Zero Trust Endpoint Network Security Devices

Abstract

Described herein are devices, systems, and methods for zero trust endpoint network security. The method may include providing, by a ZTENS device, first data indicating that the ZTENS device is communicatively coupled to a computing device, providing, by the ZTENS device and via a first communication channel through a web application of the computing device, one or more URLs, receiving, by the ZTENS device and via the first communication channel, data indicating one of the one or more URLs selected by a user of the computing device through the web application, communicating, by the ZTENS device, a request for website data for a website associated with the selected URL, and receiving, by the ZTENS device, the website data and providing the website data to the computing device.

Description

[Technical field]

[0001] Claiming priority This application claims the benefit of priority to U.S. Patent Application No. 17 / 158,345, filed January 26, 2021, which is incorporated by reference in its entirety herein.

[0002] FIELD OF THE DISCLOSURE The embodiments described herein relate to devices, systems, and methods for network security, which may be used alone or in combination, with limitations. [Background technology]

[0003] Most data on external networks is accessed through web applications such as web browsers, web apps, etc. Security of the computing device requesting the data is provided by software on the computing device. Typically, the software is part of the web application, the operating system (OS), or the computing device's firewall. This security is limited in its flexibility and the user of the computing device is left to the security provided. The owner of the data being accessed has no control over the security of the data after it leaves their database. [Brief description of the drawings]

[0004] [Figure 1] As an example, a diagram of one embodiment of a system including a Zero Trust Endpoint Network Security (ZTENS) device is shown. [Diagram 2] As an example, a diagram of one embodiment of a method for ZTENS is shown. [Diagram 3] By way of example, a block diagram of one embodiment of a machine of an exemplary form of a computer system within which instructions may be executed to cause the machine to perform any one or more of the methods described herein is shown. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0005] 1 illustrates, by way of example, a diagram of one embodiment of a system 100 including a Zero Trust Endpoint Network Security (ZTENS) device 110. The illustrated system 100 includes a computing device 104 operable by a user 102. The computing device 104 can be communicatively coupled to an external network 106. The computing device 104 can be communicatively coupled to a ZTENS device 110. The ZTENS device 110 can be communicatively coupled to a network 106. The network 106 is communicatively coupled to a web server 108.

[0006] The user 102 can access the application or hardware functionality of the computing device 104 through the user interface 112. The user interface 112 can provide the user 102 with access to functionality or data through a web application 118, for example. The web application 118 can include a web browser, a web app (e.g., a mobile app or other application that accesses data or services on another network). The web application 118 is distinct from a computer-based software program that runs locally on the operating system (OS) 114 of the device 100, and accesses the functionality of hardware or software that runs on the web server 108. The web functionality or hardware is accessed by the user 102 through the web application 118 using an active Internet connection (provided by the ZTENS device 110). The web functionality is programmed using a client-server modeling structure; that is, the user 102 ("client") is provided with services through an off-site server (web server 108) hosted by a third party. Examples of commonly used web applications include webmail, online retail sales, online banking, data storage, and online auctions.

[0007] Typically, when a user 102 wishes to access web functionality, the user 102 enters a uniform resource locator (URL) into a web browser or launches a web application 118. The web application 118 can then access the functionality of the network interface 116 through the operating system (OS) 114. The OS 114 provides applications, such as the web application 118, with access to the hardware functionality of the computing device 104. The communications circuitry 120 of the network interface 116 is an example of such hardware.

[0008] The communication circuitry 120 may be connected to a variety of devices via a physical port or bus, such as Ethernet (e.g., Ethernet RJ45), Universal Serial Bus (USB), Controller Area Network (CAN), Serial Peripheral Interface (SPI), Inter-integrated Circuit (I 2 The communications circuitry 120 may implement a wired data port protocol such as IEEE 802.11b, Universal Asynchronous Receiver / Transmitter (UART), or a wired data port protocol such as IEEE 802.11b, IEEE 802.11c, or a cellular data communications channel such as Bluetooth, WiFi, or a cellular data communications channel using a transmitter, receiver, or transceiver.

[0009] The OS 114 can issue a command to the network interface 116, which causes communication of a request for data corresponding to the URL. The network 106 can communicate with a web server 108 to retrieve the data for the URL. The web server 108 can return the data corresponding to the URL to the computing device 104 over the network 106. The user 102 can then view the data corresponding to the URL through the web application 118.

[0010] This process of accessing data corresponding to a URL includes security risks. An adversary can eavesdrop on communications between the computing device 104 and the network 106. An adversary can eavesdrop on communications between the network 106 and the web server 108. An adversary can tamper with data in the intercepted communications. The tampered data can harm one or more of the computing device 104, the network 106, or the web server 108. The tampered data can spoof the Domain Name Service (DNS) translation of a URL to an Internet Protocol (IP) address, be part of a distributed denial of service (DDOS) attack, include credential stuffing, etc. The OS 114 and web application 118 can include software or hardware configured to help mitigate these vulnerabilities, but no true solution for mitigating these vulnerabilities is currently known. These vulnerabilities of typical URL data access can be mitigated using the ZTENS device 110.

[0011] The illustrated ZTENS device 110 includes a WebUSB / WebBluetooth application 154. WebUSB and WebBluetooth are application programming interface (API) standards for securely providing access to USB or Bluetooth devices from a web browser (via a web page). For example, the WebUSB standard was published by the Web Platform Incubator Community Group.

[0012] The application 154 can be launched when the user 102 communicatively connects to the ZTENS device 110 via the computing device 104. The application 154 can cause the web browser 118 to display a home page for the ZTENS device 110. The home page for the ZTENS device 110 can present services available from the ZTENS device. The user 102 can interact with the ZTENS device 110 through the web application 118, such as by selecting an available service. The service can include a URL to a website accessible via (e.g., only via) the ZTENS device 110.

[0013] The ZTENS device 110 further includes a security circuit 122, a communication circuit 124 (similar to the communication circuit 120), and a memory 126. The security circuit 122 provides intrusion detection and / or prevention, such as to help reduce the likelihood of eavesdropping, spoofing, or other attacks. The communication circuit 124 provides wired and / or wireless communication capabilities for the ZTENS device 110. The communication circuit 124 can communicate with the computing device 104 or the network 106. The computing device 104 can communicate with the network 106 via the ZTENS device 110.

[0014] Instead of relying on security provided by the OS 114, web applications 118, or other components of the computing device 104, the user 102 can improve web security by using the ZTENS device 110.

[0015] The application 154 can cause the web application 118 (via the communications circuitry 124) to present a list of one or more permissible URLs 132 (or links to permissible URLs 132) that, upon selection, navigates to a website corresponding to the URL selected via the ZTENS device 110. Communications to the ZTENS device 110 can be protected by the security circuitry 122.

[0016] The illustrated security circuitry 122 includes a geofence application 138, a multi-factor authentication application 140, a personal identification number (PIN) 142, encryption 144 hardware and / or software, biometric authentication 146 hardware and / or software, transport layer security (TLS) 150, a certificate authority 148, and a random number generator (RNG) 152. The security circuitry 122 generally provides intrusion detection and / or prevention to communications to and from the ZTENS device 110.

[0017] The geofence 138 can include Global Positioning System (GPS), Galileo, or other geolocation circuitry configured to determine the location of the ZTENS device 110. The geofence 138 can include rules that define where functionality of the ZTENS device 110 is accessible and / or inaccessible. The geofence 138 can force the user 102 to use the ZTENS device 110 only in designated geographic locations.

[0018] Multi-factor authentication 140 can prohibit access to functionality of the ZTENS device 110 unless the user 102 can provide multiple forms of authentication. Examples of authentication include, among others, a password, a PIN (e.g., PIN 142), biometrics (e.g., fingerprint, iris, or face scan via biometrics 146), a verification code sent to a personal electronic mail (email), a phone call, etc.

[0019] The PIN 142 may include a hardware interface, such as a keypad (e.g., on a touch screen) through which the PIN of the user 102 may be entered. The PIN 142 entry can help ensure that the user 102 is authorized to access the functionality of the ZTENS device 110.

[0020] Encryption 144 may implement symmetric, asymmetric, or other encryption techniques. Encryption 144 may include hardware or software encryption techniques. Symmetric encryption is generally more secure than asymmetric encryption and may be preferred. In symmetric encryption, a single key is used to encrypt and decrypt data. In asymmetric encryption, a private key is used to encrypt and a public key is used to decrypt. It is possible to determine the private key based on the public key, making asymmetric encryption less secure. Symmetric encryption may be implemented using a secure RNG 152, password, or code. Examples of symmetric encryption include Advanced Encryption Standard (AES), Data Encryption Standard (DES), International Data Encryption Algorithm (IDEA), or Rivest Cipher (RC) (e.g., RC4, RC5, or RC6). Secure Sockets Layer (SSL) and Transport Layer Security (TLS) 150 are examples of protocols (used by Hypertext Transport Protocol Secure (HTTPS)) that implement asymmetric encryption protocols. Rivest-Shamir-Adleman (RSA), Diffie-Helman, Elliptic Curve Cryptosystem (ECC), El Gamal, and the Digital Signature Algorithm (DSA) are examples of asymmetric cryptographic protocols.

[0021] The biometric 146 hardware and / or software may be accessed via a user interface 160 where the user 102 provides biometric data. The biometric 146 hardware and / or software may perform an iris scan, face scan, fingerprint scan, etc. of the user 102. The memory 126 may contain predicted biometric 156 data of the user 102 from previous biometric scans. The biometric 146 hardware and / or software may be used to help ensure that only authorized users access the functionality of the ZTENS device 110.

[0022] The certificate authority 148 issues digital certificates that certify ownership of the encryption keys 136. The certificate authority 148 allows management of the web servers 108 that host websites on acceptable URLs 132 to certify ownership of the encryption keys 136. The certificate authority 148, in conjunction with TLS / SSL 150, can enable HTTPS communication between the computing device 104 and the ZTENS device 110.

[0023] The memory 126 may include acceptable URLs 132 (in the form of URLs) of one or more websites that may be accessed via the ZTENS device 110. The acceptable URLs 132 may include websites that contain more sensitive information than normal. Examples of such websites include personal or business banking websites, medical record websites, utility websites, insurance websites, government websites, Internal Revenue Service (IRS) tax returns, confidential communications, and the like. The ZTENS device 110 may include a virtual private network (VPN) alternative. The memory 126 may include proxy data 158 that may be used to hide the actual IP address of the computing device 104 or the ZTENS device 110.

[0024] The DNS data 134 can associate a URL with an IP address for each website in the permissible URL 132. The DNS data 134 can be a substitute for normal DNS server access, thus eliminating any vulnerabilities associated with such normal DNS server access.

[0025] The encryption keys 136 include one or more symmetric or asymmetric encryption keys that can be used by encryption 144 hardware and / or software to encrypt or decrypt data in a communication.

[0026] The communications circuitry 124 implements one or more different communications protocols 128, 130. The communications protocols may include those described with respect to the communications circuitry 120. The communications circuitry 124 can be configured to communicate with the computing device 104 using a first communications protocol 128 and with the network 106 using a second communications protocol 130. The applications 154 can enable the user 102 to interact with the ZTENS device 110 via a web application 118 over Bluetooth, USB, or other communications protocols.

[0027] The communications circuitry 124, in some embodiments, can parse a communication to a single endpoint (e.g., web server 108) into two or more disjoint packets. The communications circuitry 124 can then transmit the disjoint packets of the plurality of packets using two or more respective communications protocols. The communications circuitry 124 may thus, for example, transmit a first portion of the communication using a Wireless Fidelity (WiFi), Ethernet, or cellular data communications channel (e.g., LTE, 5G, etc.) and transmit a second, different portion of the communication using a different one of the Wireless Fidelity, Ethernet, or cellular data communications channel. More portions and more communications protocols can be used.

[0028] The ZTENS device 110 can be issued by a host of a website accessible via the web server 108. The host can limit access to the website to only those users who can pass the security criteria of the ZTENS device 110. This allows the website host to control the security required to access the website. Typically, the user 102 accesses the website solely through the security of the web application 118 or OS 114. By requiring the protocols of the ZTENS device 110 to access the website, the security of the website is placed in the hands of the website host.

[0029] The ZTENS device 110 can provide further security by implementing one or more of ephemeral IPv6 (and the like), net manipulation, port knocking, channel hopping, etc. The ZTENS device 110 can include further hardening using physical security measures (e.g., tamper evident, tamper resistant, etc.) The ZTENS device 110 can provide a substitute for a Common Access Card (CAC) such as a Public Key Infrastructure (PKI) card, a Yubikey card, etc.

[0030] During use, a user 102 can connect the ZTENS device 110 to a computing device 104. The user can enter a PIN 142, biometric data via biometric authentication 146 hardware and / or software, a username, a password, a verification code using multi-factor authentication 140, or a combination thereof, to authenticate themselves and gain access to the ZTENS device 110. Authentication is the process of verifying the identity of the user 102. Once authentication is passed, the user 102 is allowed to access further functionality of the ZTENS device 110 through the web application 118. The user 102 can issue communications to the ZTENS device 110 through the web application 118. The communications can initiate functionality (e.g., hardware, software, or a combination thereof) of the ZTENS device 110. The ZTENS device 110 can inspect content from the computing device 104, such as to detect malicious behavior or data exfiltration. The ZTENS device 110 can transact with the network 106 using the communication circuitry 124, such as after performing a translation of a URL to an IP address (using DNS data 134). Communications with the network 106 or computing device 104 can be secured using TSL / SSL protocol 150, a certificate authority 148, or the like. The ZTENS device 110 can receive content from the network 106 and detect malicious behavior or data exfiltration (e.g., using a recurrent neural network (RNN), or the like). The ZTENS device 110 can provide content that passes inspection (e.g., by the RNN) to the web application 118 via the communication circuitry 124. The user 102 then accesses the website content via the ZTENS device 110.

[0031] FIG. 2 shows, by way of example, a diagram of one embodiment of a method 200 of ZTENS. The illustrated method 200 includes, at operation 202, providing (by the ZTENS device communicatively coupled to the computing device via a first communication channel, wired or wireless, and through a web application of the computing device) first data indicating that the ZTENS device is communicatively coupled to the computing device; at operation 204, providing (by the ZTENS device and through the first communication channel through the web application of the computing device) one or more uniform resource locators (URLs); at operation 206, receiving (by the ZTENS device and through the first communication channel) data indicating one of the one or more URLs selected by a user of the computing device through the web application; at operation 208, communicating (by the ZTENS device and through a second communication channel, wired or wireless, different from the first communication channel) a request for website data of a website associated with the selected URL; and receiving (by the ZTENS device and through the second communication channel) the website data and providing the website data to the computing device.

[0032] Method 200 may further include authenticating, by the ZTENS device, the identity of the user prior to communicating the request for the website data. Method 200 may further include authenticating the identity of the user includes receiving, by the ZTENS device, a personal identification number (PIN) or biometric scan data from the user via a user interface of the ZTENS device. Method 200 may further include authenticating the identity of the user includes using multi-factor authentication through a web application.

[0033] The method 200 may further include analyzing data from the computing device for malicious behavior or data exfiltration prior to communicating the request for the website data. The method 200 may further include translating the URL to an Internet Protocol (IP) address by the ZTENS device using Domain Name Service (DNS) data in a memory of the ZTENS device. The method 200 may further include parsing the request for the website data into a plurality of packets, the plurality of packets including different portions of the request for the website data, and communicating the request for the website data includes communicating different packets of the plurality of packets over different communication channels, including a second communication channel and a third communication channel.

[0034] The method 200 may further include the second and third communication channels including different channels of a cellular data communication channel, a wireless fidelity communication channel, and an Ethernet communication channel. The method 200 may further include the first communication channel including one of a Universal Serial Bus (USB) and Bluetooth operating using a webUSB or webBluetooth communication protocol. The method 200 may further include performing, by the ZTENS device, a malicious behavior and data exfiltration analysis on the website data prior to providing the website data to the computing device.

[0035] FIG. 3 illustrates, by way of example, a block diagram of one embodiment of a machine in the exemplary form of a computer system 300 upon which instructions may be executed to cause the machine to perform any one or more of the methodologies described herein. In a networked arrangement, the machine may operate in the capacity of a server or a client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. The machine may be a personal computer (PC), a tablet PC, a set-top box (STB), a personal digital assistant (PDA), a mobile phone, a web appliance, a network router, a network switch, or a network bridge, or any machine capable of executing instructions (sequentially or otherwise) that specify actions to be taken by the machine. Furthermore, although only a single machine is shown, the term "machine" shall also be construed to include any collection of machines that individually or jointly execute a set (or sets) of instructions to perform any one or more of the methodologies described herein.

[0036] The exemplary computer system 300 includes a processor 302 (e.g., a central processing unit (CPU), a graphics processing unit (GPU), or both), a main memory 304, and a static memory 306, which communicate with each other via a bus 308. The computer system 300 may further include a video display unit 310 (e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)). The computer system 300 also includes an alphanumeric input device 312 (e.g., a keyboard), a user interface (UI) navigation device 314 (e.g., a mouse), a mass storage device 316, a signal generator 318 (e.g., a speaker), a network interface device 320, and a radio 330, such as Bluetooth, WWAN, WLAN, and NFC, to enable application of security controls to such protocols.

[0037] Mass storage device 316 includes a machine-readable medium 322 on which is stored one or more sets of instructions and data structures (e.g., software) 324 that embody or are utilized by any one or more of the methods or functions described herein. The instructions 324 may also reside, completely or at least partially, within main memory 304 and / or within processor 302 during execution thereof by computer system 300, with main memory 304 and processor 302 also constituting machine-readable media.

[0038] While the exemplary embodiment illustrates that the machine-readable medium 322 is a single medium, the term "machine-readable medium" may include a single medium or multiple media (e.g., a centralized or distributed database and / or associated caches and servers) that store one or more instructions or data structures. The term "machine-readable medium" should also be construed to include any tangible medium that can store, encode, or carry instructions for execution by a machine and that can cause a machine to perform any one or more of the methods of the present invention or that can store, encode, or carry data structures utilized by or related to such instructions. The term "machine-readable medium" should accordingly be construed to include, but is not limited to, solid-state memory, and optical and magnetic media. Specific examples of machine-readable media include, by way of example, non-volatile memory, including semiconductor memory devices such as erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), and flash memory devices, magnetic disks such as internal hard disks and removable disks, magneto-optical disks, and CD-ROM and DVD-ROM disks.

[0039] The instructions 324 may further be transmitted or received over a communications network 326 using a transmission medium. The instructions 324 may be transmitted using a network interface device 320 and any one of several well-known transfer protocols (e.g., HTTP). Examples of communications networks include a local area network ("LAN"), a wide area network ("WAN"), the Internet, a cellular network, a plain old telephone service (POTS) network, and wireless data networks (e.g., WiFi networks and WiMax networks). The term "transmission medium" shall be interpreted as including any intangible medium capable of storing, encoding, or carrying instructions for execution by a machine, including digital or analog communications signals or other intangible media for facilitating communication of such software.

[0040] Additional Notes and Examples Example 1 may include a computer-implemented method for Zero Trust Endpoint Network Security (ZTENS), the method including: providing, by a ZTENS device communicatively coupled to a computing device, first data indicating that the ZTENS device is communicatively coupled to the computing device via a first communication channel, either wired or wireless, and through a web application of the computing device; providing, by the ZTENS device and through the first communication channel through a web application of the computing device, one or more uniform resource locators (URLs); receiving, by the ZTENS device and through the first communication channel, data indicating one of the one or more URLs selected by a user of the computing device through the web application; communicating, by the ZTENS device and through a second communication channel, either wired or wireless, the second communication channel being different from the first communication channel, a request for website data for a website associated with the selected URL; receiving, by the ZTENS device and through the second communication channel, the website data and providing the website data to the computing device.

[0041] In Example 2, Example 1 can further include authenticating, by the ZTENS device, an identity of the user prior to communicating a request for the website data.

[0042] In Example 3, Example 2 can further include, where authenticating the identity of the user includes receiving, by the ZTENS device, a personal identification number (PIN) or biometric scan data from the user via the user interface of the ZTENS device.

[0043] In Example 4, at least one of Examples 2-3 can further include where authenticating the identity of the user includes using multi-factor authentication via the web browser.

[0044] In Example 5, at least one of Examples 2-4 can further include analyzing the data from the computing device for malicious behavior or data exfiltration prior to communicating the request for the website data.

[0045] In Example 6, at least one of Examples 2-5 may further include, by the ZTENS device, converting the URL into an Internet Protocol (IP) address using Domain Name Service (DNS) data in a memory of the ZTENS device.

[0046] In Example 7, at least one of Examples 2-6 may further include parsing the request for website data into a plurality of packets, the plurality of packets including different portions of the request for website data, and communicating the request for website data includes communicating different packets of the plurality of packets over different communication channels, including the second communication channel and a third communication channel.

[0047] In Example 8, example 7 can further include, wherein the second and third communication channels include different channels of a cellular data communication channel, a wireless fidelity communication channel, and an Ethernet communication channel.

[0048] In Example 9, Example 8 can further include, wherein the first communication channel includes one of a Universal Serial Bus (USB) and Bluetooth operating using a webUSB or webBluetooth communication protocol.

[0049] In Example 10, at least one of Examples 2-9 may further include performing, by the ZTENS device, an analysis of malicious behavior and data exfiltration on the website data before providing the website data to the computing device.

[0050] Example 11 includes a non-transitory machine-readable medium comprising instructions that, when executed by a machine, cause the machine to perform operations to implement at least one of the methods of claims 1-10.

[0051] Example 12 includes a system or device configured to carry out at least one of the methods of claims 1-10.

[0052] Although the embodiments have been described with reference to certain exemplary embodiments, it will be apparent that various modifications and changes may be made thereto without departing from the broader spirit and scope of the present invention. Accordingly, the specification and drawings should be regarded in an illustrative and not a limiting sense. The accompanying drawings, which form a part of this specification, show by way of illustration, and not by way of limitation, specific embodiments in which the present subject matter may be practiced. The illustrated embodiments are described in sufficient detail to enable those skilled in the art to practice the teachings disclosed herein. Since other embodiments may be utilized and derived therefrom, structural and logical substitutions and changes may be made without departing from the scope of the present disclosure. Accordingly, the detailed description is not to be construed in a limiting sense, and the scope of the various embodiments is defined solely by the appended claims, along with the full scope of equivalents to which such claims are entitled.

Claims

1. 1. A computer-implemented method for Zero Trust Endpoint Network Security (ZTENS), comprising: providing, by a ZTENS device communicatively coupled to a computing device, first data indicating that the ZTENS device is communicatively coupled to the computing device via a first communication channel, either wired or wireless, and through a web application on the computing device; providing a list of one or more Uniform Resource Locators (URLs) accessible only through the ZTENS device, without the intervention of a web server, for presentation to a user by an application on the ZTENS device and via the first communication channel through a web application on the computing device directly using the web application; receiving, by the ZTENS device and via the first communication channel, data indicating a URL of the one or more URLs selected by a user of the computing device through the web application; communicating, by the ZTENS device and via a second communication channel, wired or wireless, different from the first communication channel, a request for website data of a website associated with the selected URL, where the ZTENS device stores verification data for the selected URL; receiving, by the ZTENS device and via the second communication channel, the website data and providing the website data to the computing device; The computer-implemented method comprising:

2. authenticating, by the ZTENS device, the identity of the user prior to communicating a request for the website data. The method of claim 1 further comprising:

3. 3. The method of claim 2, wherein authenticating the identity of the user includes receiving, by the ZTENS device, a personal identification number (PIN) or biometric scan data from the user via a user interface of the ZTENS device.

4. The method of claim 2 , wherein authenticating the identity of the user includes using multi-factor authentication through the web application.

5. The method of claim 2 , further comprising analyzing the data from the computing device for malicious behavior or data exfiltration prior to communicating the request for the website data.

6. 3. The method of claim 2, further comprising: translating, by the ZTENS device, the URL into an Internet Protocol (IP) address using Domain Name Service (DNS) data in a memory of the ZTENS device.

7. A computer-implemented method for Zero Trust Endpoint Network Security (ZTENS), comprising: providing, by a ZTENS device communicatively coupled to a computing device, first data indicating that the ZTENS device is communicatively coupled to the computing device via a first communication channel, either wired or wireless, and through a web application on the computing device; providing one or more uniform resource locators (URLs) by the ZTENS device and via the first communication channel through a web application of the computing device; receiving, by the ZTENS device and via the first communication channel, data indicating a URL of the one or more URLs selected by a user of the computing device through the web application; communicating, by the ZTENS device and via a second communication channel, either wired or wireless, different from the first communication channel, a request for website data of a website associated with the selected URL; receiving, by the ZTENS device and via the second communication channel, the website data and providing the website data to the computing device; Including, authenticating, by the ZTENS device, the identity of the user prior to communicating a request for the website data. Further comprising: The method further includes parsing the request for website data into a plurality of packets, the plurality of packets including different portions of the request for the website data, and communicating the request for the website data includes communicating different packets of the plurality of packets over different communication channels, including the second communication channel and a third communication channel.

8. 8. The method of claim 7, wherein the second communication channel and the third communication channel comprise different channels of a cellular data communication channel, a wireless fidelity communication channel, and an Ethernet communication channel.

9. 9. The method of claim 8, wherein the first communication channel comprises one of Universal Serial Bus (USB) and Bluetooth operating using a webUSB or webBluetooth communication protocol.

10. 3. The method of claim 2, further comprising performing, by the ZTENS device, a malicious behavior and data exfiltration analysis on the website data prior to providing the website data to the computing device.

11. 1. A non-transitory machine-readable medium comprising instructions that, when executed by a Zero Trust Endpoint Network Security device (ZTENS device), cause the ZTENS device to perform operations for ZTENS, the operations comprising: providing, by the ZTENS device communicatively coupled to a computing device, first data indicative of the ZTENS device being communicatively coupled to the computing device via a first communication channel, either wired or wireless; providing, by a first application on the ZTENS device, via the first communication channel, to the web application on the computing device, without intervention of a web server, a list of one or more Uniform Resource Locators (URLs) of a limited number accessible only through the ZTENS device, using a web application directly for presentation to a user; receiving, via the first communication channel, data indicating a URL of the one or more URLs selected by a user of the computing device through the web application; communicating, via a second communication channel, either wired or wireless, different from the first communication channel, a request for website data of a website associated with the selected URL, for which the ZTENS device stores verification data for the selected URL; receiving the website data via the second communication channel and providing the website data to the computing device; The non-transitory machine-readable medium comprising:

12. The operation is Authenticating the identity of the user prior to communicating a request for the website data.

12. The non-transitory machine-readable medium of claim 11, further comprising:

13. 13. The non-transitory machine-readable medium of claim 12, wherein authenticating the identity of the user includes receiving, by the ZTENS device, a personal identification number (PIN) or biometric scan data from the user via a user interface of the ZTENS device.

14. 13. The non-transitory machine-readable medium of claim 12, wherein authenticating the identity of the user includes using multi-factor authentication through the web application.

15. 13. The non-transitory machine-readable medium of claim 12, wherein the operations further comprise analyzing the data from the computing device for malicious behavior or data exfiltration prior to communicating a request for the website data.

16. 1. A system for Zero Trust Endpoint Network Security (ZTENS), comprising: a computing device including a user interface, a communication circuit, and a web application; A ZTENS device communicatively coupled to the computing device via a wired or wireless first and second communication channels of the communication circuitry and through the web application, the ZTENS device including a security circuitry and the communication circuitry; providing first data indicative of the ZTENS device being communicatively coupled to the computing device; providing, by an application on the ZTENS device, via the first communication channel through a web application, a list of one or more Uniform Resource Locators (URLs) accessible only through the ZTENS device, without the intervention of a web server, using the web application directly for presentation to a user; receiving, via the first communication channel, data indicating a URL of the one or more URLs selected by a user of the computing device through the web application; communicating to a web server via the second communication channel a request for website data for a website associated with the selected URL, where the ZTENS device stores verification data for the selected URL; receiving the website data via the second communication channel and providing the website data to the computing device; The ZTENS device is configured to The system comprising:

17. 17. The system of claim 16, wherein the ZTENS device is further configured to convert the URL to an Internet Protocol (IP) address using Domain Name Service (DNS) data in a memory of the ZTENS device.

18. A system for Zero Trust Endpoint Network Security (ZTENS), comprising: a computing device including a web application; A ZTENS device communicatively coupled to the computing device via a wired or wireless first communication channel and a second communication channel and through the web application, providing first data indicative of the ZTENS device being communicatively coupled to the computing device; providing one or more uniform resource locators (URLs) over the first communication channel through a web application; receiving, via the first communication channel, data indicating a URL of the one or more URLs selected by a user of the computing device through the web application; communicating, via the second communication channel, a request for website data for a website associated with the selected URL; receiving the website data via the second communication channel and providing the website data to the computing device; The ZTENS device is configured to Equipped with The system, wherein the ZTENS device is further configured to parse the request for website data into a plurality of packets, the plurality of packets including different portions of the request for website data, and communicating the request for website data includes communicating different packets of the plurality of packets via different communication channels, including the second communication channel and a third communication channel.

19. 20. The system of claim 18, wherein the second communication channel and the third communication channel comprise different channels of a cellular data communication channel, a wireless fidelity communication channel, and an Ethernet communication channel.

20. 20. The system of claim 19, wherein the first communication channel comprises one of Universal Serial Bus (USB) and Bluetooth operating using a webUSB or webBluetooth communication protocol, respectively.

Images