Segmented ZTNA Access Control Across Multi-Level Firewalls

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing ZTNA systems do not support multi-level, segmented firewall implementations, rendering segment network security appliances ineffective as they lack the mechanism for multi-layer ZTNA processing, thus limiting network security to only perimeter network security appliances.

Innovation Solution

Implementing a system where ZTNA requests are processed by both perimeter and segment network security appliances, allowing for different levels of access control through ZTNA chaining, where perimeter appliances initiate requests and segment appliances apply additional security policies based on ZTNA tags or certificates.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If a traditional ZTNA system with a single perimeter firewall is used, then the implementation is simple, but multi-level segmented network security cannot be achieved

Engineering Contradiction:

Improvemulti-level segmented network securityVSAvoidfirewall implementation complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The network is divided into multiple segments with different security levels, and firewalls are distributed across these segments rather than concentrated at a single perimeter. Each segment has its own firewall that can independently enforce security policies, enabling multi-level segmented network security while maintaining manageable complexity through modular deployment

Inventive Principle:

Principle #1Segmentation

2Reliability

If segment network security appliances are added for multi-level security, then network security coverage is improved, but processing efficiency decreases

Engineering Contradiction:

Improvenetwork security coverageVSAvoidsession processing speed

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

Security policies are pre-configured and cached at each segment firewall before actual traffic arrives. The firewalls perform preliminary authentication and policy matching, so when traffic flows through multiple segments, the processing is faster because the security decisions have been prepared in advance rather than computed in real-time at each hop

Inventive Principle:

Principle #10Preliminary action

3Reliability

If multiple firewalls process ZTNA requests in sequence, then security coverage is enhanced, but processing time increases

Engineering Contradiction:

Improvesecurity policy enforcementVSAvoidrequest processing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The ZTNA certificate and security context are maintained continuously as traffic flows through multiple firewall segments. Instead of re-authenticating at each segment, the security evaluation continues uninterrupted using the initial ZTNA certificate, allowing multiple firewalls to enforce security policies in sequence without significant time penalty while maintaining enhanced security coverage

Inventive Principle:

Principle #20Continuity of useful action

Data Source

PatentUS12549560B2Systems and methods for multi-level segmented ZTNA access control

Publication Date: 2026.02.10 FORTINET INC

AI summary

Various embodiments provide systems and methods for applying ZTNA control in a multi-level, segmented network environment.