Per-Session Secure Communication for Pre-VPN Network Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security measures, such as zero trust procedures, fail to provide adequate security when end devices access untrusted networks before launching VPN clients, leading to potential privacy and security weaknesses.
Innovation Solution
Implementing a per-session validation with secure connection and authentication service using an enforcement orchestration device and enforcement device to validate and secure each session based on user privileges, apply security policies, and manage connections, with a client on the end device for automatic secure session establishment and authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If zero trust procedures are implemented at device level, then authentication is improved, but security is compromised when devices access untrusted networks before launching VPN clients
Solution Approach 1:
The patent implements preliminary security validation by establishing secure tunnels and performing authentication before devices access untrusted networks. The enforcement device validates session requests and establishes encrypted connections in advance, preventing security vulnerabilities that would otherwise exist during pre-VPN network access.
Solution Approach 2:
The patent introduces an enforcement device as an intermediary between end devices and untrusted networks. This intermediary validates session requests, establishes secure tunnels, and performs authentication, thereby resolving the contradiction between allowing network access and maintaining security before VPN clients are launched.
2Reliability
If per-session validation with secure connection is implemented, then security is improved, but device complexity increases
Solution Approach 1:
The patent implements self-service mechanisms where the enforcement device automatically validates session requests, establishes secure tunnels, and performs authentication without requiring complex manual configuration on end devices. The client application on end devices simply requests secure sessions, and the enforcement device handles the complex validation and tunnel establishment processes autonomously.
3Reliability
If security measures are deployed at network core, then security coverage is improved, but latency and routing costs increase
Solution Approach 1:
The patent deploys enforcement devices at the network edge closer to end devices rather than centralized at the network core. This local deployment validates session requests and establishes secure tunnels at the point of access, reducing the distance data must traverse and thereby decreasing latency and routing costs while maintaining comprehensive security coverage.
Data Source
AI summary
A method, a network device, and a non-transitory computer-readable storage medium are described in relation to an per-session validation with secure connection and authentication service. The service may include the installation of a client after an end device completes a primary authentication and registration procedure with a core network. The client and an enforcement device may establish a secure and encrypted session via which packet data unit (PDU) session requests may be approved or denied based on network access polices associated with the end device. An enforcement orchestration service may configure enforcement devices and obtain encryption keys from the core network for use by the enforcement device.