Trusted Terminal Verification via HTTPS in Zero Trust Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for determining trusted terminals in a zero trust network security architecture are inadequate, leading to security risks due to incorrect identification of terminals as trusted or untrusted, especially when environment awareness clients are uninstalled or abnormally removed, compromising the functionality of the zero trust architecture.
Innovation Solution
Implementing an HTTPS connection mechanism between terminals and policy control apparatuses to verify the presence and integrity of environment awareness clients, using SSL certificates for verification information exchange, ensuring that terminals can establish an HTTPS connection only when verified, thereby accurately determining trusted status.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If the policy detection apparatus passively receives registration or uninstall messages from the terminal to determine trusted status, then the determination process is simple, but the terminal status cannot be correctly determined when the environment awareness client is uninstalled abnormally or when network is disconnected
Solution Approach 1:
Instead of having the terminal actively notify the policy detection apparatus of its status (registration/uninstall messages), the invention inverts the approach by having the policy detection apparatus actively initiate an HTTPS connection to the terminal's environment awareness client to verify its presence. This inversion transforms the passive determination method into an active verification method, solving the reliability problem when terminals fail to send notifications due to abnormal uninstallation or network disconnection.
Solution Approach 2:
The invention implements a feedback mechanism where the policy detection apparatus sends an HTTPS connection request to the terminal, and the environment awareness client responds with verification information (SSL certificate). This feedback loop allows the policy detection apparatus to continuously verify the terminal's trusted status, ensuring accurate determination even when the terminal cannot proactively communicate its status changes.
2Measurement precision
If HTTPS connection mechanism with SSL certificate verification is implemented, then terminal status determination accuracy is improved, but the system complexity increases
Solution Approach 1:
The invention introduces SSL certificates as an intermediary verification mechanism between the policy detection apparatus and the terminal. The environment awareness client on the terminal generates and manages SSL certificates, which serve as cryptographic proof of the client's presence and integrity. This intermediary approach enables accurate verification without requiring complex direct communication protocols, as the SSL certificate acts as a standardized, widely-supported verification medium.
Solution Approach 2:
The invention changes the verification parameter from simple message reception (binary presence/absence) to cryptographic certificate validation. By using SSL certificate verification, the system transforms the determination criterion into a more precise parameter that can reliably indicate whether the environment awareness client is present and functional, thereby improving measurement precision despite increased complexity.
Data Source
Figure 1A~1B
Figure 2~3
Figure 4~6
AI summary
Embodiments of this application disclose a method for determining a trusted terminal and a related apparatus, which are applied to a zero trust network security architecture, to improve security of the zero trust architecture. The method in embodiments of this application includes: A terminal sends an access request when the terminal accesses an application server. A policy control apparatus sends an HTTPS connection request to the terminal based on the access request from the terminal. The terminal sends verification information to the policy control apparatus based on the HTTPS connection request. The policy control apparatus performs verification on the verification information. After the verification on the verification information succeeds, the terminal successfully establishes an HTTPS connection to the policy control apparatus. The HTTPS connection indicates that the terminal is a trusted terminal.