Zero-Trust Microsegmentation for Internal Traffic Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security technologies struggle to provide visibility and control over internal traffic within a LAN/VLAN, as traditional approaches like firewalls and VLANs do not address inter-device communication, and zero-trust techniques are difficult to implement and maintain due to administrative burdens.
Innovation Solution
Implementing agentless zero-trust techniques, atomic segmentation, progressive zero-trust techniques, and continuous zero-trust techniques, which include a gateway appliance (gatekeeper) to monitor and enforce zero-trust policies, segment devices into individual subnets, and continuously refine communication rules to ensure only authorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional firewalls and VLANs are used for network segmentation, then access control to LAN resources is improved, but visibility and control over internal inter-device communication is lost
Solution Approach 1:
The patent divides the network into multiple micro-segments at the host level, creating granular security zones. Each device or application can be isolated into its own micro-segment, enabling fine-grained control and visibility of internal traffic while maintaining access control policies. This resolves the contradiction by providing both security (access control) and observability (traffic visibility) simultaneously through detailed network segmentation.
2Reliability
If zero-trust techniques are implemented with microsegmentation, then security control over all resources is improved, but administrative complexity and maintenance burden increase
Solution Approach 1:
The patent implements automated policy generation and enforcement mechanisms that reduce manual administrative overhead. The system can automatically discover devices, applications, and traffic patterns, then generate appropriate zero-trust policies without requiring extensive manual configuration. This self-service capability maintains strong security control while significantly reducing the administrative complexity and maintenance burden associated with traditional zero-trust implementations.
3Reliability
If coarse-grained segmentation using firewalls and VLANs is applied, then external access control is improved, but fine-grained control over inter-device communication is lost
Solution Approach 1:
The patent adds a new dimension of segmentation by implementing host-level micro-segments that operate alongside traditional network-level VLANs. This multi-dimensional segmentation approach allows coarse-grained external access control at the VLAN/firewall level while simultaneously enabling fine-grained control over internal inter-device communication at the host micro-segment level. The layered segmentation structure resolves the contradiction by operating at multiple granularities simultaneously.
Data Source
AI summary
Zero trust and micro-segmentation techniques may be collectively used to enhance network security. To establish, refine, and enforce a zero-trust least-privileged policy, the network may be segmented to put each device of the network into a respective network of one, which forces all network traffic to pass through a zero-trust gatekeeper. The gatekeeper may then monitor and analyze the traffic to establish, refine, and enforce the zero-trust least-privileged policy, which reduces network access to only a limited set of network actions and/or paths. Using the gatekeeper, network traffic may be monitored to progressively establish the policy as well as to continually refine the policy. Recommended actions may be determined based on the analysis of the monitored network traffic and provided to the user to allow user feedback on the communication rules of zero-trust policy.