System and method for client-based traffic control using domain directory

Abstract

Embodiments of the present disclosure relate to systems and methods for client-based traffic control using a domain directory. A system and method for booting network traffic in a client device based on a domain directory. The method includes generating a virtual network interface having a namespace, the namespace having a plurality of names, where a first name of the namespace is assigned to a client device; assigning a second name of the namespace to a resource accessible by the client device through the zero-trust network environment; configuring the client device to communicate only through the virtual network interface; in response to determining that the resource is allowed based on the domain directory, network traffic is sent to the resource.

Description

Technical Field

[0001] The present disclosure relates generally to secure web gateways, and in particular to providing web filtering of domains using a domain catalog through a zero-trust network environment. Background Art

[0002] Organizations increasingly allow users to work physically both inside and outside the organization. When outside the organization, users will connect to the organization's internal computer network, private cloud network, hybrid network, etc., in order to access resources stored thereon. Often, users will use their own devices in a bring your own device (BYOD) setting. All of this can lead to security gaps that expose the organization.

[0003] One of the solutions to combat limiting this exposure is through the deployment of a secure web gateway (SWG). An SWG is configured to connect user devices to network resources and additionally perform content filtering, content inspection, and apply security controls to network services. An SWG solution generates a dedicated network space and connects user devices and, for example, web applications that the user devices attempt to access to the dedicated network space. Therefore, in order to use the SWG solution, network resources must be pre-configured in the network space. In addition, SWG solutions designed as stand-alone applications are generally not easily integrated into an organization's workflow, log monitoring, reporting, etc.

[0004] Therefore, it would be advantageous to provide a solution that can overcome the above challenges. Summary of the invention

[0005] An overview of several example embodiments of the present disclosure is as follows. This overview is provided for the convenience of the reader to provide a basic understanding of such embodiments, and does not fully limit the breadth of the present disclosure. This overview is not an extensive overview of all contemplated embodiments, and is neither intended to identify important or key elements of all embodiments, nor to delineate the scope of any or all aspects. Its sole purpose is to present some concepts of one or more embodiments in a simplified form as a prelude to a more detailed description presented later. For convenience, the term "some embodiments" or "certain embodiments" may be used herein to refer to a single embodiment or multiple embodiments of the present disclosure.

[0006] A system of one or more computers may be configured to perform specific operations or actions by virtue of software, firmware, hardware, or a combination thereof installed on the system, which in operation causes the system to perform the actions. One or more computer programs may be configured to perform specific operations or actions by virtue of including instructions that, when executed by a data processing device, cause the device to perform the actions.

[0007] In one general aspect, a method may include generating a virtual network interface having a namespace, the namespace having multiple names, wherein a first name of the namespace is assigned to a client device. The method may also include assigning a second name of the namespace to a resource accessible to the client device through a zero-trust network environment. The method may also include configuring the client device to communicate only through the virtual network interface. The method may also include sending network traffic to the resource in response to determining that the resource is allowed based on a domain directory. Other embodiments of this aspect include corresponding computer systems, apparatuses, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the method.

[0008] Implementations may include one or more of the following features. A method, wherein the domain directory is a table having a first column representing a domain name and a second column representing an attribute. A method, wherein network traffic is blocked based on a value of an attribute. A method, wherein a portion of network traffic is blocked based on the value and a portion of network traffic is allowed based on the value. The method may include: inspecting network traffic received from a client device; determining a destination for the network traffic; and in response to determining that the network traffic is allowed based on a policy of a zero-trust network environment, sending the network traffic to the destination. The method may include: altering the packetization of the network traffic so that a response from a resource is directed to the zero-trust network environment instead of the client device. The method may include: receiving credentials of a user account associated with a user device; and in response to authentication of the received credentials, providing access to the resource through the zero-trust network. The method may include: performing deep packet inspection on the network traffic. The method may include: further determining that the network traffic is allowed based on the deep packet inspection and the domain directory. Implementations of the described technology may include hardware, methods or processes, or computer tangible media.

[0009] In one general aspect, a non-transitory computer-readable medium may include generating a virtual network interface having a namespace, the namespace having multiple names, wherein a first name of the namespace is assigned to a client device. The non-transitory computer-readable medium may also include assigning a second name of the namespace to a resource accessible to the client device through a zero-trust network environment. The medium may also include configuring the client device to communicate only through the virtual network interface. The medium may also include sending network traffic to the resource in response to determining that the resource is allowed based on a domain directory. Other embodiments of this aspect include corresponding computer systems, apparatuses, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the method.

[0010] In one general aspect, a system may include a processing circuit system. The system may also include a memory containing instructions that, when executed by the processing circuit, configure the system to: generate a virtual network interface having a namespace, the namespace having multiple names, wherein a first name of the namespace is assigned to a client device. In addition, the system may assign a second name of the namespace to a resource accessible to the client device through a zero-trust network environment. In addition, the system may configure the client device to communicate only through the virtual network interface. The system may also send network traffic to a resource in response to determining that the resource is allowed based on a domain directory. Other embodiments of this aspect include corresponding computer systems, apparatuses, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the method.

[0011] Implementations may include one or more of the following features. A system wherein the domain directory is a table having a first column representing a domain name and a second column representing an attribute. A system wherein network traffic is blocked based on a value of the attribute. A system wherein a portion of the network traffic is blocked based on the value and a portion of the network traffic is allowed based on the value. A system wherein the memory contains another instruction that, when executed by the processing circuit system, further configures the system to: inspect network traffic received from a client device; determine a destination for the network traffic; and, in response to determining that the network traffic is allowed based on a policy of the zero trust network environment, send the network traffic to the destination. A system wherein the memory contains another instruction that, when executed by the processing circuit system, further configures the system to: alter the grouping of the network traffic so that a response from a resource is directed to the zero trust network environment rather than the client device. A system wherein the memory contains another instruction that, when executed by the processing circuit system, further configures the system to: receive credentials for a user account associated with a user device; and, in response to authentication of the received credentials, provide access to the resource through the zero trust network. The system, wherein the memory contains another instruction, which, when executed by the processing circuit, further configures the system to: perform deep packet inspection on the network service. The system, wherein the memory contains another instruction, which, when executed by the processing circuit system, further configures the system to: further determine that the network service is allowed based on the deep packet inspection and the domain directory. Implementations of the described technology may include hardware, methods or processes, or computer tangible media. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The subject matter disclosed herein is particularly pointed out and distinctly claimed in the claims at the conclusion of the specification. The foregoing and other objects, features and advantages of the disclosed embodiments will become apparent from the following detailed description taken in conjunction with the accompanying drawings.

[0013] Figure 1is an example of a network diagram of a user device communicating with a zero trust network, for purposes of describing an embodiment.

[0014] Figure 2 is an example schematic diagram of a client device according to an embodiment.

[0015] Figure 3 is an example of a schematic diagram of a zero trust network, used to describe an embodiment.

[0016] Figure 4 is an example flow chart of a method for providing a secure web gateway to a client device in a zero-trust network environment, the method being implemented according to an embodiment.

[0017] Figure 5 is a flow chart of a method for directing network traffic to resources through a secure web gateway of a zero-trust network, the method being implemented according to an embodiment.

[0018] Figure 6 is an example schematic diagram of a secure web gateway according to an embodiment. DETAILED DESCRIPTION

[0019] It is important to note that the embodiments disclosed herein are merely examples of the many advantageous uses of the innovative teachings herein. In general, statements made in the specification of this application do not necessarily limit any of the various embodiments claimed. In addition, some statements may apply to some inventive features but not to other inventive features. In general, unless otherwise stated, singular elements may be plural and vice versa without loss of generality. In the accompanying drawings, like numbers refer to like parts in the several views.

[0020] Various disclosed embodiments include methods and systems for providing a secure web gateway (SWG) on a zero-trust network environment. The system configures a client device operated by a user to install an agent on the client device. When executed on the client device, the agent configures the client device to generate a virtual network interface (VNI). The agent also configures the client device to communicate with the zero-trust network environment through the VNI. When the client device requests a network resource (which can be any type of network resource), the agent configures the VNI to expose the network resource to the client device as a resource accessible to the local network through the VNI. The VNI exposes the client device to a virtual local network, where various external network resources can be represented as if they were local resources in the virtual local network. Using this method, all communications from the user device are always passed through the zero-trust network, allowing the user device to connect to both a secure network and authorized public network access. Since a virtual private network (VPN) is not required to connect the user device and the web application, resources outside the VPN can also be exposed to the user device.

[0021] Figure 1 is an example of a network diagram of a user device communicating with a zero-trust network, used to describe an embodiment. Figure 2 The user device 110 discussed in more detail in FIG. 1 is communicatively connected to the zero trust network environment 120. For example, the user device 110 may be a personal computer device, a laptop computer, a tablet computer, etc. In an embodiment, the zero trust network (ZTN) environment 120 is implemented as a virtual private cloud (VPC) on a cloud computing environment. For example, the cloud computing environment may be Web Services (AWS), Azure, Cloud platform (GCP), etc. Figure 3 Examples of the ZTN environment 120 are discussed in more detail in .

[0022] The ZTN environment 120 provides connections to a private network 130 and a public network 140. In this example, the user of the user device 110 and the private network 130 belong to the same organization. In other embodiments, the user (i.e., user account) is granted access to the private network 130. In an embodiment, the private network 130 can be implemented as a VPC on a public cloud (such as AWS) accessible via a public network 140. For example, the public network 140 can be the Internet. The public network 140 is generally accessible to any user, while access to the private network 130 is limited to authorized users, who provide credentials that can be authenticated, for example, through the zero trust network environment 120.

[0023] In some embodiments, the connector application can be deployed in the private network 130 to facilitate the connection between the resources of the private network 130 and the backend servers ( Figure 3 For example, private network 130 may be an RDP server, an SSH server, a file server, an object database, a transaction database, an SQL database, a NoSQL database, a web server, a data repository, a web application, and the like.

[0024] Figure 2 is an example schematic diagram of a client device 110 according to an embodiment. Client device 110 includes processing circuitry 210 coupled to memory 220, storage 230, and network interface 240. In an embodiment, the components of the client device may be communicatively connected via a bus 250.

[0025] The processing circuit system 210 may be implemented as one or more hardware logic components and circuits. For example, but not limited to, illustrative types of hardware logic components that may be used include field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), graphics processing units (GPUs), tensor processing units (TPUs), general purpose microprocessors, microcontrollers, digital signal processors (DSPs), etc., or any other hardware logic components that can perform calculations or other information manipulations.

[0026] The memory 220 may be volatile (eg, random access memory, etc.), non-volatile (eg, read-only memory, flash memory, etc.), or a combination thereof.

[0027] In one configuration, software for implementing one or more embodiments disclosed herein may be stored in storage device 230. In another configuration, memory 220 is configured to store such software. Software should be broadly interpreted to mean any type of instructions, whether software, firmware, middleware, microcode, hardware description language or other. Instructions may include code (e.g., source code format, binary code format, executable code format, or any other suitable code format). When executed by processing circuit system 210, the instructions cause processing circuit system 210 to perform various processes described herein.

[0028] Storage device 230 may be a magnetic storage device, an optical storage device, etc., and may be implemented, for example, as flash memory or other storage technology, a compact disk read only memory (CD-ROM), a digital versatile disk (DVD), or any other medium that can be used to store the desired information.

[0029] The network interface 240 allows the client device 110 to communicate, for example, with a zero trust network (ZTN) 120. In an embodiment, the client device 110 receives agent software from the ZTN 120. The agent software includes instructions that, when executed by the processing circuit system 210 of the client device 110, configure the client device 110 to implement a virtual network interface (VNI) 242. The instructions, when executed, may also configure the client device 110 to communicate exclusively through the VNI 242. In an embodiment, the VNI 242 includes a routing table based on a network namespace. In some embodiments, the network namespace is an isolated network namespace. In some embodiments, the agent software may specifically update the routing table to expose various resources.

[0030] For example, the proxy software may update the routing table to indicate that a resource (e.g., a web server) has an IP address of 10.0.0.115. In reality, the resource has a local private network (e.g., Figure 1242). When a client device 110 generates a packet directed to that address, VNI 242 allows it to pass and sends the packet to ZTN 120 for resolution. In an embodiment, the packet can be changed to include the IP address of ZTN 120, the IP address of the resource (i.e., a different address), etc. To the client device 110, the resource is therefore treated as a resource accessible on the local network, when in fact it is only accessible through ZTN 120. Using this technique, any resource can be mapped through VNI 242 to be exposed to the client device 110. This technique can be used to expose resources from the public network, from the private network, and from both. This is advantageous because it provides additional functionality and access to the client device 110.

[0031] It should be understood that the embodiments described herein are not limited to Figure 2 The specific architectures illustrated in the drawings are used, and other architectures may equally be used without departing from the scope of the disclosed embodiments.

[0032] Figure 3 3 is an example of a schematic diagram of a zero trust network 120 for describing an embodiment. The zero trust network (ZTN) 120 includes workloads such as a policy engine 310, a domain directory 305, a front-end server 320, a back-end server 330, a secure web gateway (SWG) 340, a deep packet inspection (DPI) unit 350, and an identity and access management (IAM) server 360. In an embodiment, the ZTN 120 may be implemented as a VPC on a cloud computing environment (such as AWS). In an embodiment, each workload may be: implemented as a virtual machine on bare metal, implemented as a container, implemented as a serverless function, and implemented as any combination thereof.

[0033] User devices connected to the ZTN 120 may be directed to the front-end server 320. The front-end server 320 is configured to receive user devices (such as Figure 1 The ZTN 120 receives communications from and sends communications to user devices 110, and communicates with other components of the ZTN 120, such as the backend server 330, the SWG 340, the policy engine 310, and the IAM server 360.

[0034] In an embodiment, the front-end server 320 is configured to generate a request for credentials for a user account. For example, the credentials may include a username, a password, an encryption key, a key, a one-time password (OTP), biometric information, etc. In an embodiment, the credentials are provided to the IAM server 360. The IAM server 360 may authenticate the credentials. In an embodiment, the IAM server 360 may issue a multi-factor authentication (MFA) challenge. For example, by sending a unique PIN, a temporary PIN, etc. to a predetermined mobile phone number associated with a user account that provides credentials from a user device, the challenge may include a request to receive additional credentials.

[0035] In some embodiments, the front-end server 320 is configured to provide the user device with agent software in response to successfully authenticating the credentials provided by the user device. When executed by the processing unit of the user device, the agent software can configure the user device to perform the method described in more detail herein.

[0036] The back-end server 330 is configured to connect to a private network, for example, via a connector application deployed in the private network. The private network is a network external to the ZTN 120 and is not a public network. The back-end server 330 can be configured to communicate with the front-end server 320 to establish a communication line between the client device to the front-end server, to the back-end server, and to the resources in the private network.

[0037] The secure web gateway (SWG) 340 is configured to perform actions on network traffic received from a user device. For example, the actions may include filtering uniform resource locators (URLs), content inspection, policy enforcement, malicious code detection, and providing application control for web-based applications (such as instant messaging applications). In an embodiment, the SWG 340 may be configured to receive incoming network traffic, such as IP packets, from the front-end server 320. The incoming network traffic may be filtered, for example, based on policies retrieved from the policy engine 310. The engine 310 is configured to store policies related to user accounts, IP addresses, domain directories, etc. thereon. In some embodiments, the SWG 340 is also configured to initiate inspection of the network traffic, for example, by providing the IP packets to the DPI 350. The DPI 350 is configured to inspect the content of the network traffic, for example, by performing signature matching to detect network attacks, block certain protocols, etc.

[0038] In some embodiments, SWG 340 may determine when to provide network traffic to DPI 350, for example, based on a policy retrieved from policy engine 310. This may be beneficial because performing DPI on every packet may cause congestion due to a bottleneck on DPI unit 350. SWG 340 may be configured to read only the packet header and determine whether the packet should be provided to DPI 350 based on that header information and the policy retrieved from policy engine 310.

[0039] The domain directory 305 includes a list of domains and their attributes, which the policy engine 310 can use to filter network traffic. For example, the domain directory 305 can be implemented as a table stored on a database, where the first column is the domain name (i.e., www.example.com, *.example.com, *.example.*, etc.), the second column is the first attribute of the domain name, the third column is the second attribute of the domain name, etc. For example, the attribute or attribute value can be a web application, social media, email, CRM, news, entertainment, professional forums, etc. The policy engine 310 can store policies that filter network traffic when applied, for example. For example, the policy engine 310 can store policies that, when applied, block network traffic to any domain containing example.com. As another example, the policy engine 310 can store policies that, when applied, block any traffic to a domain with the attribute "social media".

[0040] In an embodiment, a portion of network traffic may be blocked based on an attribute of a domain, and a portion of network traffic may be allowed based on the attribute. For example, if the attribute is "instant messaging," the policy engine 310 may store a policy that, when applied, allows messages from the domain, but blocks media (e.g., pictures, videos, etc.), files, etc.

[0041] Figure 4 is an example flow chart 400 of a method for providing a secure web gateway to client devices on a zero-trust network environment, the method being implemented in accordance with an embodiment.

[0042] At S410, a software agent is sent to a client device. The software agent includes instructions that, when executed by a processing unit of the client device, configure the client device to perform the steps detailed in the method.

[0043] At S412, a virtual network interface (VNI) is generated. In an embodiment, the VNI includes a routing table based on a network namespace. In some embodiments, the network namespace is an isolated network namespace. Client devices can be assigned names in the namespace, which allows the client devices to communicate with other resources with names in the VNI namespace through the VNI.

[0044] At S414, the resource is exposed through the VNI. In some embodiments, the routing table can be updated to expose various resources. For example, the routing table can be updated to indicate that a resource (e.g., a web server) is accessible through the IP address 10.0.0.115. In fact, the resource has a local private network (e.g., the above Figure 1 The VNI may be configured to include a different address on the private network 120 of the ZTN. When a client device generates a packet directed to the address, the VNI allows it to pass and sends the packet to the zero trust network (ZTN) for resolution. In an embodiment, the packet may be altered to include the IP address of the ZTN, the IP address of the resource (i.e., a different address), etc.

[0045] To the client device, the resource is thus treated as a resource accessible on the local network because the VNI exposes the resource as if it were on the same local network as the client device, when in fact it is accessible only through the ZTN. This provides the security of a zero-trust network, which in addition to providing a seamless user experience, can also implement a secure web gateway (SWG). In embodiments, resources can be exposed from a private network, from a public network, and from a combination thereof. In certain embodiments, a request can be received, for example, from a client device to expose another resource (i.e., to assign a name in the namespace of the VNI to the other resource).

[0046] At S416, a check is performed to determine whether another resource should be exposed to the client device. If so, execution can continue at S414, otherwise execution can be terminated.

[0047] Figure 5 is a flow chart of a method for directing network traffic to resources through a secure web gateway of a zero-trust network, the method being implemented according to an embodiment.

[0048] At S510, network traffic is received from a client device. For example, the network traffic may include an IP packet having a source, a destination, and a payload. In an embodiment, the client device is configured to communicate using a virtual network interface (VNI), wherein resources are exposed to the client device through the VNI. Resources may be deployed in a private network, a public network, and combinations thereof. Resources may be network applications, RDP servers, SSH servers, file servers, object databases, transaction databases, SQL databases, NoSQL databases, web servers, data repositories, and the like.

[0049] At S520, the network traffic is checked. In an embodiment, checking the network traffic includes reading an IP packet header. For example, the source address, the destination address, and the packet size may be read. The destination may include a uniform resource locator (URL), a domain name, etc. In certain embodiments, the payload of the IP packet may be provided to a deep packet inspection (DPI) unit. The DPI unit is configured to read the contents of the payload and, for example, check for network security threats, illegal content (e.g., pirated software), prohibited content (e.g., confidential information), etc.

[0050] At S530, a check is performed to determine whether the network service is an allowed service. In an embodiment, the allowed service is a network service that is allowed based on a policy (e.g., retrieved from a policy engine). For example, the checked network service can be matched to a policy to determine whether it is permissible. A routing table can be used to determine whether the network service is allowed. In certain embodiments, for example, based on previous network services, network services can be blocked or partially blocked for a predefined time period. For example, if a user device has downloaded content from a private network and is requesting content to be uploaded to a public network within a time period less than a predetermined amount of time (e.g., ten minutes), the policy can determine that such a request should be blocked. In other embodiments, network services are determined to be permissible based on a domain directory. In some embodiments, a first user account can access a domain that a second user account cannot access. If the service is permissible, execution continues at S540. If the network service is not permissible, execution continues at S550.

[0051] At S540, the network traffic is sent to the resource. In an embodiment, the address of the resource is determined by reading an IP header packaged from the network traffic. In some embodiments, the network traffic may be modified to indicate to the resource that the response should be sent to the ZTN instead of to the client device.

[0052] At S550, the network traffic is blocked. In an embodiment, a notification may be generated and sent to the user device to indicate that the request associated with the network traffic is blocked.

[0053] At S560, a check is performed to determine whether additional network traffic is received. If so, execution continues at S510. If no additional network traffic is received (e.g., because the connection to the zero-trust network environment is terminated), execution may terminate.

[0054] Figure 6 6 is an example schematic diagram of a secure web gateway 340 according to an embodiment. The secure web gateway (SWG) 340 includes processing circuitry 610 coupled to a memory 620, storage 630, and a network interface 640. In an embodiment, the components of the SWG 340 may be communicatively connected via a bus 650.

[0055] The processing circuit system 610 may be implemented as one or more hardware logic components and circuits. For example, but not limited to, illustrative types of hardware logic components that may be used include field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on a chip (SOCs), graphics processing units (GPUs), tensor processing units (TPUs), general purpose microprocessors, microcontrollers, digital signal processors (DSPs), etc., or any other hardware logic components that can perform calculations or other information manipulations.

[0056] The memory 620 may be volatile (eg, random access memory, etc.), non-volatile (eg, read-only memory, flash memory, etc.), or a combination thereof.

[0057] In one configuration, software for implementing one or more embodiments disclosed herein may be stored in storage device 630. In another configuration, memory 620 is configured to store such software. Software should be broadly interpreted as meaning any type of instruction, whether it refers to software, firmware, middleware, microcode, hardware description language, or other. Instructions may include code (e.g., source code format, binary code format, executable code format, or any other suitable code format). When executed by processing circuit system 610, the instruction causes processing circuit system 610 to perform various processes described herein.

[0058] Storage device 630 may be a magnetic storage device, an optical storage device, etc., and may be implemented as, for example, flash memory or other storage technology, a compact disk read only memory (CD-ROM), a digital versatile disk (DVD), or any other medium that can be used to store the desired information.

[0059] The network interface 640 allows the secure web gateway 340 to communicate, for example, with client devices, front-end servers, back-end servers, DPI units, policy engines, and the like.

[0060] It should be understood that the embodiments described herein are not limited to Figure 6 The specific architectures illustrated in the drawings are used, and other architectures may equally be used without departing from the scope of the disclosed embodiments.

[0061] In addition, front-end servers, back-end servers, DPI units, policy engines, etc. can use Figure 6 The present invention may be implemented with a similar architecture as described in without departing from the scope of the disclosed embodiments.

[0062] Various embodiments disclosed herein can be implemented as hardware, firmware, software, or any combination thereof. In addition, the software is preferably implemented as an application program, which is tangibly embodied in a program storage unit or a computer-readable medium consisting of a component, or a combination of certain devices and / or devices. The application program can be uploaded to a machine including any suitable architecture and executed by it. Preferably, the machine is implemented on a computer platform, and the computer platform has hardware such as one or more central processing units ("CPU"), memory, and input / output interfaces. The computer platform can also include an operating system and microinstruction codes. The various processes and functions described herein can be a part of a microinstruction code, or a part of an application program, or any combination thereof, which can be executed by a CPU, whether or not such a computer or processor is explicitly shown. In addition, various other peripheral units can be connected to the computer platform, such as additional data storage units and printing units. In addition, a non-transient computer-readable medium is any computer-readable medium other than a transient propagation signal.

[0063] All examples and conditional language described herein are intended for teaching purposes to help the reader understand the principles of the disclosed embodiments and the concepts contributed by the inventor to promote this area, and should be interpreted as not being limited to such specific examples and conditions. In addition, all statements describing the principles, aspects, and embodiments of the disclosed embodiments and their specific examples herein are intended to cover their structural and functional equivalents. In addition, such equivalents are intended to include currently known equivalents and equivalents developed in the future (that is, any element developed to perform the same function), regardless of their structure.

[0064] It should be understood that any reference to an element using names such as "first", "second", etc. herein does not generally limit the number or order of these elements. Instead, these names are generally used herein as a convenient method to distinguish two or more elements or element instances. Therefore, a reference to a first and a second element does not mean that only two elements can be used there, nor does it mean that the first element must be in some way before the second element. In addition, unless otherwise stated, a group of elements includes one or more elements.

[0065] As used herein, the phrase "at least one of" followed by a list of items means that any one of the listed items may be used alone or in any combination of two or more of the listed items. For example, if a system is described as including "at least one of A, B, and C," the system may include only A; B alone; C alone; 2 As; 2 Bs; 2 Cs; 3 As; a combination of A and B; a combination of B and C; a combination of A and C; a combination of A, B, and C; a combination of 2 A and C; a combination of A, 3 Bs, and 2 Cs; and so on.

Claims

1. A method for directing network traffic in a client device based on a domain directory, the method comprising: generating a virtual network interface having a namespace, the namespace having a plurality of names, wherein a first name of the namespace is assigned to a client device; assigning a second name of the namespace to a resource accessible by the client device through the zero trust network environment; configuring the client device to communicate only through the virtual network interface; as well as In response to determining that the resource is allowed based on the domain directory, network traffic is sent to the resource.

2. The method of claim 1, wherein the domain directory is a table comprising a first column representing domain names and a second column representing attributes. The method of claim 2 , wherein the network traffic is blocked based on a value of the attribute. 4 . The method of claim 2 , wherein a portion of the network traffic is blocked based on the value and a portion of the network traffic is allowed based on the value.

5. The method according to claim 1, further comprising: inspecting network traffic received from the client device; determining a destination of the network traffic; as well as In response to determining that the network traffic is allowable based on a policy of the zero-trust network environment, the network traffic is sent to the destination.

6. The method according to claim 5, further comprising: The grouping of the network traffic is altered so that responses from the resources are directed to the zero trust network environment instead of the client device.

7. The method according to claim 1, further comprising: receiving credentials for a user account associated with the user device; In response to authentication of the received credentials, access to the resource is provided through the zero trust network.

8. The method according to claim 1, further comprising: Deep packet inspection is performed on the network traffic.

9. The method according to claim 8, further comprising: The network traffic is further determined to be allowed based on the deep packet inspection and the domain directory.

10. A non-transitory computer readable medium (CRM) storing thereon instructions for causing a processing circuit system to perform a process, the process comprising: generating a virtual network interface having a namespace, the namespace having a plurality of names, wherein a first name of the namespace is assigned to a client device; assigning a second name of the namespace to a resource accessible by the client device through the zero trust network environment; configuring the client device to communicate only through the virtual network interface; as well as In response to determining that the resource is allowed based on the domain directory, network traffic is sent to the resource.

11. A system for directing network traffic in a client device based on a domain directory, the system comprising: Processing circuit system; as well as a memory comprising instructions that, when executed by the processing circuitry, configure the system to: generating a virtual network interface having a namespace, the namespace having a plurality of names, wherein a first name of the namespace is assigned to a client device; assigning a second name of the namespace to a resource accessible by the client device through the zero trust network environment; configuring the client device to communicate only through the virtual network interface; as well as In response to determining that the resource is allowed based on the domain directory, network traffic is sent to the resource.

12. The system of claim 11, wherein the domain directory is a table including a first column representing domain names and a second column representing attributes.

13. The system of claim 12, wherein the network traffic is blocked based on a value of the attribute.

14. The system of claim 12, wherein a portion of the network traffic is blocked based on the value and a portion of the network traffic is allowed based on the value.

15. The system of claim 11, wherein the memory contains further instructions that, when executed by the processing circuit, further configure the system to: inspecting network traffic received from the client device; determining a destination of the network traffic; and In response to determining that the network traffic is allowable based on a policy of the zero-trust network environment, the network traffic is sent to the destination.

16. The system of claim 15, wherein the memory contains further instructions which, when executed by the processing circuit, further configure the system to: The grouping of the network traffic is altered so that responses from the resources are directed to the zero trust network environment instead of the client device.

17. The system of claim 11, wherein the memory contains further instructions that, when executed by the processing circuit, further configure the system to: receiving credentials for a user account associated with the user device; In response to authentication of the received credentials, access to the resource is provided through the zero trust network.

18. The system of claim 11, wherein the memory contains further instructions that, when executed by the processing circuit, further configure the system to: Deep packet inspection is performed on the network traffic.

19. The system of claim 18, wherein the memory contains further instructions which, when executed by the processing circuit, further configure the system to: The network traffic is further determined to be allowed based on the deep packet inspection and the domain directory.

Images