Zero Trust Access Routing for Private Resource Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large employee workforces accessing cloud resources remotely strain network capacity and security, allowing compromised users/devices to move laterally through corporate networks, compromising security and network integrity.
Innovation Solution
Implementing a secure access service edge (SASE) with zero trust network access (ZTNA) to provide authentication, authorization, and conditional access, intelligently routing traffic based on client location and resource type, ensuring consistent security posture for both remote and local users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If employees access cloud resources remotely through the Internet or corporate network, then access flexibility is improved, but network capacity and security are strained
Solution Approach 1:
The patent introduces a zero trust network access (ZTNA) gateway as an intermediary between users and cloud resources. This gateway performs authentication, authorization, and traffic routing decisions before allowing access to private resources. The ZTNA gateway mediates the trust relationship by continuously verifying user identity, device security posture, and access policies, thereby maintaining network security while enabling flexible remote access.
Solution Approach 2:
The system dynamically changes access parameters based on multiple conditions including user identity, device location, network type, and resource sensitivity. Instead of a static security model, the patent implements dynamic policy evaluation where access rights are adjusted in real-time based on current system state, allowing flexible access while adapting security measures to the specific access scenario.
2Reliability
If remote users access private resources through a security service, then security is improved, but network traffic routing complexity increases
Solution Approach 1:
The patent segments network traffic into different categories based on destination, user identity, and access pattern. The ZTNA gateway divides traffic flow management into separate processing stages: authentication phase, authorization phase, and traffic routing phase. This segmentation allows complex security policies to be applied systematically without overwhelming routing complexity, as each phase handles specific aspects of traffic management independently.
Solution Approach 2:
The ZTNA gateway performs multiple functions within a single unified system: it authenticates users, authorizes access, determines device trustworthiness, routes traffic appropriately, and applies security policies. By consolidating these functions into one multi-functional gateway rather than separate systems, the patent reduces overall system complexity while maintaining strong security posture.
3Ease of operation
If a VPN connection is used to access corporate network resources, then access capability is improved, but lateral movement of compromised users/devices is enabled
Solution Approach 1:
Instead of providing blanket network access through VPN, the patent applies granular access controls at the resource level. Each private resource has its own access policy that evaluates user identity, device security posture, and contextual factors before allowing connection. This local quality approach means access is not uniform across the network but is specifically tailored to each resource, preventing lateral movement by denying access to resources the user should not reach regardless of network connectivity.
Solution Approach 2:
The ZTNA gateway acts as a mediator between users and private resources, inserting itself in the access path. Rather than allowing direct VPN access to the corporate network, all traffic must pass through this intermediary which continuously evaluates security policies. This intermediary blocks lateral movement by preventing unauthorized access to internal resources even when users have initial access to the network.
4Reliability
If consistent security posture is maintained for remote and local users, then security is improved, but infrastructure complexity increases
Solution Approach 1:
The ZTNA gateway is designed as a universal access control system that handles both remote and local users through the same security framework. Rather than maintaining separate security infrastructures for different user types, the patent implements a unified gateway that applies consistent authentication and authorization policies to all users regardless of their location. This multi-functional approach achieves security consistency while avoiding the complexity of multiple separate infrastructure systems.
Data Source
AI summary
Methods, systems and computer program products are provided for intelligent secure access to private resources. A security service (e.g., SASE ZTNA) may maintain the same or similar security posture for users who work remotely and/or locally by providing authentication, authorization, and/or ongoing conditional access via a security service (e.g., private or public SASE) while intelligently routing remote client traffic to private resources through the security service and routing local client traffic to private resources locally. A traffic routing determination may be made by a security client and/or security server. A traffic routing determination may be based on the location of a client computing device, such as a trusted network detection for a private/trusted network. Traffic routing determinations may be based on conditions alternative or in addition to location, such as the type of private resource or information being accessed by a client computing device.