Sharable VM Access Links Through a Security Portal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing facilities, sharing virtual machine resources via configuration files like RDP files is prone to malicious modifications, inefficient, and labor-intensive, especially when multiple copies need updating or deletion across client devices.
Innovation Solution
Implementing a sharable link that includes a network address of a security portal and a VM identifier, allowing secure access management without exposing the virtual machine's direct network address, enabling efficient distribution and updating of configuration files centrally.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If configuration files are shared via physical storage drives or direct distribution, then users can access virtual machines, but the configuration files are prone to malicious modifications and security compromises
Solution Approach 1:
A security portal is introduced as an intermediary between users and virtual machines. The portal receives access requests containing configuration information, validates them, and forwards approved requests to the target virtual machines. This mediator architecture protects configuration files from direct exposure and malicious modification while enabling secure access distribution.
2Adaptability or versatility
If multiple copies of configuration files are distributed to multiple users, then access sharing is enabled, but updating and deleting files becomes labor-intensive and inefficient
Solution Approach 1:
Instead of distributing actual configuration file copies to multiple users, the system distributes references or tokens that point to the centralized configuration information stored in the security portal. Each user's access request includes a reference to the configuration, allowing the portal to retrieve and validate the same configuration data without requiring physical copies on each client device.
Solution Approach 2:
The security portal serves as a centralized intermediary that manages configuration information for all users. When updates or deletions are needed, the administrator modifies the configuration in the portal's central storage, and the changes automatically apply to all user access requests without requiring manual updates to individual user devices.
3Ease of operation
If virtual machines are exposed via public IP addresses for remote access, then users can connect to virtual machines, but the virtual machines become vulnerable to malicious actions such as DDoS attacks
Solution Approach 1:
The security portal acts as a protective intermediary that sits between the public network and private virtual machines. Users submit access requests through the portal using configuration information, and the portal validates and forwards requests without exposing the virtual machines' direct network addresses. This architecture enables remote access while shielding virtual machines from direct public network exposure and malicious attacks.
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
Techniques of remote computing resource access using sharable links are disclosed herein. One example technique includes receiving, at a security portal of a private network, an access request from a client device of a user for accessing a virtual machine ("VM") on the private network via a public network. The technique can then include retrieving a copy of a configuration file corresponding to the virtual machine according to the VM identifier in the access request and accessing the virtual machine according to operating parameters in the retrieved copy of the configuration file to generate an execution result. The technique can further include transmitting, from the security portal, the execution result to the client device of the user via the public network, thereby shielding, with the security portal, the virtual machine on the private network from actions initiated via the public network.