Jump Server Access Control for Secure Network Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for accessing services across different local networks, such as VPN connections, often lack secure access restrictions and expose firewalls to the internet, allowing unrestricted access to entire networks.
Innovation Solution
A method involving a DMZ network connecting two secured networks via firewalls, using smart card authentication, a jump server with unique IP address assignment, and centralized rule management in LDAP for controlled access, along with single sign-on and encrypted connections, ensures secure and restricted access to specific services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a VPN connection is used to access services across networks, then access to remote services is enabled, but the firewall becomes directly accessible on the Internet and the entire network can be accessed without restrictions
Solution Approach 1:
The patent introduces a DMZ network as an intermediary layer between the internal network and external networks. This DMZ contains application servers that act as mediators, allowing users to access services without directly exposing the internal network or firewall to the Internet. The DMZ serves as a buffer zone that enables service access while maintaining network security boundaries.
Solution Approach 2:
The network architecture is segmented into distinct zones: the internal network, the DMZ network, and external networks. This segmentation isolates the internal network from direct external access while allowing controlled service communication through the DMZ. The firewall is positioned to protect only the DMZ, not the entire internal network, thereby limiting the attack surface.
2Ease of operation
If the firewall is made directly accessible on the Internet for VPN connections, then remote access is enabled, but the firewall's security is compromised and the entire network becomes vulnerable
Solution Approach 1:
The DMZ network acts as an intermediary that receives and processes VPN connection requests. Instead of the firewall being directly accessible, the DMZ contains the necessary services and servers that handle remote access requests. This intermediary layer protects the firewall from direct Internet exposure while maintaining remote access functionality through controlled service interfaces in the DMZ.
3Adaptability or versatility
If unrestricted VPN access is provided to the entire network, then users can access any resource, but security restrictions and access control are lost
Solution Approach 1:
The patent implements local quality control by applying different access permissions to different services and resources within the DMZ. Each application server and service in the DMZ can have its own access control policies, allowing users to access only specific services they are authorized for. This enables selective accessibility where different parts of the network have different security requirements and access rules.
Solution Approach 2:
Access control parameters are changed and applied dynamically based on user authentication and authorization. The system modifies access permissions, IP addresses, and service availability parameters according to the user's identity and required services. This allows the network to provide versatile access to authorized users while maintaining security restrictions through parameter-based control mechanisms.
Data Source
Figure 1
Figure 2
AI summary
Method for the secure access of a user U1 using a computer C1 in a first local network (A) to digital services (SNb) in a second local network (B), wherein both networks are protected by firewalls (Fa, Fb), and wherein both networks are connected by a network (Nab) disposed between the firewalls, comprising the following steps: authenticating the user (U1) at the firewall Fa; on the basis of the authentication, establishing a rule that the user can access a specific jump server (SNab) within the network (Nab); accessing the server (Nab) and authenticating at the server, and assigning a unique IP address depending on the authentication; accessing the service (SNb) in the second network (B) by way of the jump server (Nab), wherein an authentication is carried out at the second firewall (Fb) by way of the IP address; determining a rule at the second firewall (Fb) based on the IP address in order to verify whether access to the service is permitted, and if said access is permitted, forwarding the inquiry from the jump server (SNab) into the second network (B) to the service.