Identity-Aware Secure Network With SDP-Mediated Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Zero-Trust security mechanisms in remote working environments reduce but do not eliminate the attack surface, leaving enterprises vulnerable to third-party attacks.
Innovation Solution
An identity-verification based secure network system utilizing an SDP controller, IH, and AH, which continuously verifies the security posture of source identities through an Endpoint Detection and Response software, and dynamically establishes secure tunnels for data communication, ensuring only authorized identities can access enterprise resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If conventional Zero-Trust security mechanism is implemented, then the attack surface is reduced, but the enterprise remains vulnerable to third-party attacks
Solution Approach 1:
The system performs preliminary identity verification and security posture assessment before allowing network access. The SDP controller evaluates security attributes and policies in advance, establishing trusted relationships before data transmission occurs, thereby eliminating vulnerable access points
Solution Approach 2:
The SDP controller acts as an intermediary between initiating hosts and accepting hosts, mediating all authentication and authorization processes. This intermediary verifies security postures and enforces policies, creating a trusted bridge that eliminates direct exposure to third-party attacks
2Reliability
If identity verification of all devices and humans is implemented, then network security is improved, but system complexity increases
Solution Approach 1:
The SDP controller provides universal identity verification services for all devices and users in the network through a single centralized system. This multi-functional controller handles authentication, authorization, and security posture assessment for diverse entities, simplifying the overall system architecture while maintaining comprehensive security
Solution Approach 2:
The system implements continuous feedback loops where the SDP controller periodically re-evaluates security postures and automatically updates policies. This feedback mechanism ensures ongoing verification without requiring complex manual intervention, maintaining security while automating the verification process
Data Source
AI summary
An identity-verification based secure network based on a zero-trust mechanism, is disclosed. The network includes an initiating host (IH), an accepting host (AH), and a software-defined perimeter (SDP) controller. The controller is configured to receive, from the IH, an indication of a source identity, verify a security posture of the source identity based on a stored policy associated with the source identity, and transmit the policy, to the AH, based on the verification. The AH is configured to receive, from the IH, data packets and verify one or more source identities corresponding to each of the received data packets based on a check of each of the one or more source identities against the policy received from the controller. The AH is further configured to transmit one or more of the received data packets, corresponding to the source identity, based on the verification being successful for the source identity.