VPN Key Splitting for Secure Session Resumption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Long-lived VPN sessions can compromise network security if an endpoint device is lost or stolen, as they allow unauthorized access to the corporate network without reauthentication, and existing two-factor authentication methods are inconvenient and limited to session initiation.
Innovation Solution
The solution involves generating key information for a VPN connection and splitting it into shares stored on a dongle and the endpoint device, allowing the VPN connection to be established and resumed only when both shares are available, with the dongle serving as an additional authentication factor to minimize unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If long-lived VPN sessions are allowed to reduce reauthentication frequency, then user convenience is improved, but network security deteriorates because lost or stolen devices can access the corporate network without reauthentication
Solution Approach 1:
The authentication credentials are segmented into two separate parts: a first set of shares stored on a removable dongle and a second set of shares stored on the endpoint device. Both parts are required to reconstruct the full authentication credentials, ensuring that if the endpoint device is lost or stolen, the attacker cannot access the VPN network without also obtaining the dongle.
2Reliability
If two-factor authentication using hardware tokens is implemented to protect against device loss, then network security is improved, but user convenience deteriorates and the method can only be used at session initiation
Solution Approach 1:
The authentication credentials are prepared in advance by splitting them into two shares and distributing them to the dongle and endpoint device before the VPN session begins. This preliminary segmentation allows for seamless automated authentication during session resumption without requiring user intervention, while still providing strong security protection.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
Techniques are disclosed for improving security in virtual private network. In one embodiment, key information is generated for a virtual private network (VPN) connection between a first device and a second device. A plurality of shares is then generated based on the key information. A first set of one or more shares is stored on a dongle that is paired to the first device. A second set of one or more shares is stored on the first device. In response to a request to resume the VPN connection, the first set of shares is retrieved from the dongle. The key information is reconstructed based on the first set of shares and the second set of shares. The reconstructed key information may then be used to resume the VPN connection.