Deperimeterized Access Control via Single Packet Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtual Private Networks (VPNs) face challenges in scalability, performance, and network security, particularly when exposing services to the Internet, as they do not provide flexible access control, mask real-time services, and are vulnerable to attacks like DDoS due to open service ports.
Innovation Solution
The implementation of Single Packet Authorization (SPA) for deperimeterized access control, which uses a lightweight SPA agent to authenticate client devices and establish secure tunnels, allowing authorized access while ignoring unauthorized traffic, and employing deception environments to detect and redirect malicious traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If services are directly exposed to the Internet, then access convenience is improved, but security vulnerability increases due to open service ports and exposure to scanning attacks
Solution Approach 1:
The patent introduces a broker as an intermediary component that sits between external networks and internal services. The broker receives authorization requests, validates them against stored authorization data, and selectively forwards legitimate requests while blocking unauthorized access attempts. This mediator architecture enables direct service exposure to the Internet while maintaining security through centralized authorization control.
Solution Approach 2:
The system performs preliminary authorization validation before allowing any service access. Authorization data is pre-configured and stored in the broker, enabling rapid validation of incoming requests without real-time complex authentication. This preliminary action ensures that only pre-authorized access patterns can reach services, preventing security vulnerabilities from exploiting open ports.
2Object-affected harmful factors
If VPN tunneling is used for all traffic, then security is improved, but network performance deteriorates due to tunneling overhead and QoS masking
Solution Approach 1:
The patent implements selective authorization where different services receive different levels of access control. High-priority real-time services like voice and video are configured with permissive authorization rules that allow direct access without VPN tunneling, maintaining their QoS requirements. Other services use stricter authorization patterns. This local quality differentiation enables optimal performance for time-sensitive applications while maintaining security for other traffic.
Solution Approach 2:
The authorization system segments network traffic into different categories based on service type and priority. Real-time services are segmented into a separate authorization class that bypasses VPN tunneling requirements, while other services remain protected through traditional mechanisms. This segmentation allows the system to optimize performance for critical services without compromising overall security posture.
3Speed
If service ports are always open for direct access, then access speed is improved, but susceptibility to DDoS attacks increases due to visible attack surface
Solution Approach 1:
The broker serves as a protective intermediary that absorbs and filters malicious traffic before it reaches services. Even though service ports remain open for legitimate fast access, the broker monitors authorization patterns and blocks DDoS attack traffic based on anomaly detection and pre-configured authorization rules. This mediator architecture maintains access speed for legitimate users while providing DDoS mitigation.
Data Source
AI summary
Techniques for deperimeterized access control are described. A method of deperimeterized access control may include receiving, by a controller of a deperimeterized access control service, a single packet authorization (SPA) request for a session ticket from an agent on a electronic device, wherein the agent sends the request for the session ticket in response to intercepting traffic destined for a service associated with the deperimeterized access control service and determining that the agent does not have a session ticket for the service, authorizing the SPA request, providing a session ticket to the agent based on the request, receiving, by a gateway of the deperimeterized access control service, a request to initiate a session with a service, the request including the session ticket, validating the session ticket, and providing session parameters to the agent to be used to initiate the session between the electronic device and the service.