Single Sign-On Mechanism for Secure Virtual Machine Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional remote desktop systems require users to sign in locally and then again on the remote computer, transferring credentials insecurely, making them vulnerable to attacks and overburdening the virtual machine's operating system with decryption tasks.
Innovation Solution
A single sign-on mechanism that securely stores user credentials on the local device, encrypts them on demand, and decrypts them within a guest agent on the virtual machine to log the user into the remote operating system transparently, eliminating the need for repeated sign-ins and reducing the burden on the virtual machine.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If credentials are transferred securely using encryption, then security is improved, but the virtual machine's operating system is overburdened with decryption tasks
Solution Approach 1:
The patent introduces a credential provider as an intermediary component that handles decryption operations separately from the operating system. The credential provider receives encrypted credentials, decrypts them using stored credentials, and provides the decrypted form to the operating system without requiring the OS to perform decryption itself. This mediator approach maintains security through encryption while relieving the operating system of the computational burden of decryption.
2Reliability
If users sign in locally and then again on the remote computer, then authentication is performed, but the user experience deteriorates due to repeated sign-ins
Solution Approach 1:
The patent implements preliminary authentication by storing user credentials locally on the user's device before remote access is needed. When the user initiates remote desktop access, the system automatically retrieves and uses these pre-stored credentials to authenticate to the remote computer without requiring the user to manually sign in again. This preliminary action of storing credentials locally eliminates the need for repeated sign-ins while maintaining secure authentication.
3Reliability
If manual sign-ins are required on each access, then security control is maintained, but productivity decreases due to repeated authentication steps
Solution Approach 1:
The patent enables the system to perform authentication automatically without requiring manual user intervention for each sign-in. The credential provider automatically retrieves stored credentials, performs decryption, and completes the authentication process to the remote computer. This self-service automation maintains security control through encrypted credential management while dramatically improving access efficiency by eliminating repetitive manual authentication steps.
Data Source
AI summary
An illustrative embodiment disclosed herein is an apparatus including a processor with programmed instructions to receive, from a user device and via a network, encrypted credentials for logging on a user associated with the user device to a virtual machine. The processor is coupled to the virtual machine via a hypervisor. The processor has programmed instructions to decrypt the credentials, send, to an operating system of the virtual machine, the decrypted credentials, and cause the operating system to log the user on to the virtual machine.