SDP Controller Identity Mapping for Zero-Trust Latency

The patent uses an intermediate broker (gateway system) to mediate traffic between untrusted external networks and trusted internal networks. The broker authenticates devices, establishes secure tunnels, and filters traffic while maintaining the zero-trust security model. This resolves the contradiction by providing security through mediation without requiring permanently open ports, thereby reducing latency compared to traditional firewall approaches while maintaining security.

The patent implements dynamic port opening where the border firewall ports are opened temporarily only when needed for specific authenticated connections, rather than remaining permanently open. The gateway system dynamically requests port openings, receives authentication, and the firewall opens ports only for the duration of the connection. This dynamic approach maintains connectivity while reducing deployment effort and security risk compared to static open ports.

The patent performs preliminary authentication and connection establishment through the gateway before actual data transfer begins. The gateway pre-authenticates devices, pre-establishes secure tunnels, and pre-coordinates firewall port openings. This preliminary action ensures that once connectivity is established, data transfer occurs directly between devices without repeated authentication overhead, thereby reducing latency for the actual data transmission while maintaining security.

The patent segments the network communication into two distinct phases: a control plane phase where the intermediate broker (gateway) handles authentication, tunnel establishment, and security policies; and a data plane phase where traffic flows directly between devices through established secure tunnels. This segmentation allows security management to be handled by the broker while data transmission occurs on direct paths, minimizing bandwidth consumption by the broker to only control messages rather than all data traffic.