Secure Data Plane Path Switching for Direct ZTNA Connections
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Zero Trust Network Access (ZTNA) technologies establish media sessions using relayed-relayed candidate pairs without adequate connectivity checks, leading to suboptimal and potentially insecure connections.
Innovation Solution
Utilize a policy server in the cloud to evaluate existing TCP or UDP encryption protocols, establish direct paths if secure, or employ proxy capabilities to maintain end-to-end encryption, and dynamically switch to optimal paths using multipathing techniques like STUN or ICE protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If relayed-relayed candidate pairs are used to establish media sessions, then connection establishment is simplified, but connection security and optimality deteriorate due to lack of connectivity checks
Solution Approach 1:
The patent performs connectivity checks on alternative candidate pairs before finalizing the media session establishment. This preliminary verification ensures that the selected path is both secure and optimal before traffic flows, resolving the contradiction by adding a preparatory security check step without blocking the overall connection establishment process
Solution Approach 2:
The patent implements a feedback mechanism where connectivity check results are used to determine whether to switch from relayed-relayed paths to direct paths. The system continuously monitors connection quality and security, allowing dynamic adjustments to optimize both security and performance while maintaining ease of operation
2Productivity
If direct paths are established between devices, then connection performance is improved, but security control deteriorates due to reduced intermediary oversight
Solution Approach 1:
The patent uses a trust broker as an intermediary that mediates between direct connection desires and security requirements. The trust broker evaluates connectivity checks, determines optimal paths, and controls the switching process, allowing direct paths to improve performance while maintaining security control through the intermediary's oversight
Solution Approach 2:
The patent dynamically changes connection parameters (path selection, encryption protocols, relay involvement) based on real-time security assessments and performance metrics. This allows the system to optimize performance when safe while maintaining security control through parameter adjustments driven by security policies and connectivity check results
3Reliability
If multiple path options are evaluated, then connection optimality is improved, but system complexity increases due to additional connectivity check processes
Solution Approach 1:
The patent segments the path evaluation process into distinct phases: candidate pair generation, connectivity checking, and path selection. This segmentation allows complex optimality evaluation to be broken down into manageable steps, improving connection optimality while reducing the perceived complexity through structured processing
Solution Approach 2:
The patent implements a universal connectivity check mechanism that serves multiple functions: security verification, performance assessment, and path validation. This multi-functional approach improves connection optimality through comprehensive evaluation while avoiding the complexity of separate specialized checks by using a single versatile mechanism
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Techniques for creating an optimal and secure data plane based on network constraints. The techniques include establishing an initial networking connection (118) for a data flow between a client device (102) and a resource (104) such that data plane traffic of the data flow is routed through a relay node (122) disposed between the client device and the resource, determining, using a Session Traversal Utilities for Network Address Translators (STUN) server (124), an alternate networking connection (126) for the data flow that bypasses the relay node, and based at least in part on a determination that the alternate networking connection is a more optimal path for the data plane traffic than the initial networking connection, causing the data plane traffic of the data flow to be routed over the alternate networking connection.