Single Sign-On Portal for Remote Virtual Machine Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
System administrators face security risks when accessing remote virtual machines over non-secure channels due to the use of static login credentials, which are often not changed frequently and are stored in insecure locations, making them vulnerable to theft and unauthorized access.
Innovation Solution
Implementing a Single Sign-On Portal (SSOP) system that uses a one-time password (OTP) as the sole authentication credential, managed through a Remote Access Helper (RAH) and Request Collector (RC) to securely connect system administrators to remote virtual machines, eliminating the need to store multiple credentials and preventing long-term access by unauthorized users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If system administrators use static login credentials (username and password) for remote VM access, then ease of operation is improved, but security is worsened due to vulnerability to theft and unauthorized access
Solution Approach 1:
The patent implements dynamic credentials by generating a new one-time password (OTP) for each remote access session. The OTP is valid only for a single authentication attempt and expires immediately after use, transforming the static credential system into a dynamic one that automatically changes with each access, thereby preventing reuse of stolen credentials.
Solution Approach 2:
The patent introduces an intermediary component (the OTP generation and verification system) between the administrator and the remote VM. This intermediary generates time-limited credentials and mediates the authentication process, adding a security layer that prevents direct exposure of long-term access credentials while maintaining ease of operation.
2Productivity
If system administrators store multiple VM credentials in files or spreadsheets, then productivity is improved by having all credentials in one place, but security is worsened as a single point of failure allows hackers to access all VMs
Solution Approach 1:
The patent implements disposable credentials in the form of one-time passwords that are generated for each session and become invalid immediately after use. Each OTP is a short-lived credential that cannot be reused, eliminating the value of storing credentials centrally while maintaining productivity through automated generation and management.
Solution Approach 2:
The system performs preliminary actions by pre-configuring the OTP generation mechanism and credential management infrastructure before any access is needed. The system automatically generates and manages credentials as needed, eliminating the need for administrators to manually store and manage credential files in advance.
3Reliability
If system administrators use different passwords for each VM to improve security, then security is improved by isolating access, but device complexity is worsened due to managing multiple credentials
Solution Approach 1:
The patent implements a universal OTP generation system that can be applied across multiple different remote access protocols and VM types. The same OTP mechanism works for various protocols (RDP, SSH, VNC, etc.), providing a multi-functional solution that maintains security isolation while simplifying credential management through a single unified approach.
Data Source
AI summary
A user may securely access a remote virtual machine (RVM) by authenticating with a single sign-on portal (SSOP) connected to a request collector. The request collector is connected to a remote access helper (RAH) associated with the RVM. Upon a user request from the SSOP, a one-time password (OTP) is generated by the RVM and the RAH sends an acceptance notice to the request collector. The request collector generates a payload containing a URL which is sent to the SSOP and connects to the URL downloading a file containing the OTP. The user then connects to and accesses the RVM using the OTP contained in the file.