ZTNA Data Plane Routing for Secure Direct Connections
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network access technologies, such as VPNs, do not efficiently provide secure application access without wider network access, and there is a need for optimizing data plane connections while maintaining end-to-end encryption.
Innovation Solution
Utilizing a cloud-based Zero Trust Network Access (ZTNA) control plane and employing multipathing techniques to determine an optimal data path between a client device and a resource, preserving end-to-end encryption through protocols like (D)TLS 1.3, QUIC, and Wireguard, and using STUN servers to bypass intermediary proxies when necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data plane traffic is routed through a relay node in ZTNA, then connection security and trust are improved, but data transmission efficiency and latency are worsened
Solution Approach 1:
The system dynamically switches between relay node routing and direct routing based on real-time network conditions. The controller monitors network state and selectively establishes direct data plane connections when network conditions permit, while falling back to relay node routing when security requirements demand it, thus optimizing the balance between security and performance
Solution Approach 2:
The relay node acts as an intermediary that can be selectively removed from the data path. When direct routing is established, the relay node is removed from the data plane path, eliminating the performance penalty while maintaining security through the control plane's continuous verification of connection legitimacy
2Speed
If direct data plane connections are established, then data transmission efficiency is improved, but security control and trust verification are worsened
Solution Approach 1:
The system segments the connection into two independent parts: control plane connection (always through relay node for security verification) and data plane connection (direct when established). This segmentation allows security control to remain centralized while enabling direct data transmission paths that optimize performance
Solution Approach 2:
The relay node serves as a trust intermediary that verifies connection legitimacy in the control plane before allowing direct data plane connections. This maintains security control without requiring the relay node to be in the data path, resolving the contradiction between efficiency and security
3Productivity
If network paths are dynamically changed, then bandwidth and latency optimization are improved, but connection stability and reliability are worsened
Solution Approach 1:
The controller continuously monitors network conditions and connection performance, using this feedback to dynamically adjust routing decisions. The system establishes direct connections when network conditions are stable and secure, and switches to relay node routing when conditions change, thus optimizing performance while maintaining connection stability through informed decision-making
Data Source
AI summary
Techniques for creating an optimal and secure data plane based on network constraints. The techniques may include establishing an initial networking connection for a data flow between a client device and a resource such that data plane traffic of the data flow is routed through a relay node disposed between the client device and the resource. In some examples, the techniques may include determining, using a Session Traversal Utilities for Network Address Translators (STUN) server, an alternate networking connection for the data flow that bypasses the relay node. Based at least in part on a determination that the alternate networking connection is a more optimal path for the data plane traffic than the initial networking connection, the techniques may include causing the data plane traffic of the data flow to be routed over the alternate networking connection.