Zero-Trust Network Access Control for Service-Port Authentication

The patent transitions from traditional TCP/IP-based network security (operating at network and transport layers) to a zero-trust architecture that operates at the application layer and beyond. This dimensional shift enables security controls to inspect and verify actual application traffic and user identities rather than relying solely on IP addresses and network protocols, thereby preventing application layer breaches and man-in-the-middle attacks that bypass traditional perimeter security.

The patent introduces a zero-trust access broker as an intermediary component that mediates all network access requests. This broker verifies user identities, device states, and application contexts before granting access, and continuously monitors sessions. This intermediary layer blocks malicious traffic and prevents attacks by validating each request against security policies, rather than relying on traditional network perimeter defenses that can be bypassed.

The patent extracts the access control function from network-layer protocols like ARP and implements it at the application layer through the zero-trust access broker. This separates identity verification and access authorization from the underlying network infrastructure, allowing control decisions to be made based on application context, user credentials, and device state without requiring network-wide ARP spoofing operations that consume significant bandwidth and processing resources.

The patent changes the parameters used for access control from network-layer identifiers (IP addresses, MAC addresses) to application-layer parameters including user identities, device states, application contexts, and security credentials. This parameter transformation enables more precise and efficient access decisions without requiring the broadcast-based ARP spoofing mechanism that generates network load.

The patent implements preliminary action by requiring all connection requests to be pre-authenticated and authorized by the zero-trust access broker before actual data transmission begins. The broker establishes security contexts, verifies user identities, and obtains explicit authorization for each connection attempt. This preliminary security verification ensures that only authenticated and authorized connections are established, making the firewall's subsequent packet filtering more effective and reliable.

The patent implements continuous feedback mechanisms where the zero-trust access broker monitors ongoing connections, user activities, and device states, and dynamically adjusts access controls based on real-time security assessments. This feedback loop ensures that connection security is maintained throughout the session, not just at establishment, allowing the system to respond to changing security conditions and prevent unauthorized access attempts that might bypass static firewall rules.