Zero-Trust Microsegmentation for Agentless LAN Traffic Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security techniques, including zero-trust and microsegmentation, face challenges in providing visibility and control over internal traffic within a LAN/VLAN, are difficult to implement and maintain, and require extensive administration, leading to inefficiencies and potential security gaps.
Innovation Solution
Implement agentless zero-trust techniques using a gateway appliance (gatekeeper) to segment devices into individual subnets, monitor network traffic, and enforce zero-trust policies without agents, employing atomic segmentation, progressive enforcement, and continuous optimization to ensure fine-grained access control and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Weight of moving object
If traditional firewalls and VLANs with ACLs are used for network segmentation, then coarse-grained network segmentation can be accomplished, but network communication visibility and control for inter-device communications within LAN/VLAN are not provided
Solution Approach 1:
The patent applies segmentation by dividing the network into fine-grained microsegments at the device level using individualized subnets (e.g., /32 subnets). Each device is isolated in its own subnet, enabling precise control and visibility of inter-device communications while maintaining the benefits of network segmentation.
2Reliability
If zero trust and microsegmentation are implemented traditionally, then network security is enhanced, but the administration of access policies across all devices becomes laborious and difficult to maintain
Solution Approach 1:
The patent implements self-service by using an agentless approach where the gatekeeper appliance automatically discovers devices, creates individualized subnets, and enforces zero trust policies without requiring manual configuration on each device. The system self-manages the complex policy administration across all devices, eliminating laborious manual configuration while maintaining strong security.
3Ease of operation
If agents are deployed on devices for zero trust enforcement, then fine-grained access control can be achieved, but device complexity and implementation costs increase
Solution Approach 1:
The patent extracts the zero trust enforcement functionality from individual devices by implementing it centrally on a gatekeeper appliance. This agentless approach removes the need to deploy, manage, and maintain security agents on each device, reducing device complexity and implementation costs while still achieving fine-grained access control through network-level policy enforcement.
Data Source
AI summary
Zero trust and micro-segmentation techniques may be collectively used to enhance network security. To establish, refine, and enforce a zero-trust least-privileged policy, the network may be segmented to put each device of the network into a respective network of one, which forces all network traffic to pass through a zero-trust gatekeeper. The gatekeeper may then monitor and analyze the traffic to establish, refine, and enforce the zero-trust least-privileged policy, which reduces network access to only a limited set of network actions and/or paths. Using the gatekeeper, network traffic may be monitored to progressively establish the policy as well as to continually refine the policy. Recommended actions may be determined based on the analysis of the monitored network traffic and provided to the user to allow user feedback on the communication rules of zero-trust policy.