Shared VPN User Identification via Virtual IP Token
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
When using a shared VPN tunnel, the VPN server cannot identify individual users behind a specific connection, making it difficult to apply user-specific access rules and log security incidents effectively.
Innovation Solution
The system employs a method to detect users by assigning a virtual IP address and using it as an authentication token within the VPN, allowing the gateway to identify users and generate authentication tokens for access, enabling user-specific access control and logging.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a shared VPN tunnel is used to connect the whole organization to a VPN server, then device complexity is reduced and ease of operation is improved, but the VPN server cannot identify individual users behind a specific connection
Solution Approach 1:
The patent introduces an intermediary authentication mechanism that operates within the shared VPN tunnel. A gateway server receives authentication tokens from users and forwards them to the VPN server, enabling user identification without requiring separate VPN tunnels for each user. This intermediary layer resolves the contradiction by maintaining the simplicity of shared VPN infrastructure while adding user identification capability through token-based authentication.
2Loss of information
If a separate VPN tunnel and IP are assigned per user, then user identification capability is improved, but device complexity increases and ease of operation deteriorates
Solution Approach 1:
The patent applies universality by enabling a single shared VPN tunnel to serve multiple users while maintaining user identification capability through authentication tokens. The gateway server performs multiple functions: receiving authentication tokens, validating user identities, and forwarding requests to the VPN server. This multi-functional approach eliminates the need for separate VPN tunnels per user while preserving user identification, thus reducing device complexity.
3Adaptability or versatility
If user authentication is implemented within shared VPN tunnel, then user-specific access control is enabled, but authentication complexity increases
Solution Approach 1:
The patent implements preliminary action by having users authenticate themselves before accessing resources through the shared VPN tunnel. The gateway server performs authentication checks in advance, validating user tokens and determining access rights before forwarding requests to the VPN server or web servers. This preliminary authentication step enables user-specific access control while keeping the overall system manageable by centralizing authentication logic at the gateway.
Data Source
AI summary
Transparently identifying users using a shared VPN tunnel uses an innovative method to detect a user of a shared VPN tunnel, after authenticating the user, using an assigned userid (that may be a virtual IP). The virtual IP is used as a cookie in each request made by the user. This cookie is an authentication token used by the gateway to detect the user behind a specific request for an Internet resource (such as an http/s request). The cookie is stripped by the gateway so the cookie is not sent to the resource.