SSH Bastion Service Centralizes Multi-Tenant Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant environments, managing secure SSH connections with per-user authentication and authorization using specific SSH keys is cumbersome and does not leverage the multi-tenant nature, leading to difficulties in access management and auditing.
Innovation Solution
Implementing an SSH bastion service that proxies customer SSH traffic, using existing customer credentials for authentication, and establishing separate connections to target resource instances, allowing for centralized management and auditing of secure connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If per-user SSH keys are used for authentication and authorization, then security is maintained, but management complexity increases and multi-tenant nature is not leveraged
Solution Approach 1:
The patent introduces a bastion host as an intermediary component between users and the multi-tenant environment. The bastion host centralizes SSH key management and authentication, acting as a mediator that handles security requirements while simplifying user access. Users connect to the bastion host which then manages authentication and authorization, eliminating the need for users to directly manage individual SSH keys for each resource.
Solution Approach 2:
The bastion host serves multiple functions: it acts as an SSH server, authentication manager, authorization controller, and audit log generator. By consolidating these functions into a single universal component, the system reduces management complexity while maintaining security. The bastion host can serve multiple tenants and resources simultaneously, leveraging the multi-tenant nature of the environment.
2Reliability
If per-user SSH keys are managed individually, then authentication is secure, but auditing and access management become difficult
Solution Approach 1:
The bastion host serves as a central intermediary that logs all authentication attempts and access requests. Every SSH connection request passes through the bastion host, which maintains centralized audit logs of who accessed what resource and when. This centralized logging significantly improves auditing capabilities compared to distributed per-user key management.
Solution Approach 2:
The system implements feedback mechanisms where the bastion host monitors and logs all authentication and authorization events. This feedback is captured in centralized logs that can be reviewed for auditing purposes, providing visibility into access patterns and enabling security monitoring without compromising individual authentication security.
3Ease of operation
If a centralized bastion service is implemented, then management and auditing are improved, but system architecture complexity increases
Solution Approach 1:
The bastion host is designed to automatically handle authentication and authorization without requiring manual intervention. It self-manages SSH key validation, user authentication, session management, and audit logging. This automation reduces the operational burden despite the added architectural component, as the bastion host serves itself for most management tasks.
Data Source
AI summary
A secure shell (SSH) bastion service can proxy customer SSH traffic through SSH host resources before routing the traffic to the target resource instances in a customer allocation of a multi-tenant environment. The bastion service supports connections directly from a customer allocation management console, which enables the specification of a target instance and selection of an option to establish a secure connection to that instance. The bastion service handles authentication and authorization, ensuring that all security requirements are satisfied. An SSH server of the bastion service can route the traffic to the target instance using the appropriate port for SSH traffic. A second SSH connection is established from the bastion service to the SSH server executing on the target instance, providing end-to-end security of traffic from the client device to the target instance of the customer allocation.