Segmented ZTNA Access Control Using Chained Firewall Requests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing ZTNA systems do not support multi-level, segmented firewall implementations, rendering segment network security appliances ineffective as they lack the mechanism for multi-layer ZTNA processing.
Innovation Solution
Implementing a system where a perimeter network security appliance receives a ZTNA request, applies initial access control, and generates chained requests to segment network security appliances using ZTNA tags or certificates, allowing for differentiated access control across network segments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a traditional ZTNA system is implemented with a single firewall level, then access control is simplified and easier to manage, but multi-level segmented network access control cannot be achieved
Solution Approach 1:
The patent divides the network into multiple segments with different security levels, implementing ZTNA control at each segment boundary. The firewall system is segmented into multiple levels (L1, L2, L3, etc.), where each level handles access control for its specific network segment. This allows the system to achieve multi-level segmented network access control while keeping each individual firewall level relatively simple to manage.
Solution Approach 2:
The patent implements a nested structure where ZTNA certificates and authentication mechanisms are embedded across multiple firewall levels. Each nested firewall level contains its own ZTNA control logic, creating a hierarchical nested arrangement that enables multi-level access control without requiring complete system redesign at each level.
2Reliability
If segment network security appliances are added for multi-level control, then network security is improved, but the appliances become ineffective without multi-layer ZTNA processing capability
Solution Approach 1:
The patent designs segment network security appliances with universal ZTNA processing capability that can operate at multiple security levels. Each appliance is configured to perform ZTNA authentication and certificate validation, making them versatile enough to function effectively at any network segment level rather than being limited to a single function or level.
Solution Approach 2:
The patent adds the dimension of multi-layer ZTNA processing by implementing vertical hierarchy across multiple firewall levels. Instead of horizontal scaling alone, the system creates a vertical dimension where ZTNA certificates and authentication protocols operate across L1, L2, L3 and deeper levels, enabling segment appliances to be effective through multi-dimensional processing capability.
3Adaptability or versatility
If multi-level ZTNA processing is implemented, then segmented network access control is achieved, but session management complexity increases
Solution Approach 1:
The patent introduces intermediary components such as certificate authorities and trust anchors that mediate session management across multiple ZTNA levels. These intermediaries handle the complexity of certificate validation, trust relationship establishment, and session state synchronization, allowing the segmented access control system to function without each individual firewall level bearing the full burden of session management complexity.
Data Source
AI summary
Various embodiments provide systems and methods for applying ZTNA control in a multi-level, segmented network environment.