by pre-provisioning cryptographic key pairs in secure elements before the service processor and virtual machine need to communicate. This advance preparation of authentication credentials enables direct secure connections without requiring complex runtime authentication intermediaries
Data Source
AI summary
A computer-implemented method, system and computer program product for securing access to a virtual machine via a service processor. A broadcasted request from a computing device of a user to establish a virtual session with the virtual machine through a service processor is received. Such a broadcasted request includes an identifier of the virtual machine as well as a key. A secure connection between the service processor and the computing device of the user is established in response to the broadcasted identifier of the virtual machine matching the identifier of the virtual machine in the service processor table. After establishing the secure connection between the service processor and the computing device of the user, a secure connection between the service processor and the virtual machine is established in response to the broadcasted key matching the key associated with the identifier of the virtual machine in the service processor table.