SASE Domain Access Mapping for Client-Less ISP Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
SASE implementations relying on software clients for remote access can be inefficient and impractical due to the explosion in connected devices, making it difficult to determine trustworthiness of devices without clients.
Innovation Solution
Utilizing ISP authentication processes, such as PPPoE or DOCSIS connections, as a proxy of trust to establish access IDs and IP addresses, which are then mapped to tenant-specific mappings within the SASE domain for secure connectivity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software clients are installed on devices to enable authentication to SASE, then security control is improved, but device complexity and ease of operation deteriorate due to the explosion in connected devices
Solution Approach 1:
The patent extracts the authentication function from the device side (removing the need for software clients) and relocates it to the network side by utilizing ISP authentication mechanisms. The SASE gateway intercepts and leverages existing ISP authentication processes (PPPoE, DOCSIS) to establish trust relationships, eliminating the requirement for devices to have SASE clients installed while maintaining security control.
Solution Approach 2:
The patent makes the ISP authentication system serve multiple functions: it not only provides internet access authentication but also simultaneously establishes trust relationships for SASE domain access. The authentication mechanism is universalized to work across different device types without requiring device-specific client software, enabling both IoT devices and traditional devices to access SASE services through the same authentication pathway.
2Reliability
If software clients are required for SASE authentication, then security is improved, but ease of operation deteriorates due to impracticality with large numbers of connected devices
Solution Approach 1:
The system enables self-service authentication by leveraging the existing ISP authentication infrastructure. Devices automatically benefit from the trust relationship established through ISP authentication without requiring manual client installation or configuration. The SASE gateway automatically intercepts authentication messages and establishes mappings, making the process transparent and effortless for end users while maintaining strong security controls.
3Ease of operation
If ISP authentication is used as a proxy of trust, then ease of operation is improved by enabling client-less device access, but device complexity increases due to authentication mapping requirements
Solution Approach 1:
The SASE gateway acts as an intermediary between the ISP authentication system and the SASE domain. It intercepts authentication messages during the ISP authentication process, extracts relevant information (access ID, IP address), and automatically generates IP address-to-tenant mappings. This intermediary function simplifies the overall system by centralizing the mapping logic in the gateway rather than requiring complex client software on each device.
Data Source
AI summary
Methods and system for providing network connectivity are disclosed. In an example, a method for providing network connectivity involves receiving from an Internet Service Provider (ISP) an access ID and an IP address at a SASE domain, wherein the access ID and the IP address correspond to a subscriber of the ISP, generating an IP address-to-tenant mapping at the SASE domain by applying the access ID and the IP address to an access ID-to-tenant mapping, and forwarding traffic received at the SASE domain from a Broadband Network Gateway (BNG) of the ISP according to the IP address-to-tenant mapping.