Cryptographic Identity Enforcement for Segmentation Policy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing segmentation policies that rely on IP addresses for machine identification are vulnerable to spoofing and administrative burdens due to changing IP addresses, leading to security risks and policy failures.
Innovation Solution
A method where operating system instances authenticate each other using cryptographic proofs of identity, determining if communication is permitted based on predefined management instructions, and generating session parameters for secure communication sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If IP addresses are used as machine identifiers in segmentation policies, then the policy can be implemented with simple address-based rules, but the system becomes vulnerable to spoofing and requires frequent updates when IP addresses change
Solution Approach 1:
The patent replaces the mechanical IP address identification system with a cryptographic identification system. Instead of relying on network layer addressing (IP addresses), the system uses application-layer cryptographic proofs of identity. Each machine possesses cryptographic credentials that enable it to prove its identity to other machines, making the segmentation policy enforcement independent of IP address assignment and immune to IP spoofing attacks.
2Ease of operation
If IP addresses are used to identify machines in segmentation policies, then the policy configuration is straightforward, but administrative burden increases when IP addresses change due to mobile devices reconnecting
Solution Approach 1:
The cryptographic identification system enables machines to self-identify using their cryptographic credentials without requiring administrative intervention. When a machine connects to the network, it automatically presents its cryptographic proof of identity, and the segmentation policy is automatically enforced based on this identity. This eliminates the need for administrators to manually update policies when IP addresses change, as the identity-based system naturally handles dynamic IP assignments.
3Reliability
If cryptographic proof of identity is used for machine identification, then security is enhanced by preventing spoofing, but the system complexity increases compared to IP address-based identification
Solution Approach 1:
The patent introduces a cryptographic credential system as an intermediary between the machine and the segmentation policy enforcement mechanism. Rather than directly using IP addresses or complex cryptographic protocols, the system uses standardized cryptographic proofs (such as digital certificates or signed tokens) that act as intermediaries. These proofs can be verified using well-established cryptographic libraries, reducing the complexity burden on the segmentation system itself while maintaining high security.
4Reliability
If cryptographic authentication is implemented for segmentation policy enforcement, then communication security is improved, but the communication overhead increases due to authentication exchanges
Solution Approach 1:
The patent performs cryptographic authentication in advance, during the connection establishment phase, before any data transmission occurs. The authentication exchange (presenting cryptographic proofs and verifying identities) is completed as a preliminary step, and once authenticated, the session can proceed with the segmentation policy already enforced. This preliminary authentication approach ensures security while minimizing ongoing overhead, as the identity verification is performed once per session rather than continuously during data transfer.
Data Source
AI summary
A segmentation server defines a segmentation policy and distributes the segmentation policy to be enforced by a plurality of operating system (OS) instances. The segmentation policy includes rules controlling which workloads executing on the OS instances can communicate with other workloads and controlling how the workloads may communicate. When a connection between two OS instances is requested, each OS instance provides an identity and a cryptographic proof of the identity. The OS instances each authenticate the identity received from the other OS instance, and once authenticated, determines based on the authenticated identities if the rules permit the communication. If the rules permit the communication, the OS instances obtain session parameters that enable the OS instances to validate integrity of the messages communicated between the workloads and optionally encrypt the messages.