Zero-Trust Microsegmentation for Internal Traffic Visibility
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security technologies struggle to provide visibility and control over internal traffic within a LAN/VLAN, and implementing zero trust and microsegmentation is laborious and difficult to maintain, leading to inefficiencies and increased complexity.
Innovation Solution
Implement agentless zero-trust techniques using a zero-trust gatekeeper that segments devices into individualized subnets, monitors network traffic, and enforces granular access controls without requiring agents on each device, employing atomic segmentation, progressive enforcement, and continuous optimization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Weight of moving object
If traditional firewalls and VLANs are used for network segmentation, then coarse-grained network segmentation is achieved, but visibility and control over internal traffic within LAN/VLAN is lost
Solution Approach 1:
The patent implements microsegmentation by dividing the network into fine-grained segments at the device level, allowing individual control and visibility of each device's traffic. This resolves the contradiction by providing both segmentation and visibility, as each device becomes a manageable unit with observable traffic patterns.
Solution Approach 2:
The patent introduces a network observer/analytic component that acts as an intermediary to monitor and analyze traffic between segmented devices. This mediator provides the necessary visibility into internal traffic while maintaining the segmentation structure, resolving the contradiction between segmentation and observability.
2Reliability
If zero trust and microsegmentation are implemented traditionally, then security is enhanced, but implementation and maintenance becomes laborious and complex
Solution Approach 1:
The patent implements automated policy generation where the system observes traffic patterns and automatically creates security policies without requiring manual configuration. This self-service approach maintains high security through zero trust principles while eliminating the laborious administration typically associated with microsegmentation.
Solution Approach 2:
The patent incorporates continuous monitoring and feedback loops where traffic observations automatically inform policy adjustments. This feedback mechanism enables the system to adapt and optimize security policies automatically, reducing maintenance complexity while enhancing security effectiveness.
3Ease of operation
If agents are deployed on each device for zero trust enforcement, then granular access control is achieved, but device complexity and deployment costs increase
Solution Approach 1:
The patent uses a network observer as an intermediary that enforces access control policies based on observed traffic patterns, eliminating the need for agents on each device. This approach achieves granular access control through network-level observation and policy enforcement, avoiding the complexity of device-level agent deployment.
Data Source
AI summary
Zero trust and micro-segmentation techniques may be collectively used to enhance network security. To establish, refine, and enforce a zero-trust least-privileged policy, the network may be segmented to put each device of the network into a respective network of one, which forces all network traffic to pass through a zero-trust gatekeeper. The gatekeeper may then monitor and analyze the traffic to establish, refine, and enforce the zero-trust least-privileged policy, which reduces network access to only a limited set of network actions and/or paths. Using the gatekeeper, network traffic may be monitored to progressively establish the policy as well as to continually refine the policy. Recommended actions may be determined based on the analysis of the monitored network traffic and provided to the user to allow user feedback on the communication rules of zero-trust policy.