Zero Trust Policy Engine for Context-Based Network Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The traditional enterprise network security model, which relies on a well-defined perimeter, is inadequate in the era of cloud-based applications and mobile users, leading to increased risks from unsecured devices and unmanaged access to the Internet.
Innovation Solution
Implementing a zero trust policy engine with a Zero Trust Architecture (ZTA) that monitors and controls access by verifying user and device identity and context, using enforcement nodes distributed throughout the network to enforce policies and manage risk through dynamic scoring, and providing inline inspection and adaptive controls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a traditional perimeter-based security model is used, then network security is maintained within a well-defined boundary, but security coverage is insufficient when users access resources from outside the perimeter
Solution Approach 1:
The patent segments the traditional monolithic perimeter security into distributed zero trust policy enforcement points throughout the network. Each enforcement point independently evaluates and enforces security policies, replacing the single perimeter boundary with multiple distributed security checkpoints that provide both reliability and extended coverage.
Solution Approach 2:
The patent introduces zero trust policy engines as intermediary components between users and network resources. These engines verify identities, assess risks, and enforce access policies dynamically, acting as mediators that extend security coverage beyond the traditional perimeter while maintaining reliable security enforcement at each access point.
2Ease of operation
If cloud-based applications and mobile access are enabled, then user accessibility and flexibility are improved, but security risks from unsecured devices and unmanaged access increase
Solution Approach 1:
The patent implements dynamic risk scoring and adaptive policy enforcement that adjusts security controls based on real-time assessments of device security posture, user behavior, and context. This allows the system to maintain ease of operation for legitimate users while dynamically increasing security measures when risks are detected, resolving the contradiction between accessibility and security.
Solution Approach 2:
The patent changes security parameters dynamically based on verified identity and context information. Instead of static perimeter-based access control, the system adjusts authentication requirements, monitoring intensity, and access permissions based on real-time parameters such as device security state, user location, and requested resource sensitivity, enabling both easy access and risk mitigation.
3Reliability
If zero trust policy verification is implemented for all users and devices, then security is enhanced, but system complexity and processing overhead increase
Solution Approach 1:
The patent performs preliminary identity verification and context information collection during initial connection establishment. By gathering and verifying security-relevant data upfront rather than continuously during sessions, the system reduces ongoing processing overhead while maintaining rigorous security verification, thus enhancing security without excessive complexity.
Solution Approach 2:
The patent creates universal zero trust policy engines that handle multiple security functions including identity verification, risk assessment, policy enforcement, and logging within single integrated components. This multi-functionality reduces the number of separate systems needed, thereby enhancing comprehensive security verification while managing overall system complexity.
4Measurement precision
If granular context-based policies are enforced, then access control precision is improved, but policy management complexity increases
Solution Approach 1:
The patent applies the principle of local quality by implementing granular context-based policies that are tailored to specific users, devices, locations, and resources. Each zero trust policy enforcement point evaluates local context information and applies appropriate access controls specific to that situation, achieving high precision in access control while distributing policy management across multiple independent enforcement points rather than requiring centralized management of all policies.
Data Source
AI summary
Disclosed is a method for implementing a Zero Trust Architecture (ZTA) to secure network resources by eliminating lateral threat movement and minimizing attack surfaces. A zero trust policy engine, positioned inline between user devices and network resources, receives and evaluates access requests by verifying user and device identities along with context information. Based on dynamic risk scores derived from these evaluations, the engine enforces least-privileged, identity-based access policies, selectively granting access exclusively to authorized resources. Connections are terminated and re-established through secure proxy techniques, with continuous inspection of traffic for threats and data loss. Adaptive security measures, including isolation through pixel-streaming and context-aware access adjustments, further enhance protection. This architecture integrates seamlessly with cloud-based security service platforms, supporting workload-to-workload security, external entity integration, and comprehensive compliance reporting through audit trails and dashboards.