Clientless SASE Gateway Policy Enforcement via Certificate Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional SIM SASE architecture is challenged by its software client dependency, which is not conducive to the decentralized, scalable, and secure approach required for modern enterprise operations, particularly in the context of mobile and IoT device security, due to resource constraints and proprietary operating systems.
Innovation Solution
A clientless security system that uses a traffic steering module to configure SIMs with custom network identifiers, creates device-to-IP mappings, and applies policies through gateways, leveraging UUMSI as a primary key for secure traffic segregation and enforcement, with alert generation for policy violations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional SIM SASE architecture with software client is used, then security services can be delivered at network edge, but device complexity and resource requirements increase due to client installation
Solution Approach 1:
The patent extracts the security enforcement functionality from the device client and relocates it entirely to the network gateway. The gateway now performs certificate validation, policy enforcement, and traffic control without requiring any security software on the cellular device, thereby eliminating device complexity while maintaining security service delivery
Solution Approach 2:
The patent introduces a gateway as an intermediary component between the cellular device and the network. This gateway acts as a mediator that handles all security-related operations including certificate installation, validation, and policy enforcement, allowing security services to be delivered without modifying the device itself
2Ease of operation
If software client is installed on cellular devices, then security policies can be enforced, but adaptability to diverse devices with proprietary operating systems decreases
Solution Approach 1:
The gateway performs automatic certificate installation and validation without requiring device client software or user intervention. The system self-manages security enforcement by leveraging standard cellular network protocols and SIM card capabilities that are universally supported across all cellular devices regardless of their operating system
Solution Approach 2:
The patent implements a universal security approach that works across all cellular devices by using standardized network protocols and SIM card functions. The gateway provides multi-functional security services including authentication, authorization, encryption, and policy enforcement through a single platform that is compatible with diverse devices and proprietary operating systems
3Productivity
If clientless security system is implemented, then scalability and ease of deployment improve, but device identity determination complexity increases
Solution Approach 1:
The patent creates and manages digital certificates that serve as cryptographic copies of device identity. These certificates are installed on devices and validated by the gateway, providing a reliable method for device identification without requiring complex detection mechanisms. The certificate acts as a verifiable copy of the device's identity credentials
Data Source
AI summary
A clientless security system to secure cellular devices across a network in a cloud-based environment. The clientless security system includes a tenant with multiple cellular devices, tunnels for transmitting traffic, and a traffic steering module for directing traffic towards a gateway. The traffic steering module provides a SIM with custom network identifiers, configures them, creates and distributes a device-to-IP mapping to gateways in real-time. The gateways loads tenant information, decrypts secure sockets layer (SSL), and determines an installation of a certificate for a hypertext transfer protocol communication. A uniform resource locator (URL) is classified based on a server name indication when certificate is uninstalled. When the certificate is installed, proxy policies are enforced. The gateway retrieves security policies, detects threats based on the security policies, remediates detected threats and encrypts the SSL.