Client-Specific Access Control Rules for Zero Trust Network Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Zero Trust Network Access (ZTNA) implementations face challenges in real-time detection and mitigation of security threats within the network, as they often treat all blocked requests as potential security risks, which can lead to benign requests being incorrectly blocked, and there is a need for improved access control mechanisms to differentiate between legitimate and malicious activities.
Innovation Solution
A system that employs two sets of access control rules (ACR) managed by a controller, where one set (ACR_AN) is applied to traffic from multiple clients and another (ACR_CN) is specific to each client, allowing for differentiated handling of requests based on client-specific permissions and security contexts, with the ability to block or allow requests dynamically based on rule sets and token validation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all blocked requests are treated as potential security risks, then security detection capability is improved, but legitimate requests are incorrectly blocked
Solution Approach 1:
The patent applies different quality standards to different requests by implementing client-specific access control rules (ACR_CN) alongside general rules (ACR_AN). Each client receives customized rule sets that reflect their specific permissions and security contexts, allowing the system to differentiate between legitimate and malicious requests rather than treating all blocked requests uniformly.
Solution Approach 2:
The access control system is segmented into two distinct rule sets: general access control rules (ACR_AN) applicable to all clients, and client-specific access control rules (ACR_CN) tailored to individual clients. This segmentation enables precise control where legitimate requests can be allowed based on client-specific permissions while still detecting security threats through the general rules.
2Ease of operation
If perimeter firewall allows full access from inside network, then ease of operation is improved, but security vulnerability increases
Solution Approach 1:
The patent introduces an intermediary trust broker that mediates all access requests between clients and protected resources. Even requests originating from inside the network must pass through this intermediary, which evaluates both general and client-specific access control rules. This eliminates excessive trust for inside access while maintaining ease of operation through automated rule-based decisions.
3Reliability
If Zero Trust Network Access is implemented with trust brokers, then security against lateral movement is improved, but system complexity increases
Solution Approach 1:
The trust broker is designed as a universal intermediary that handles all access requests regardless of origin (internal or external). It implements a unified rule evaluation mechanism that processes both general access control rules and client-specific rules through a single system, reducing operational complexity despite the enhanced security architecture.
Data Source
AI summary
A client node (CN) requests content from an access node (AN). Rule set ACR_CN is provided to CN and AN and ACR_AN is used by AN. A request sent by CN in violation of ACR_CN may be blocked and cause AN to block subsequent requests from CN that would be allowed per ACR_CN. A request blocked according to ACR_AN but not ACR_CN is blocked but subsequent requests may still be allowed according to ACR_CN and ACR_AN. Authenticated distribution of the ACR_CN and ACR_AN may be performed in cooperation with a controller using authenticated tokens (AT).