Techniques for providing secure network gateway

Abstract

Embodiments of the present disclosure relate to techniques for providing a secure web gateway through a zero-trust network environment. A system and method for configuring a client device to communicate using a secure web gateway. The method includes: generating a virtual network interface having a namespace, the namespace having a plurality of names, where a first name of the namespace is assigned to a client device; assigning a second name of the namespace to a resource accessible by the client device through the zero-trust network environment, wherein the resource is deployed in the secure network environment; and configuring the client device to communicate only through the virtual network interface.

Description

Technical Field

[0001] The present disclosure relates generally to secure web gateways, and more particularly, to providing secure web gateways through a zero-trust network environment. Background Art

[0002] Organizations increasingly allow users to work physically both inside and outside the organization. When outside the organization, users will connect to the organization's internal computer network, private cloud network, hybrid network, etc., in order to access resources stored thereon. Often, users will use their own devices in a bring your own device (BYOD) setting. All of this leads to security gaps that can expose the organization.

[0003] One of the preventive solutions to limit this exposure is through the deployment of a secure web gateway (SWG). SWG is configured to connect user devices to network resources and additionally perform content filtering, content inspection, and apply security controls to network services. SWG solutions generate a dedicated network space and connect user devices and, for example, web applications that the user devices attempt to access to the dedicated network space. Therefore, in order to utilize the SWG solution, network resources must be pre-configured in the network space. In addition, SWG solutions designed as standalone applications are generally not easily integrated into an organization's workflow, log monitoring, reporting, etc.

[0004] Therefore, it would be advantageous to provide a solution that would overcome the above challenges. Summary of the invention

[0005] An overview of several example embodiments of the present disclosure is as follows. This overview is provided for the convenience of the reader to provide a basic understanding of these embodiments, and does not completely limit the scope of the present disclosure. This overview is not an extensive review of all contemplated embodiments, and is neither intended to identify the main or key elements of all embodiments, nor to describe the scope of any or all aspects. Its sole purpose is to present some concepts of one or more embodiments in a simplified form as a preface to a more detailed description presented later. For convenience, the term "some embodiments" or "certain embodiments" may be used herein to refer to a single embodiment or multiple embodiments of the present disclosure.

[0006] A system of one or more computers may be configured to perform specific operations or actions by installing software, firmware, hardware, or a combination thereof on the system, which in operation causes the system to perform these actions. One or more computer programs may be configured to perform specific operations or actions by including instructions that, when executed by a data processing device, cause the device to perform these actions.

[0007] In one general aspect, a method may include generating a virtual network interface having a namespace, the namespace having a plurality of names, wherein a first name of the namespace is assigned to a client device. The method may also include assigning a second name of the namespace to a resource accessible to the client device through a zero-trust network environment, wherein the resource is deployed in a secure network environment. The method may also include configuring the client device to communicate only through the virtual network interface. Other embodiments of this aspect include corresponding computer systems, apparatuses, and computer programs recorded on one or more computer storage devices, each configured to perform the method actions.

[0008] Implementations may include one or more of the following features. The method may include: inspecting network traffic received from a client device; determining a destination for the network traffic; and sending the network traffic to the destination in response to determining that the network traffic is permissible based on a policy of a zero-trust network environment. The method may include: changing the packetization of the network traffic so that the response from the resource is directed to the zero-trust network environment rather than the client device. The method may include: receiving credentials of a user account associated with a user device; and providing access to the resource through a zero-trust network in response to authenticating the received credentials. In the method, the virtual network interface also includes a routing table. The method may include: performing deep packet inspection on the network traffic. In the method, the resource is deployed in any of the following: a private network, a public network, and any combination thereof. In the method, the resource is any of the following: a web application, a remote desktop protocol (RDP) server, a secure shell (SSH) server, a file server, an object database, a transaction database, an SQL database, a NoSQL database, a web server, a data repository, and any combination thereof. The method may include: assigning a third name of the namespace to another resource accessible to a client device through a zero-trust network environment, wherein the resource is deployed in a private network and the other resource is deployed in a public network; and in response to determining that the client device requests content from the resource within a time period less than a predefined time period, blocking network traffic to the other resource. In the method, the zero-trust network environment includes any one of the following: a front-end SSH server, a front-end RDP server, an access portal server, a back-end server, and any combination thereof. Implementations of the described technology may include hardware, methods or processes, or computer tangible media.

[0009] In one general aspect, a non-transitory computer-readable medium may include one or more instructions that, when executed by one or more processors of a device, cause the device to: generate a virtual network interface having a namespace, the namespace having multiple names, wherein a first name of the namespace is assigned to a client device. The medium may further include assigning a second name of the namespace to a resource accessible to the client device through a zero-trust network environment, wherein the resource is deployed in a secure network environment. The medium may further include configuring the client device to communicate only through the virtual network interface. Other embodiments of this aspect include corresponding computer systems, apparatuses, and computer programs recorded on one or more computer storage devices, each configured to perform method actions.

[0010] In one general aspect, a system may include a processing circuit system. The system may also include a memory, the memory containing instructions, which, when executed by the processing circuit system, configure the system to: generate a virtual network interface having a namespace, the namespace having multiple names, wherein a first name of the namespace is assigned to a client device. The system may also assign a second name of the namespace to a resource accessible to the client device through a zero-trust network environment, wherein the resource is deployed in a secure network environment. The system may additionally configure the client device to communicate only through the virtual network interface. Other embodiments of this aspect include corresponding computer systems, apparatuses, and computer programs recorded on one or more computer storage devices, each configured to perform method actions.

[0011] Implementations may include one or more of the following features. In the system, the memory contains additional instructions, which, when executed by the processing circuit system, further configure the system to: check network traffic received from a client device; determine the destination of the network traffic; and in response to determining that the network traffic is allowable based on a policy of a zero-trust network environment, send the network traffic to the destination. In the system, the memory contains additional instructions, which, when executed by the processing circuit system, further configure the system to: change the grouping of the network traffic so that the response from the resource is directed to the zero-trust network environment, rather than the client device. In the system, the memory contains additional instructions, which, when executed by the processing circuit system, further configure the system to: receive credentials of a user account associated with a user device; and in response to authenticating the received credentials, provide access to the resource through the zero-trust network. In the system, the virtual network interface also includes a routing table. In the system, the memory contains additional instructions, which, when executed by the processing circuit system, further configure the system to: perform deep packet inspection on the network traffic. In the system, resources are deployed in any of the following: a private network, a public network, and any combination thereof. In the system, the resource is any one of the following: a web application, a remote desktop protocol (RDP) server, a secure shell (SSH) server, a file server, an object database, a transaction database, an SQL database, a NoSQL database, a web server, a data repository, and any combination thereof. In the system, the memory contains additional instructions, which, when executed by the processing circuit system, also configure the system to: assign a third name of the namespace to another resource accessible to the client device through a zero-trust network environment, wherein the resource is deployed in a private network and the other resource is deployed in a public network; and in response to determining that the client device requests content from the resource within a time period less than a predefined time period, block network traffic to another resource. In the system, the zero-trust network environment includes any one of the following: a front-end SSH server, a front-end RDP server, an access portal server, a back-end server, and any combination thereof. Implementations of the described technology may include hardware, methods or processes, or computer tangible media. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The subject matter disclosed herein is particularly pointed out and distinctly claimed in the claims at the conclusion of the specification. The foregoing and other objects, features and advantages of the disclosed embodiments will be apparent from the following detailed description taken in conjunction with the accompanying drawings.

[0013] Figure 1 is an example of a network diagram of a user device communicating with a zero trust network for describing an embodiment.

[0014] Figure 2is an example schematic diagram of a client device according to an embodiment.

[0015] Figure 3 is an example of a schematic diagram of a zero trust network for describing an embodiment.

[0016] Figure 4 is an example flow chart of a method for providing a secure web gateway to client devices through a zero-trust network environment, according to an embodiment.

[0017] Figure 5 is a flow chart of a method for directing network traffic to resources through a secure web gateway of a zero-trust network, implemented according to an embodiment.

[0018] Figure 6 is an example schematic diagram of a secure web gateway according to an embodiment. DETAILED DESCRIPTION

[0019] It is important to note that the embodiments disclosed herein are merely examples of many advantageous uses of the innovative teachings herein. In general, statements made in the specification of the present application do not necessarily limit any of the various claimed embodiments. In addition, some statements may apply to some inventive features but not to other features. In general, unless otherwise noted, singular elements may be plural and vice versa without loss of generality. In the accompanying drawings, the same reference numerals refer to the same parts in several views.

[0020] Various disclosed embodiments include methods and systems for providing a secure web gateway (SWG) in a zero-trust network environment. The system configures a client device operated by a user to install an agent on the client device. When executed on the client device, the agent configures the client device to generate a virtual network interface (VNI). The agent also configures the client device to communicate with the zero-trust network environment through the VNI. When the client device requests a network resource (which can be any type of network resource), the agent configures the VNI to expose the network resource to the client device as a resource accessible to the local network through the VNI. The VNI exposes the client device to a virtual local area network, where various external network resources can be represented as if they were local resources in the virtual local area network. Using this method, all communications from the user device are always passed through the zero-trust network, thereby allowing the user device to connect to a secure network and authorized public network access. By not requiring a virtual private network (VPN) to connect the user device and the web application, resources outside the VPN can also be exposed to the user device.

[0021] Figure 1is an example of a network diagram of a user device communicating with a zero-trust network for describing an embodiment. Figure 2 The user device 110 discussed in more detail in FIG. 1 is communicatively connected to the zero trust network environment 120. The user device 110 may be, for example, a personal computer device, a laptop, a tablet, etc. In one embodiment, the zero trust network (ZTN) environment 120 is implemented as a virtual private cloud (VPC) on a cloud computing environment. The cloud computing environment may be, for example, Web Services Web Service, AWS), Azure, Cloud Platform( Cloud Platform, GCP) etc. Figure 3 Examples of the ZTN environment 120 are discussed in more detail in .

[0022] The ZTN environment 120 provides connectivity to a private network 130 and a public network 140. In this example, the user of the user device 110 and the private network 130 belong to the same organization. In other embodiments, the user (i.e., user account) is otherwise permitted to access the private network 130. In one embodiment, the private network 130 may be implemented as a VPC on a public cloud (such as AWS) accessible via the public network 140. The public network 140 may be, for example, the Internet. The public network 140 is generally accessible to any user, while the private network 130 is limited to authorized users who provide credentials that can be authenticated (e.g., via the zero trust network environment 120).

[0023] In some embodiments, the connector application can be deployed in the private network 130 to facilitate the connection between the resources of the private network 130 and the backend servers (such as Figure 3 The resources of the private network 130 may be, for example, an RDP server, an SSH server, a file server, an object database, a transaction database, an SQL database, a NoSQL database, a network server, a data repository, a web application, etc.

[0024] Figure 2 2 is an example schematic diagram of a client device 110 according to an embodiment. The client device 110 includes a processing circuitry 210 coupled to a memory 220, a storage device 230, and a network interface 240. In one embodiment, the components of the client device may be communicatively connected via a bus 250.

[0025] The processing circuit system 210 may be implemented as one or more hardware logic components and circuits. For example, but not limited to, illustrative types of hardware logic components that may be used include field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SOCs), graphics processing units (GPUs), tensor processing units (TPUs), general-purpose microprocessors, microcontrollers, digital signal processors (DSPs), etc., or any other hardware logic components that can perform calculations or other manipulations of information.

[0026] The memory 220 may be volatile (eg, random access memory, etc.), non-volatile (eg, read-only memory, flash memory, etc.), or a combination thereof.

[0027] In one configuration, software for implementing one or more embodiments disclosed herein may be stored in storage device 230. In another configuration, memory 220 is configured to store such software. Software should be broadly interpreted as representing any type of instructions, whether referred to as software, firmware, middleware, microcode, hardware description language or other. Instructions may include code (e.g., source code format, binary code format, executable code format, or any other suitable code format). When executed by processing circuit system 210, the instructions cause processing circuit system 210 to perform various processes described herein.

[0028] The storage device 230 may be a magnetic storage device, an optical storage device, etc., and may be implemented as, for example, flash memory or other memory technology, a compact disk-read only memory (CD-ROM), a digital versatile disk (DVD), or any other medium that may be used to store the desired information.

[0029] The network interface 240 allows the client device 110 to communicate with, for example, a zero trust network (ZTN) 120. In one embodiment, the client device 110 receives agent software from the ZTN 120. The agent software includes instructions that, when executed by the processing circuit system 210 of the client device 110, configure the client device 110 to implement a virtual network interface (VNI) 242. When executed, the instructions may also configure the client device 110 to communicate exclusively through the VNI 242. In one embodiment, the VNI 242 includes a routing table based on a network namespace. In some embodiments, the network namespace is an isolated network namespace. In some embodiments, the agent software may specifically update the routing table to expose various resources.

[0030] For example, the proxy software may update the routing table to indicate that a resource (e.g., a web server) has IP address 10.0.0.115. In reality, the resource has a local private network (e.g., Figure 1 In one embodiment, the packet may be altered to include the IP address of the ZTN 120, the IP address of the resource (i.e., a different address), etc. To the client device 110, the resource is thus viewed as a resource accessible on the local network, when in fact it is only accessible through the ZTN 120. Using this technique, any resource can be mapped through the VNI 242 for exposure to the client device 110. Using this technique, resources from public and / or private networks can be exposed. This is advantageous because it provides additional functionality and access to the client device 110.

[0031] It should be understood that the embodiments described herein are not limited to Figure 2 Specific architectures are shown, and other architectures may equally be used without departing from the scope of the disclosed embodiments.

[0032] Figure 33 is an example of a schematic diagram of a zero trust network 120 for describing an embodiment. The zero trust network (ZTN) 120 includes workloads such as a policy engine 310, a front-end server 320, a back-end server 330, a secure web gateway (SWG) 340, a deep packet inspection (DPI) unit 350, and an identity and access management (IAM) server 360. In one embodiment, the ZTN 120 can be implemented as a VPC on a cloud computing environment (such as AWS). In one embodiment, each workload can be implemented on a bare metal, as a virtual machine, as a container, as a serverless function, and as any combination thereof.

[0033] User devices connected to ZTN 120 may be directed to front-end server 320. Front-end server 320 is configured to receive user devices (such as Figure 1 The ZTN 120 receives communications from user devices 110, sends communications to user devices, and communicates with other components of the ZTN 120 (such as backend server 330, SWG 340, policy engine 310, and IAM server 360).

[0034] In one embodiment, the front-end server 320 is configured to generate a request for credentials of a user account. The credentials may include, for example, a username, a password, a cryptographic key, a secret, a one-time passcode (OTP), biometric information, etc. In one embodiment, the credentials are supplied to the IAM server 360. The IAM server 360 may authenticate the credentials. In one embodiment, the IAM server 360 may issue a multi-factor authentication (MFA) challenge. The challenge may include a request to receive additional credentials (e.g., by sending a unique PIN, a temporary PIN, etc. to a predetermined mobile phone number associated with a user account that supplies credentials from a user device).

[0035] In some embodiments, front-end server 320 is configured to provide agent software to the user device in response to successfully authenticating the credentials provided by the user device. When executed by a processing unit of the user device, the agent software can configure the user device to perform the methods described in more detail herein.

[0036] The back-end server 330 is configured to connect to a private network (e.g., via a connector application deployed in the private network). The private network is a network external to the ZTN 120, not a public network. The back-end server 330 can be configured to communicate with the front-end server 320 to establish a communication line between the client device and the front-end server, the back-end server, and the resources in the private network.

[0037] The secure web gateway (SWG) 340 is configured to perform actions on network traffic received from a user device. The actions may include, for example, filtering uniform resource locators (URLs), content inspection, policy enforcement, malicious code detection, and providing application control for web-based applications (e.g., instant messaging applications). In one embodiment, the SWG 340 may be configured to receive incoming network traffic, such as IP packets, from the front-end server 320. The incoming network traffic may be filtered (e.g., based on policies retrieved from the policy engine 310). The policy engine 310 is configured to store policies related to user accounts, IP addresses, domain directories, etc. thereon. In some embodiments, the SWG 340 is also configured to initiate inspection of the network traffic (e.g., by providing the IP packets to the DPI 350). The DPI 350 is configured to inspect the content of the network traffic (e.g., by performing signature matching to detect network attacks, blocking certain protocols, etc.).

[0038] In some embodiments, SWG 340 may determine when to provide network traffic to DPI 350 (e.g., based on a policy retrieved from policy engine 310). This may be beneficial because performing DPI on every packet may cause network congestion due to a bottleneck on DPI unit 350. SWG 340 may be configured to read only the header of a packet and determine whether the packet should be provided to DPI 350 based on the header information and the policy retrieved from policy engine 310.

[0039] Figure 4 is an example flow chart 400 of a method for providing a secure web gateway to client devices via a zero-trust network environment, implemented in accordance with an embodiment.

[0040] At S410, a software agent is sent to a client device. The software agent includes instructions that, when executed by a processing unit of the client device, configure the client device to perform the steps detailed in the method.

[0041] At S412, a virtual network interface (VNI) is generated. In one embodiment, the VNI includes a routing table based on a network namespace. In some embodiments, the network namespace is an isolated network namespace. The client device can be assigned a name in the namespace, which allows the client device to communicate with other resources with names in the VNI namespace through the VNI.

[0042] At S414, resources are exposed through the VNI. In some embodiments, the routing table may be updated to expose various resources. For example, the routing table may be updated to indicate that a resource (e.g., a web server) is accessible through the IP address 10.0.0.115. In fact, the resource has a local private network (e.g., the above Figure 1 The VNI may be configured to include a different address on the private network 120 of the ZTN. When a client device generates a packet directed to that address, the VNI allows it to pass through and sends the packet to the zero trust network (ZTN) for resolution. In one embodiment, the packet may be altered to include the IP address of the ZTN, the IP address of the resource (i.e., a different address), etc.

[0043] To the client device, the resource is thus treated as a resource accessible on the local network because the VNI exposes the resource as if it were on the same local network as the client device, when in fact it is accessible only through the ZTN. This provides the security of a zero-trust network, which in addition to providing a seamless user experience, can also implement a secure web gateway (SWG). In one embodiment, resources can be exposed from a private network, from a public network, and from a combination thereof. In some embodiments, a request to expose another resource (i.e., to assign a name to another resource in the namespace of the VNI) can be received (e.g., from a client device).

[0044] At S416, a check is performed to determine whether another resource should be exposed to the client device. If so, execution can continue at S414, otherwise, execution can terminate.

[0045] Figure 5 is a flow chart of a method for directing network traffic to resources through a secure web gateway of a zero-trust network, according to an embodiment.

[0046] At S510, network traffic is received from a client device. The network traffic may include, for example, an IP packet having a source, a destination, and a payload. In one embodiment, the client device is configured to communicate using a virtual network interface (VNI), wherein resources are exposed to the client device via the VNI. Resources may be deployed in a private network, a public network, and a combination thereof. Resources may be web applications, RDP servers, SSH servers, file servers, object databases, transaction databases, SQL databases, NoSQL databases, web servers, data repositories, and the like.

[0047] At S520, the network traffic is checked. In one embodiment, checking the network traffic includes reading the header of the IP packet. For example, the source address, the destination address, and the packet size may be read. In some embodiments, the payload of the IP packet may be provided to a deep packet inspection (DPI) unit. The DPI unit is configured to read the contents of the payload and check, for example, network security threats, illegal content (e.g., pirated software), prohibited content (e.g., confidential information), etc.

[0048] At S530, a check is performed to determine whether the network service is an allowed service. In one embodiment, the allowed service is a network service that is allowed based on a policy (e.g., retrieved from a policy engine). For example, the checked network service can be matched with a policy to determine whether it is allowable. A routing table can be used to determine whether a network service is allowed. In certain embodiments, network services may be blocked or partially blocked for a predefined time frame (e.g., based on previous network services). For example, if a user device is downloading content from a private network and is requesting to upload the content to a public network within an amount of time that is less than a predetermined amount of time (e.g., ten minutes), the policy may determine that such a request should be blocked. If the service is allowable, execution continues at S540. If the network service is not allowable, execution continues at S550.

[0049] At S540, the network traffic is sent to the resource. In one embodiment, the address of the resource is determined by reading the header of the IP packet from the network traffic. In some embodiments, the network traffic may be modified to indicate to the resource that the response should be sent to the ZTN instead of to the client device.

[0050] At S550, the network service is blocked. In one embodiment, a notification may be generated and sent to the user device to indicate that the request associated with the network service is blocked.

[0051] At S560, a check is performed to determine whether additional network traffic is received. If so, execution continues at S510. If no additional network traffic is received (e.g., because the connection to the zero-trust network environment is terminated), execution may terminate.

[0052] Figure 6 is an example schematic diagram of a secure web gateway 340 according to an embodiment. The secure web gateway (SWG) 340 includes processing circuitry 610 coupled to a memory 620, storage 630, and a network interface 640. In one embodiment, the components of the SWG 340 may be communicatively connected via a bus 650.

[0053] Processing circuit system 610 may be implemented as one or more hardware logic components and circuits. For example, but not limited to, illustrative types of hardware logic components that may be used include field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on a chip (SOCs), graphics processing units (GPUs), tensor processing units (TPUs), general purpose microprocessors, microcontrollers, digital signal processors (DSPs), etc., or any other hardware logic component that can perform calculations or other manipulations of information.

[0054] The memory 620 may be volatile (eg, random access memory, etc.), non-volatile (eg, read-only memory, flash memory, etc.), or a combination thereof.

[0055] In one configuration, software for implementing one or more embodiments disclosed herein may be stored in storage device 630. In another configuration, memory 620 is configured to store such software. Software should be broadly interpreted as representing any type of instructions, whether referred to as software, firmware, middleware, microcode, hardware description language or other. Instructions may include code (e.g., source code format, binary code format, executable code format, or any other suitable code format). When executed by processing circuit system 610, the instructions cause processing circuit system 610 to perform various processes described herein.

[0056] Storage device 630 may be magnetic storage device, optical storage device, etc. and may be implemented as, for example, flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD), or any other medium that can be used to store the desired information.

[0057] The network interface 640 allows the secure web gateway 340 to communicate with, for example, client devices, front-end servers, back-end servers, DPI units, policy engines, etc.

[0058] It should be understood that the embodiments described herein are not limited to Figure 6 Specific architectures are shown, and other architectures may equally be used without departing from the scope of the disclosed embodiments.

[0059] In addition, front-end servers, back-end servers, DPI units, policy engines, etc. can use similar Figure 6 The present invention may be implemented with the architecture described in without departing from the scope of the disclosed embodiments.

[0060] Various embodiments disclosed herein can be implemented as hardware, firmware, software or any combination thereof. In addition, the software is preferably implemented as an application program tangibly embodied in a program storage unit or a computer readable medium (composed of components or certain devices and / or device combinations). The application program can be uploaded to a machine including any suitable architecture and executed by a machine including any suitable architecture. Preferably, the machine is implemented on a computer platform with hardware such as one or more central processing units ("CPU"), memory and input / output interfaces. The computer platform may also include an operating system and microinstruction codes. The various processes and functions described herein may be a part of a microinstruction code, or a part of an application program, or any combination thereof, which may be executed by a CPU, whether or not such a computer or processor is explicitly shown. In addition, various other peripheral units may be connected to a computer platform, such as an additional data storage unit and a printing unit. In addition, a non-transitory computer readable medium is any computer readable medium other than a temporary propagation signal.

[0061] All examples and conditional language recorded herein are for teaching purposes, to help the reader understand the principles of the disclosed embodiments and the concepts contributed by the inventor to promote this field, and should be interpreted as not being limited to these specifically recorded examples and conditions. In addition, all statements of the principles, aspects and embodiments of the disclosed embodiments and their specific examples recorded herein are intended to cover their structural equivalents and functional equivalents. In addition, it is intended that such equivalents include currently known equivalents and equivalents developed in the future, that is, any element developed to perform the same function, regardless of the structure.

[0062] It should be understood that any reference to elements using reference numerals such as "first", "second", etc. herein generally does not limit the number or order of these elements. Rather, these reference numerals are generally used herein as a convenient method of distinguishing two or more elements or element instances. Therefore, reference to a first element and a second element does not mean that only two elements can be used there, or that the first element must be in some way before the second element. In addition, unless otherwise stated, a group of elements includes one or more elements.

[0063] As used herein, the phrase "at least one of" followed by a list of items means that any of the listed items may be utilized individually, or any combination of two or more of the listed items may be utilized. For example, if a system is described as including "at least one of A, B, and C," the system may include: only A; only B; only C; 2A; 2B; 2C; 3A; a combination of A and B; a combination of B and C; a combination of A and C; a combination of A, B, and C; a combination of 2A and C; a combination of A, 3B, and 2C; and so on.

Claims

1. A method for configuring a client device to communicate using a secure web gateway, comprising: generating a virtual network interface having a namespace, the namespace having a plurality of names, wherein a first name of the namespace is assigned to a client device; assigning a second name of the namespace to a resource accessible by the client device through the zero-trust network environment, wherein the resource is deployed in a secure network environment; and The client device is configured to communicate only through the virtual network interface.

2. The method according to claim 1, further comprising: inspecting network traffic received from the client device; determining a destination of the network traffic; as well as In response to determining that the network traffic is allowable based on a policy of the zero-trust network environment, the network traffic is sent to the destination.

3. The method according to claim 2, further comprising: The packetization of the network traffic is altered so that responses from the resource are directed to the zero trust network environment instead of the client device.

4. The method according to claim 1, further comprising: receiving credentials for a user account associated with the user device; In response to authenticating the received credentials, access to the resource is provided through the zero trust network. The method of claim 1 , wherein the virtual network interface further comprises a routing table.

6. The method according to claim 1, further comprising: Deep packet inspection is performed on the network traffic.

7. The method of claim 1, wherein the resources are deployed in any of the following: a private network, a public network, and any combination thereof.

8. The method of claim 1, wherein the resource is any one of the following: a web application, a Remote Desktop Protocol (RDP) server, a Secure Shell (SSH) server, a file server, an object database, a transactional database, an SQL database, a NoSQL database, a web server, a data repository, and any combination thereof.

9. The method according to claim 1, further comprising: assigning a third name of the namespace to another resource accessible by the client device through the zero trust network environment, wherein the resource is deployed in a private network and the another resource is deployed in a public network; as well as In response to determining that the client device requested content from the resource within a time period that is less than a predefined time period, network traffic to the other resource is blocked.

10. The method according to claim 1, wherein the zero-trust network environment includes any one of the following: a front-end SSH server, a front-end RDP server, an access portal server, a back-end server, and any combination thereof.

11. A non-transitory computer-readable medium storing a set of instructions for configuring a client device to communicate using a secure web gateway, the set of instructions comprising: One or more instructions that, when executed by one or more processors of a device, cause the device to: generating a virtual network interface having a namespace, the namespace having a plurality of names, wherein a first name of the namespace is assigned to a client device; assigning a second name of the namespace to a resource accessible by the client device through the zero-trust network environment, wherein the resource is deployed in a secure network environment; and The client device is configured to communicate only through the virtual network interface.

12. A system for configuring a client device to communicate using a secure web gateway, comprising: Processing circuit system; as well as a memory comprising instructions which, when executed by the processing circuit system, configure the system to: generating a virtual network interface having a namespace, the namespace having a plurality of names, wherein a first name of the namespace is assigned to a client device; assigning a second name of the namespace to a resource accessible by the client device through the zero-trust network environment, wherein the resource is deployed in a secure network environment; and The client device is configured to communicate only through the virtual network interface.

13. The system of claim 12, wherein the memory contains further instructions which, when executed by the processing circuitry, further configure the system to: inspecting network traffic received from the client device; determining a destination of the network traffic; and In response to determining that the network traffic is allowable based on a policy of the zero-trust network environment, the network traffic is sent to the destination.

14. A system according to claim 13, wherein the memory contains further instructions which, when executed by the processing circuitry, further configure the system to: The packetization of the network traffic is altered so that responses from the resource are directed to the zero trust network environment instead of the client device.

15. The system of claim 12, wherein the memory contains further instructions which, when executed by the processing circuitry, further configure the system to: receiving credentials for a user account associated with the user device; and In response to authenticating the received credentials, access to the resource is provided through the zero trust network.

16. The system of claim 12, wherein the virtual network interface further comprises a routing table.

17. The system of claim 12, wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to: Deep packet inspection is performed on the network traffic.

18. The system of claim 12, wherein the resources are deployed in any of the following: a private network, a public network, and any combination thereof.

19. The system of claim 12, wherein the resource is any of the following: a web application, a Remote Desktop Protocol (RDP) server, a Secure Shell (SSH) server, a file server, an object database, a transactional database, an SQL database, a NoSQL database, a web server, a data repository, and any combination thereof.

20. The system of claim 12, wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to: assigning a third name of the namespace to another resource accessible by the client device through the zero trust network environment, wherein the resource is deployed in a private network and the another resource is deployed in a public network; and In response to determining that the client device requested content from the resource within a time period that is less than a predefined time period, network traffic to the other resource is blocked.

21. The system of claim 12, wherein the zero-trust network environment comprises any one of the following: a front-end SSH server, a front-end RDP server, an access portal server, a back-end server, and any combination thereof.

Images