Discovery Token Gating for Zero Trust Resource Discovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Zero Trust (ZT) access models fail to adequately protect resources from unauthorized discovery by not-yet-trusted devices, allowing potential security breaches and unauthorized lateral movement.
Innovation Solution
Implement a Discovery Token Service (DTS) that requires endpoint devices to establish a minimum level of trust through multi-factor authentication before allowing discovery of protected resources, using tokens generated by a gateway and associated cloud services to verify device identity and posture.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If Zero Trust access model is implemented without discovery limitation, then resource accessibility is improved, but network security deteriorates due to unauthorized discovery by untrusted devices
Solution Approach 1:
The patent introduces a gateway as an intermediary component between endpoint devices and protected resources. This gateway enforces multi-factor authentication and controls the discovery process, allowing only authenticated devices to discover resource locations. The gateway acts as a mediator that maintains resource accessibility for trusted devices while blocking unauthorized discovery attempts from untrusted devices, thus resolving the contradiction between ease of access and security protection.
2Object-affected harmful factors
If multi-factor authentication is required for resource discovery, then network security is improved, but device complexity increases due to additional authentication procedures
Solution Approach 1:
The patent implements preliminary authentication actions by requiring multi-factor authentication before allowing resource discovery. The gateway performs this authentication check in advance, verifying device identity and posture before granting discovery permissions. This preliminary security measure ensures that only authenticated devices can proceed with resource discovery, thereby improving network security while managing device complexity through automated enforcement at the gateway level.
3Object-affected harmful factors
If resource locations are hidden from untrusted devices, then network security is improved, but information availability deteriorates for legitimate users
Solution Approach 1:
The patent applies local quality by providing different information visibility to different devices based on their authentication status. Authenticated devices receive resource location information through the gateway, while unauthenticated devices receive no such information. This localized information distribution ensures that resource location data is available to legitimate users who have passed authentication, while simultaneously preventing reconnaissance by untrusted devices, thus resolving the contradiction between information availability and security.
Data Source
AI summary
According to an embodiment, a system comprises one or more processors and one or more computer-readable non-transitory storage media comprising instructions that, when executed by the one or more processors, cause one or more components of the system to perform operations. The operations comprise determining that an endpoint device has requested to discover a location of a protected resource that is protected by a gateway, determining whether the endpoint device has provided a token that is valid, and permitting the endpoint device to discover the location of the protected resource based on determining that the endpoint device has provided the token that is valid. The token indicates that the endpoint device successfully completed a first multi-factor authentication procedure in connection with accessing an authentication enforcement resource.