Thin Client ZTNA Tunneling for Non-HTTP Application Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing zero trust network access (ZTNA)/web virtual private network (VPN) environments face challenges in securely authenticating and communicating with non-HTTP and TCP/UDP applications, leading to high network gateway loads and performance overhead.
Innovation Solution
The implementation of a thin client on a client device that establishes a secure communication channel with a firewall, using a certificate and key pair generated by an authentication server, to enable secure tunneling of application traffic without the need for HTTPs validation and routing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a typical ZTNA/webVPN setup uses HTTPs server on gateway to decapsulate and validate cookies for non-HTTP applications, then authentication security is maintained, but network gateway load and processing overhead increase significantly
Solution Approach 1:
The patent segments the authentication and tunneling functions by using separate certificate authorities for authentication (CA Auth) and tunnel establishment (CA Tunnel). This allows the gateway to validate certificates without the complex cookie decapsulation and validation process, reducing processing overhead while maintaining security.
Solution Approach 2:
The patent introduces thin clients as intermediary components that establish secure tunnels using mTLS authentication. These thin clients handle the certificate-based authentication locally, eliminating the need for the gateway to perform expensive cookie validation operations for each connection.
2Reliability
If HTTPs tunneling is used for non-HTTP applications, then secure communication is achieved, but the complexity of HTTP decapsulation, cookie validation, and routing increases
Solution Approach 1:
Instead of using HTTPs as the transport protocol and adding complexity for decapsulation and validation, the patent inverts the approach by using mTLS directly over TCP/UDP. This eliminates the HTTP layer entirely for these applications, simplifying the gateway's role to basic certificate validation and routing.
Solution Approach 2:
The patent extracts the HTTP protocol layer from the communication path for non-HTTP applications. By using direct mTLS over TCP/UDP, it removes the need for HTTP decapsulation, cookie validation, and HTTP-specific routing logic from the gateway.
3Reliability
If certificate validation is performed at the gateway for each connection, then authentication reliability is improved, but connection establishment time and processing overhead increase
Solution Approach 1:
The patent implements preliminary authentication actions where the thin client establishes an mTLS-secured tunnel with the gateway before the actual application connection is made. The certificate validation occurs during this preliminary tunnel establishment phase, allowing subsequent application traffic to flow through the already-authenticated channel without repeated validation delays.
Data Source
AI summary
Techniques and architecture are described for protecting non-http and TCP/UDP applications in a zero trust network access (ZTNA)/web virtual private network (VPN) environment by establishing a secure communication channel between a native application and an application server providing an application service. More particularly, the present disclosure describes techniques and architecture that leverage the firewall wherein a thin client on a client device enables a client desktop, establishes a secure channel from a native application, e.g., the client desktop, to the firewall, and acts as a proxy.