Trusted Terminal Detection Using HTTPS Client Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for determining trusted terminals in a zero trust network architecture are inadequate, leading to security risks due to the inability to correctly identify untrusted terminals when environment awareness clients are uninstalled or abnormally removed, thereby compromising the functionality of the zero trust architecture.
Innovation Solution
Implementing an HTTPS connection mechanism between terminals and policy control apparatuses to verify the presence of environment awareness clients, using SSL certificates for verification information exchange, ensuring that terminals can establish an HTTPS connection only if the client is present and functional, thereby determining trusted status.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If the policy detection apparatus passively receives registration or uninstall messages to determine terminal trust status, then the determination process is simple, but the apparatus cannot correctly identify untrusted terminals when the environment awareness client is uninstalled abnormally or when the network is disconnected
Solution Approach 1:
Instead of having the terminal actively notify the policy detection apparatus of its trust status (registration/uninstall messages), the invention inverts the approach by having the policy detection apparatus actively initiate an HTTPS connection to the terminal's environment awareness client to verify its presence and functionality. This inversion ensures that the apparatus can reliably detect both normal and abnormal client states.
Solution Approach 2:
The invention implements a feedback mechanism where the policy detection apparatus sends an HTTPS connection request to the terminal, and the environment awareness client responds with verification information (SSL certificate). Based on whether the verification succeeds or fails, the apparatus accurately determines the terminal's trust status, providing continuous feedback on client functionality.
2Ease of manufacture
If the environment awareness client is deployed in the terminal with passive message-based verification, then the deployment is straightforward, but the system cannot detect when the client is uninstalled due to network disconnection or OS re-deployment
Solution Approach 1:
The invention applies preliminary action by having the policy detection apparatus proactively initiate an HTTPS connection request to the terminal's environment awareness client before any access request. This advance verification ensures that the client's presence and functionality are confirmed beforehand, allowing the system to detect abnormal uninstallation scenarios that passive message-based methods miss.
Solution Approach 2:
The invention uses HTTPS connection and SSL certificate verification as an intermediary mechanism to indirectly verify the environment awareness client's presence and functionality. Instead of relying on direct client messages that may be lost, the SSL certificate acts as a reliable intermediary proof that the client is installed and operational.
3Quantity of substance
If the policy detection apparatus relies on registration and uninstall messages from the terminal, then the message exchange is minimal, but the apparatus cannot distinguish between intentional uninstallation and abnormal removal
Solution Approach 1:
The invention implements feedback by having the policy detection apparatus actively send HTTPS connection requests and analyze the responses. The environment awareness client's ability to respond with valid SSL certificate verification information provides feedback on its operational status, allowing the apparatus to distinguish between intentional uninstallation (no response or invalid certificate) and abnormal removal (network issues, OS re-deployment).
Data Source
AI summary
A method for determining a trusted terminal and a related apparatus, which are applied to a zero trust network security architecture, improves security of the zero trust architecture. The method includes: a terminal sends an access request when the terminal accesses an application server. A policy control apparatus sends an HTTPS connection request to the terminal based on the access request from the terminal. The terminal sends verification information to the policy control apparatus based on the HTTPS connection request. The policy control apparatus performs verification on the verification information. After the verification on the verification information succeeds, the terminal successfully establishes an HTTPS connection to the policy control apparatus. The HTTPS connection indicates that the terminal is a trusted terminal.