Adaptive network security using zero trust microsegmentation

Patent metadata

Field	Value
Publication number	US-12177260-B2
Application number	US-202418620708-A
Country	US
Kind code	B2
Filing date	Mar 28, 2024
Priority date	Apr 24, 2023
Publication date	Dec 24, 2024
Grant date	Dec 24, 2024

Abstract

Zero trust and micro-segmentation techniques may be collectively used to enhance network security. To establish, refine, and enforce a zero-trust least-privileged policy, the network may be segmented to put each device of the network into a respective network of one, which forces all network traffic to pass through a zero-trust gatekeeper. The gatekeeper may then monitor and analyze the traffic to establish, refine, and enforce the zero-trust least-privileged policy, which reduces network access to only a limited set of network actions and/or paths. Using the gatekeeper, network traffic may be monitored to progressively establish the policy as well as to continually refine the policy. Recommended actions may be determined based on the analysis of the monitored network traffic and provided to the user to allow user feedback on the communication rules of zero-trust policy.

First claim

We claim:

1. A zero-trust microsegmentation method comprising:
determining a plurality of network microsegments of a network including a plurality of devices, wherein each network microsegment of the plurality of network microsegments is configured to include one or more of the plurality of devices, the network being configured to cause all device traffic of the plurality of devices to traverse a network device common to and associated with each of the devices of the plurality of devices;
determining an initial zero-trust security policy including communication permissions;
analyzing network traffic under the communication permissions of the initial zero-trust security policy, the network traffic comprising the device traffic of the plurality of devices traversing the network device; and
adapting one or more of the communication permissions, based on the analysis of the network traffic, to generate an adapted zero-trust security policy including the one or more adapted communication permissions.

2. The method of claim 1 , further comprising iteratively performing: the analyzing network traffic, and adapting one or more of the communication permissions based on the analysis of the network traffic.

3. The method of claim 1 , wherein the initial zero-trust security policy is configured to deny network traffic for the plurality of devices of the network by default unless otherwise allowed.

4. The method of claim 1 , wherein adapting the one or more of the communication permissions comprises removing the one or more of the communication permissions from the initial zero-trust security policy to generate the adapted zero-trust security policy.

5. The method of claim 1 , further comprising determining a suggested modification the one or more of the communication permissions based on the analysis of the network traffic.

6. The method of claim 5 , wherein the adapting the one or more of the communication permissions is based on feedback responsive to the suggested modification.

7. The method of claim 5 , further comprising providing the suggested modification as a computer-generated output.

8. The method of claim 7 , wherein providing the suggested modification comprises displaying the suggested modification.

9. The method of claim 8 , wherein the suggested modification is displayed on a graphical user interface (GUI) and a feedback responsive to the suggested modification is submitted using the GUI.

10. The method of claim 7 , wherein the adapting the one or more of the communication permissions is based on feedback responsive to the computer-generated output.

11. The method of claim 10 , wherein the feedback comprises acceptance or rejection of the suggested modification.

12. The method of claim 1 , wherein adapting one or more of the communication permissions comprises increasing a restrictiveness of the one or more of the communication permissions.

13. The method of claim 1 , wherein adapting one or more of the communication permissions comprises modifying a communication dimension of the initial zero-trust security policy.

14. The method of claim 1 , wherein configuring the network comprises: providing each device of the plurality of devices in its own respective network-of-one within the network.

15. The method of claim 14 , wherein the networks-of-one are configured to cause all of the device traffic to traverse the network device, wherein the network device is a gatekeeper configured as a default gateway for the plurality of devices.

16. The method of claim 1 , wherein one or more of the plurality of devices of the network comprise a respective local zero-trust agent configured to provide zero-trust least-privilege network management.

17. The method of claim 1 , further comprising:
analyzing, using the network device, network traffic under the communication permissions of the adapted zero-trust security policy;
adapting one or more of the communication permissions of the adapted zero-trust security policy, based on the analysis of the network traffic under the adapted zero-trust security policy, to generate a further adapted zero-trust security policy; and
implementing, using the network device, the further adapted zero-trust security policy.

18. The method of claim 17 , further comprising iteratively performing: the analyzing network traffic under the adapted zero-trust security policy, the adapting the adapted zero-trust security policy, and the implementing the further adapted zero-trust security policy.

19. An apparatus comprising:
one or more processors; and
a memory for storing computer readable instructions that, when executed by the one or more processors, cause the apparatus to:
determine a plurality of network microsegments of a network including a plurality of devices, wherein each network microsegment of the plurality of network microsegments is configured to include one or more of the plurality of devices, the network being configured to cause all device traffic of the plurality of devices to traverse a network device common to and associated with each of the devices of the plurality of devices;
determine an initial zero-trust security policy including communication permissions;
analyze network traffic under the communication permissions of the initial zero-trust security policy, the network traffic comprising the device traffic of the plurality of devices traversing the network device; and
adapt one or more of the communication permissions, based on the analysis of the network traffic, to generate an adapted zero-trust security policy including the one or more adapted communication permissions.

20. The apparatus of claim 19 , wherein executing the computer readable instructions further causes the apparatus to establish the network, wherein each device of the network is in its own network of one.

21. The method of claim 1 , wherein configuring the network comprises implementing a subnet mask to cause each of the devices of the plurality of devices to be in its own network-of-one.

22. The method of claim 1 , further comprising applying, by the network device, the adapted zero-trust security policy to the device traffic traversing the network device.

23. The method of claim 1 , wherein analyzing the network traffic comprises analyzing, by the network device, the device traffic of the plurality of devices traversing the network device.

24. The method of claim 1 , wherein analyzing the network traffic comprises determining whether one or more communication paths associated with one or more of the plurality devices has an absence of device traffic, the one or more adapted communication permissions including restricting communications via the one or more communication paths in response to the absence of device traffic via the one or more communication paths.

25. The method of claim 1 , wherein the network device is a gatekeeper configured as a default gateway for the plurality of devices.

Assignees

• Colortokens Inc

Inventors

• Akali Harish
• Tyagi Satyam
• Owen Wyn
• Kollimarla Surya
• Khazanchi Rajesh

Classifications

• H04L63/0263 Primary

  Rule management · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L63/205

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title