Virtual File System Secure Access Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern security mechanisms, such as multi-factor authentication and hardware security modules, are challenging to implement within secure environments for tools, leading to weaker authentication methods and management complexities, particularly with credentials being stored in plain text, which compromises security.
Innovation Solution
A computer-implemented method and system for secure access management that uses a virtual file system to encrypt sensitive data with a user's public key, allowing decryption by a remote cryptography device outside the secure environment, ensuring that private keys never leave the user's system and are not exposed within the secure environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If credentials are stored as files in plain text to enable tool access, then ease of operation is improved, but security is worsened
Solution Approach 1:
The patent extracts the private key from the secure environment and stores it only on the user's system. The secure environment contains only encrypted credential files, while the user's system holds the decryption capability. This separation removes the security vulnerability of storing plain text credentials in the secure environment while maintaining tool access functionality.
Solution Approach 2:
The patent introduces an encrypted credential file as an intermediary between the secure environment and the user's system. These files are encrypted with the user's public key and can only be decrypted by the corresponding private key on the user's system. This intermediary mechanism enables secure credential transmission without exposing sensitive data in plain text within the secure environment.
2Reliability
If modern security mechanisms like MFA and HSM are implemented for user access, then security is improved, but device complexity and ease of operation are worsened for tools inside the secure environment
Solution Approach 1:
The patent creates encrypted copies of credentials that can be securely transmitted to the user's system. Instead of requiring complex authentication mechanisms for every tool access, the system uses encrypted credential files that replicate the security of MFA/HSM while being simpler to implement for individual tools. The encrypted files serve as portable security credentials that maintain strong authentication without the operational complexity.
3Ease of operation
If private keys are stored in the secure environment for tool authentication, then ease of operation is improved, but security is worsened due to key exposure
Solution Approach 1:
The patent extracts the private key from the secure environment and relocates it to the user's system. Only the encrypted form of credentials resides in the secure environment, while the decryption capability (private key) remains exclusively on the user's system. This extraction eliminates the security risk of private key exposure while maintaining authentication functionality.
Solution Approach 2:
Instead of storing private keys in the secure environment and managing their exposure risks, the patent inverts the approach by storing only encrypted credentials in the secure environment and keeping the private key outside. This inversion transforms the security model from protecting private keys within the secure perimeter to protecting encrypted data within the perimeter, with decryption occurring externally where the key naturally resides.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This approach provides a secure and efficient authorization mechanism for tools within secure environments, protecting sensitive data by using public key cryptography, ensuring that only the user's private key is required for decryption, thus enhancing security and simplifying credential management.
Implementation Method 1
A computer-implemented method and system for secure access management that uses a virtual file system to encrypt sensitive data with a user's public key
Data Source
AI summary
A method, system and computer program product for secure access management for tools within a secure environment. A virtual file system for a user in memory on a server side in the secure environment is accessed as part of an authenticated user session including a user command instigated by a user. At the virtual file system, an encrypted file stored in the secure environment is obtained, where the file is encrypted using a public key of a user. A read operation at the virtual file system of the encrypted file is intercepted and the encrypted file is sent to a client at a user system external to the secure environment over a secure connection for decryption by a remote cryptography device of the user system using the user's private key. The decrypted file is then received at the virtual file system enabling the user to run the required user command.