Providing zero trust network security without modification of network infrastructure

Patent metadata

Field	Value
Publication number	US-12348513-B2
Application number	US-202418600176-A
Country	US
Kind code	B2
Filing date	Mar 8, 2024
Priority date	Jul 27, 2020
Publication date	Jul 1, 2025
Grant date	Jul 1, 2025

Abstract

Zero trust network security is provided without modifying the underlying network infrastructure. A first entity at a first node in a network environment obtains an entity identifier and host certificate from a second entity installed on a second node. A determination is made as to whether the host certificate is valid based on a firewall policy and an intermediate certificate that was issued to the first entity. A determination is also made as to whether the entity identifier is valid based on a known infrastructure of the network environment. If the host certificate and entity identifier are valid, communications between the first and second entities can be allowed, while communications are blocked if at least one of the host certificate and the entity identifier is not valid.

First claim

The invention claimed is:

1. A method comprising:
receiving, by a first entity at a first node in a network environment, an entity identifier and a host certificate from a second entity installed on a second node in the network environment, wherein the first entity was issued an intermediate certificate;
determining if the host certificate is valid based on at least one of a firewall policy enforced at the first node and the intermediate certificate, wherein determining if the host certificate is valid comprises determining if the host certificate is a non-expired certificate issued by a same issuing authority as the intermediate certificate and comprises a valid signature of a cloud provider;
determining if the entity identifier is valid based on a known network infrastructure of the network environment, wherein determining if the entity identifier is valid comprises determining whether the second entity is indicated in the known network infrastructure; and
based on determining that at least one of the host certificate and the entity identifier is not valid, blocking communications with the second entity.

2. The method of claim 1 , further comprising, based on determining that the host certificate is valid and determining that the entity identifier is valid, allowing communications with the second entity.

3. The method of claim 1 , wherein each of the first and second entities is an application, and wherein determining if the host certificate is valid comprises comparing contents of the intermediate certificate and the host certificate.

4. The method of claim 1 , wherein each of the first and second entities is a service, and wherein determining if the host certificate is valid comprises comparing properties of the host certificate to the firewall policy.

5. The method of claim 1 , further comprising:
receiving, by an agent installed on the first node, traffic routed from the second entity to the first entity;
determining, by the agent, if communications with the second entity are permitted based on the firewall policy; and
based on determining that communications with the second entity are not permitted, securing communications between the first and second entities.

6. The method of claim 5 , wherein securing communications between the first and second entities comprises encrypting communications between the first and second entities and utilizing mutual authentication for communications between the first and second entities.

7. The method of claim 6 , wherein utilizing mutual authentication for communications between the first and second entities comprises authenticating with mutual Transport Layer Security.

8. The method of claim 1 , wherein determining if the entity identifier is valid based on the known network infrastructure of the network environment comprises correlating metadata obtained from the cloud provider with metadata of the network environment indicating a known network infrastructure for the network environment.

9. One or more non-transitory machine-readable media having program code stored thereon, the program code comprising instructions to:
obtain, by a first entity at a first node in a network environment, an entity identifier and a host certificate from a second entity installed on a second node in the network environment, wherein the first entity was issued an intermediate certificate;
determine whether the host certificate is valid based on at least one of a firewall policy enforced at the first node and the intermediate certificate, wherein the instructions to determine whether the host certificate is valid comprise instructions to determine whether the host certificate is a non-expired certificate issued by a same issuing authority as the intermediate certificate and comprises a valid cloud provider signature;
determine whether the entity identifier is valid based on a known network infrastructure of the network environment, wherein the instructions to determine whether the entity identifier is valid comprise instructions to determine whether the second entity is indicated in the known network infrastructure; and
based on a determination that at least one of the host certificate and the entity identifier is not valid, block communications with the second entity.

10. The non-transitory machine-readable media of claim 9 , wherein the program code further comprises instructions to,
based on determinations that the host certificate and the entity identifier are valid, allow communications with the second entity.

11. The non-transitory machine-readable media of claim 9 , wherein the instructions to determine whether the host certificate is valid further comprise instructions to compare contents of the intermediate certificate and the host certificate.

12. The non-transitory machine-readable media of claim 9 , wherein the instructions to determine whether the host certificate is valid comprise instructions to compare properties of the host certificate to the firewall policy.

13. The non-transitory machine-readable media of claim 9 , wherein the program code further comprises instructions to:
based on receipt of traffic routed from the second entity to the first entity, determine, by an agent installed on the first node, whether communications with the second entity are permitted based on the firewall policy; and
based on a determination that communications with the second entity are not permitted, secure communications between the first entity and the second entity.

14. The non-transitory machine-readable media of claim 13 , wherein the instructions to secure communications between the first entity and the second entity comprise instructions to encrypt communications between the first and second entities and utilize mutual authentication for communications between the first and second entities.

15. An apparatus comprising:
a processor; and
a non-transitory machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to:
obtain, by a first entity at a first node in a network environment, an entity identifier and a host certificate from a second entity installed on a second node in the network environment, wherein the first entity was issued an intermediate certificate;
determine if the host certificate is valid based on at least one of a firewall policy and the intermediate certificate, wherein the instructions executable by the processor to cause the apparatus to determine if the host certificate is valid comprise instructions executable by the processor to cause the apparatus to determine if the host certificate is a non-expired certificate issued by a same issuing authority as the intermediate certificate and comprises a valid cloud provider signature;
determine if the entity identifier is valid based on a known network infrastructure of the network environment, wherein the instructions executable by the processor to cause the apparatus to determine if the entity identifier is valid comprise instructions executable by the processor to cause the apparatus to determine whether the second entity is indicated in the known network infrastructure; and
based on a determination that at least one of the host certificate and the entity identifier is not valid, block communications with the second entity.

16. The apparatus of claim 15 , further comprising instructions executable by the processor to cause the apparatus to, based on determinations that the host certificate and the entity identifier are valid, allow communications with the second entity.

17. The apparatus of claim 15 , wherein

Assignees

• Palo Alto Networks Inc

Inventors

• Levin Liron
• Yanay Eran
• Stopel Dima

Classifications

• H04L63/0263

  Rule management · CPC title

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/166

  at the transport layer · CPC title

• H04L63/0869 Primary

  for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273) · CPC title