Centralized Identity Redistribution for Security Policy Enforcement

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing security architectures face challenges in efficiently redistributing user context information across distributed networks, requiring complex configurations and lacking scalability, central visibility, and leading to inconsistent security policy enforcement.

Innovation Solution

A system for centralized identity redistribution that receives and applies user context information from a cloud security service, using a publish-subscribe model to unify and simplify user context distribution across security platforms, including physical, virtual, and container-based firewalls, without requiring changes to existing deployments.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If user context information is distributed across multiple security platforms, then local security enforcement is enabled, but system complexity and configuration difficulty increase

Engineering Contradiction:

Improvesecurity policy enforcementVSAvoidconfiguration complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a cloud-based security service as an intermediary that centralizes user context information distribution. Security platforms subscribe to relevant context via publish-subscribe model without direct peer-to-peer communication, simplifying configuration while maintaining distributed enforcement capability

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system segments user context information into different types (IP-user mapping, User-tag mapping, IP-tag mapping, etc.) and distributes only relevant segments to subscribing security platforms, reducing configuration complexity and improving efficiency

Inventive Principle:

Principle #1Segmentation

2Reliability

If security platforms process and store all user context information locally, then complete security policy enforcement is achieved, but CPU and memory usage increase

Engineering Contradiction:

Improvesecurity policy enforcementVSAvoidCPU and memory usage

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

Security platforms perform partial processing by receiving only the specific user context information they need via publish-subscribe model, rather than processing and storing all context information locally, thereby reducing CPU and memory usage while maintaining effective security enforcement

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

Each security platform independently subscribes to and receives only the user context information relevant to its specific security policies, eliminating the need to process unnecessary data and reducing resource consumption

Inventive Principle:

Principle #25Self-service

3Stability of the object's composition

If user context information is redistributed through centralized cloud service, then consistency across platforms is improved, but network dependency increases

Engineering Contradiction:

Improveuser context consistencyVSAvoidnetwork independence

Core Design Contradiction:

Stability of the object's compositionVSAdaptability or versatility

Solution Approach 1:

The system implements feedback mechanisms where security platforms send subscriptions and receive updates from the cloud service, ensuring consistent user context information distribution while maintaining the ability to function with standardized protocols

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS20250112893A1Centralized identity redistribution

Publication Date: 2025.04.03 PALO ALTO NETWORKS INC

AI summary

Techniques for providing centralized identity redistribution for a security service are disclosed. In some embodiments, a system/process/computer program product for providing centralized identity redistribution for a security service includes receiving user context information (e.g., an IP-user mapping, a user-tag mapping, an IP-tag mapping, an IP-port-user mapping, an IP-device ID mapping, 5G user context information, and/or other user context information/data) at a security platform from a cloud security service; and applying a security policy at the security platform using the user context information.