Context-Based Firewall Enforcement for Agentless Multi-User Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional identity-based firewall systems face challenges in enforcing user-based policies when multiple users log into the same computing device, as they rely on network addresses to identify users, leading to difficulties in distinguishing between users and applying appropriate access controls.
Innovation Solution
The system employs edge service gateway virtual machines (ESG VMs) with an event log monitor and context engine to detect user login events, store login information as context attributes, and use these attributes to enforce firewall rules on data messages, eliminating the need for a guest agent on the user's device and enabling scalable and efficient policy enforcement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional identity-based firewall systems use network address to identify users, then firewall policies can be enforced for single-user systems, but multiple users logged into the same device cannot be distinguished
Solution Approach 1:
The patent introduces a directory service as an intermediary between the firewall system and user authentication. The directory service maintains mappings between user identities and device identifiers, allowing the firewall to resolve which user is currently using a device without relying on the device's network address alone. This mediator enables accurate user identification in multi-user environments.
Solution Approach 2:
The patent adds a new dimension to user identification by incorporating user identity context from directory services alongside traditional network address identification. Instead of relying solely on the network layer (IP address), the system queries the directory service for user context information, effectively adding an application-layer dimension to the identification process that disambiguates multiple users sharing the same device.
2Measurement precision
If a guest agent is installed on user devices to capture login events, then user identification accuracy improves, but device complexity and deployment difficulty increase
Solution Approach 1:
The system implements self-service by having the directory service automatically generate and publish user context information (such as login events and user identifiers) without requiring any software agents on client devices. The firewall system queries the directory service directly to obtain this information, allowing the network infrastructure to serve itself rather than requiring endpoint modifications.
Solution Approach 2:
The patent extracts the login event capture functionality from the client device and relocates it to the directory service. Instead of installing agents on user devices to monitor and report login events, the system uses the directory service's existing authentication mechanisms to generate and publish user context information centrally, eliminating the need for device-level agents.
3Reliability
If firewall rules are published to multiple ESG VMs for redundancy, then system reliability improves, but publishing time and processing overhead increase
Solution Approach 1:
The system performs preliminary action by having the primary ESG VM publish firewall rules to the directory service in advance, where they are stored and cached. When secondary ESG VMs need the rules, they retrieve them from the directory service rather than requiring real-time synchronization. This preliminary publication reduces the time required for rule distribution across multiple VMs.
Solution Approach 2:
The directory service acts as an intermediary that stores and distributes firewall rule information to multiple ESG VMs. Instead of requiring direct peer-to-peer synchronization between VMs, the directory service mediates the rule distribution process, allowing VMs to independently retrieve rules as needed and reducing the overall publishing time while maintaining reliability.
Data Source
AI summary
A system and method for performing firewall operations on an edge service gateway virtual machine that monitors traffic for a network. The method includes detecting, from a directory service executing on a computing device, a login event on the computing device, obtaining, from the detected login event, login event information comprising an identifier that identifies a user associated with the login event, storing the login event information as one or more context attributes in an attribute table, and applying a firewall rule to a data message that corresponds to the one or more context attributes.