Single Sign-On for Appliance Secure Shell
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for secure shell connections in Web-based applications often require users to re-authenticate despite already having an active HTTP session, and they cannot support HTTP redirections, making it inefficient and insecure.
Innovation Solution
Deploying a storage service device that uses a third-party authentication service for user management, allowing HTTP redirections to authenticate users, and storing access tokens and client device IDs to facilitate secure HTTP sessions, enabling secure SSH connections without re-authentication by using these stored credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If HTTP Basic Authentication is used for each access, then user credentials can be verified, but users are prompted for credentials repeatedly even after authentication
Solution Approach 1:
The system performs authentication in advance through HTTP Basic Authentication, stores the authenticated user's credentials securely, and reuses them for subsequent SSH connection attempts. This preliminary authentication action eliminates the need for repeated credential prompts while maintaining security through secure storage mechanisms.
2Ease of operation
If token authentication is implemented, then credential tracking and session management improve, but system complexity increases significantly
Solution Approach 1:
The patent introduces an authentication service as an intermediary component that handles token generation, validation, and management. This mediator service centralizes the complex token authentication logic, allowing the main application to benefit from improved session management without directly implementing the complex token authentication mechanisms themselves.
3Adaptability or versatility
If SSH connection is established after HTTP session, then command-line access is provided, but users are prompted for another login attempt
Solution Approach 1:
The system merges the HTTP authentication session with the SSH connection establishment process by sharing the authenticated credentials between the two protocols. The authentication context from the HTTP session is combined with the SSH connection request, allowing seamless transition from web interface to command-line interface without requiring a separate login attempt.
4Ease of operation
If credentials are stored in client code, then authentication can be performed, but malicious users can reverse engineer and obtain the stored API key
Solution Approach 1:
The patent extracts the sensitive credential storage from the client-side application code and relocates it to a secure server-side storage mechanism. By taking out the credentials from the vulnerable client environment and storing them securely on the server, the system maintains authentication capability while eliminating the security vulnerability to reverse engineering that exists in client-side storage.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and method for efficiently establishing a secure shell connection for accessing Web resources. A user attempts to establish a secure Hypertext Transfer Protocol (HTTP) session between a client computing device and a remote storage device. The storage device redirects the Web browser of the client computing device to a single sign-on (SSO) third-party identity provider for authorizing the user. After successful authorization, the client computing device receives information to use to maintain a secure HTTP session. This information is stored on the storage device. The user attempts to establish a text-based secure shell session. The user is not prompted for login credentials. However, the user is authenticated using the previously stored information and a text-based secure shell session is established.