Virtualized Gateway Access Control for Secure Logical Network Tunnels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies face challenges in enabling secure and efficient communication between dispersed computing devices through logical networks, particularly in managing user access, authentication, and configuration of virtualized gateways.
Innovation Solution
A system is implemented that includes a logical network configuration manager, user manager, and gateway to programmatically configure and manage logical networks, using protocols like TACACS+, RADIUS, and Diameter for authentication and authorization, allowing secure access and management of user accounts and permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If virtualized gateways are used to enable dispersed computing devices to communicate through logical networks, then communication flexibility and access control are improved, but system complexity and configuration management difficulty increase
Solution Approach 1:
A gateway server is introduced as an intermediary component between client devices and the logical network. The gateway server receives connection requests from clients, authenticates them against user accounts stored in memory, and establishes logical network tunnels only for authorized users. This mediator approach centralizes the complexity of authentication and tunnel management in a dedicated component, simplifying the overall system architecture while maintaining flexible access control.
Solution Approach 2:
The patent implements a virtualized gateway architecture where the gateway functionality is replicated across multiple instances. Each gateway instance maintains its own memory space with user account information, allowing independent operation and failover. This copying approach improves system reliability and enables load distribution while maintaining the same access control functionality, thereby reducing the impact of complexity on any single point of failure.
2Reliability
If authentication protocols like TACACS+, RADIUS, and Diameter are implemented for secure user access, then security and confidentiality are improved, but processing time and authentication overhead increase
Solution Approach 1:
User account information, including authentication credentials and access permissions, is pre-stored in the gateway server's memory in a structured format. When a connection request arrives, the gateway retrieves the relevant user account data directly from memory rather than performing complex authentication procedures from scratch. This preliminary preparation significantly reduces authentication time while maintaining the security requirements of protocols like TACACS+ and RADIUS.
Solution Approach 2:
The patent employs temporary authentication tokens and session keys that are generated for each connection and expire after use. These short-living cryptographic objects provide strong authentication and data protection during the active session, then are discarded to prevent reuse. This approach maintains high security standards while minimizing the computational overhead associated with long-term key management and reducing authentication time for subsequent connections.
3Ease of operation
If logical network tunnels are established for each user connection, then user access control and data confidentiality are improved, but resource consumption and tunnel management complexity increase
Solution Approach 1:
The gateway server is designed to handle multiple connection types and user scenarios through a unified architecture. A single gateway instance can serve multiple users simultaneously, managing diverse connection requests through standardized procedures. This multi-functional design consolidates resource requirements compared to having dedicated gateway instances for each user type, thereby reducing overall resource consumption while maintaining granular access control through logical network tunnels.
Solution Approach 2:
The gateway dynamically creates, modifies, and terminates logical network tunnels based on real-time authentication results and user permissions. Rather than establishing static tunnels in advance or maintaining persistent connections, the system dynamically adapts tunnel configurations to match current user needs. This dynamic approach optimizes resource utilization by creating tunnels only when needed and adjusting their parameters to minimize overhead, while still providing robust user access control.
Data Source
AI summary
Disclosed are various embodiments for receiving, via a network, a request from a client to establish a network tunnel over the network. Various embodiments can create a virtual network comprising a virtual network gateway in response to receiving a service call. Various embodiments can further allocate an available computing resource to the virtual network gateway to augment a first computing resource. Allocating the available computing resource can be performed in response to a usage of the first computing resource assigned to the virtual network gateway.