VPN Key Splitting for Secure Session Resumption

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Long-lived VPN sessions can compromise network security if an endpoint device is lost or stolen, as they allow unauthorized access to the corporate network without reauthentication, and existing two-factor authentication methods are inconvenient and limited to session initiation.

Innovation Solution

The solution involves generating key information for a VPN connection and splitting it into shares stored on a dongle and the endpoint device, allowing the VPN connection to be established and resumed only when both shares are available, with the dongle serving as an additional authentication factor to minimize unauthorized access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If long-lived VPN sessions are allowed to reduce reauthentication frequency, then user convenience is improved, but network security deteriorates because lost or stolen devices can access the corporate network without reauthentication

Engineering Contradiction:
Improvereauthentication frequencyVSAvoidnetwork security
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

The authentication credentials are segmented into two separate parts: a first set of shares stored on a removable dongle and a second set of shares stored on the endpoint device. Both parts are required to reconstruct the full authentication credentials, ensuring that if the endpoint device is lost or stolen, the attacker cannot access the VPN network without also obtaining the dongle.

Inventive Principle:
Principle #1Segmentation

2Reliability

If two-factor authentication using hardware tokens is implemented to protect against device loss, then network security is improved, but user convenience deteriorates and the method can only be used at session initiation

Engineering Contradiction:
Improvenetwork securityVSAvoidauthentication convenience
Core Design Contradiction:
ReliabilityVSEase of operation

Solution Approach 1:

The authentication credentials are prepared in advance by splitting them into two shares and distributing them to the dongle and endpoint device before the VPN session begins. This preliminary segmentation allows for seamless automated authentication during session resumption without requiring user intervention, while still providing strong security protection.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP2684332B1Improving security for remote access VPN
Publication Date: 2019.09.11 CISCO TECHNOLOGY INC
  • EP2684332B1 patent drawingFigure 1
  • EP2684332B1 patent drawingFigure 2
  • EP2684332B1 patent drawingFigure 3A

AI summary

Techniques are disclosed for improving security in virtual private network. In one embodiment, key information is generated for a virtual private network (VPN) connection between a first device and a second device. A plurality of shares is then generated based on the key information. A first set of one or more shares is stored on a dongle that is paired to the first device. A second set of one or more shares is stored on the first device. In response to a request to resume the VPN connection, the first set of shares is retrieved from the dongle. The key information is reconstructed based on the first set of shares and the second set of shares. The reconstructed key information may then be used to resume the VPN connection.