What is a Connection Broker?

A Connection Broker is a centralized component that acts as an intermediary between end users and virtualized or remote resources in an IT environment.

It is primarily used in Virtual Desktop Infrastructure (VDI) architectures and Remote Desktop environments (in our case, Shielded Remote Desktop). This system manages, authenticates, and directs user access requests to available resources, ensuring that each session is properly configured according to security policies and defined resource allocation.

What is a Connection Broker used for?

The primary goal of a Connection Broker is to orchestrate remote access sessions and ensure that each user is connected to the appropriate resource. These can be a virtual desktop, a specific application, or a remote server.

Some of the most important functions of a Connection Broker are:

1. Session management: Assigns active sessions to connected users and allows reconnection to previously initiated sessions, ensuring work continuity.
2. Load balancing: Optimizes resource allocation by distributing requests across servers to prevent overload and maximize efficiency.
3. Security: Verifies user identities, enforces role-based access control (RBAC) policies, and establishes secure tunnels between the client and remote resources.
4. Multi-client compatibility: Allows different devices and operating systems to connect to the centralized environment.
5. Granular access control: Enables the implementation of segmentation policies based on users, groups, or locations.

How does a Connection Broker work?

The operation of a Connection Broker can be broken down into the following steps:

1. User authentication: When a user attempts to access the system, the Broker verifies their credentials through mechanisms such as LDAP, Active Directory, or multi-factor authentication (MFA). This step ensures that only authorized users can proceed. 
2. Policy evaluation: Based on the user’s credentials and attributes, such as roles, geographic location, or device, the Broker checks the configured access policies to determine which resources the user is allowed to access.
3. Resource allocation: Once the user is authenticated, the Broker assigns an appropriate resource. This could be a specific virtual desktop, a dynamic pool machine, or a remote application. If there is a previous active session, the Broker reconnects the user.
4. Connection establishment: The Connection Broker coordinates communication between the client and the remote resource, establishing a secure channel (typically RDP, ICA, or PCoIP) that ensures the privacy and integrity of the transmitted data.
5. Monitoring and control: Throughout the session, the Broker monitors active connections, logs events, and ensures policy compliance. Additionally, it can make real-time dynamic adjustments, such as redirecting users in the event of failures.

Practical applications

1. VDI environments: The Broker is essential for managing access to virtual desktops hosted on centralized infrastructure.
2. Secure remote access: In combination with encryption mechanisms and advanced authentication, it enables secure connections to critical business resources.
3. Scalability: It allows businesses to scale their infrastructure to support thousands of simultaneous users without compromising performance or security.

The use of a Connection Broker, as part of broader cybersecurity and access management solutions, enhances the end-user experience and optimizes the security of distributed systems.

Endurance

Incorporating a Connection Broker into Cosmikal’s Endurance significantly enhances its management and security capabilities by centralizing and optimizing access to critical resources. This integration allows for dynamic session allocation, ensuring continuity and scalability in environments with multiple users and distributed assets.

A key feature of the Connection Broker in Endurance is that communications between assets and the user are limited exclusively to mouse events, keyboard input, and video and audio streaming. This means that no sensitive information or data is transferred directly from protected systems, unless explicitly authorized by the administrator, ensuring that the assets remain completely inviolable. This architecture minimizes exposure to potential attacks, as direct physical or logical access to the system is not possible, and any attempt to intercept or manipulate data is ineffective.

Additionally, by combining the advanced features of a Connection Broker with the protection measures of Endurance (VDI, PAM, Shielded Remote Desktop, etc.), robust authentication, granular segmentation, and real-time monitoring are ensured, reducing the attack surface and strengthening regulatory compliance.

Endurance not only protects access to critical company assets. With a Connection Broker, redefines how businesses manage security and access to their remote and virtualized infrastructures.