Providing zero trust network security without modification of network infrastructure
AssigneeTwistlock, Ltd.
InventorsLiron Levin, Eran Yanay, Dima Stopel
Life of this patent
Estimating the term…
Abstract
Zero trust network security is provided without modifying the underlying network infrastructure. Unique intermediate certificates created based on a primary certificate are sent to each of a plurality of entities. Each entity of the plurality of entities is installed on a respective node of a plurality of nodes in a network environment of a cloud provider. An agent is deployed to each of the plurality of nodes, and the agent is configured to enforce at least one network firewall policy based on the intermediate certificate sent to the corresponding entity.
Claims26
A method comprising:
- creating a primary certificate based on signed data obtained from a cloud provider, wherein the signed data identify a plurality of nodes in a network environment of the cloud provider;
- creating a plurality of intermediate certificates based on the primary certificate, wherein the primary certificate and each of the plurality of intermediate certificates comprises a signature of the cloud provider, wherein each of the plurality of intermediate certificates is unique;
- sending each of the plurality of intermediate certificates to a respective one of a plurality of entities, wherein each entity of the plurality of entities is installed on a respective node of the plurality of;
- and
- deploying each of a plurality of agents to a respective one of the plurality of nodes, where the plurality of agents enforces a first firewall policy for respective ones of the plurality of entities based on the plurality of intermediate certificates.
A non-transitory computer-readable medium having stored thereon instructions executable by a processing circuitry to:
- create a primary certificate based on signed data obtained from a cloud provider, wherein the signed data identify a plurality of nodes in a network environment of the cloud provider;
- create a plurality of intermediate certificates based on the primary certificate, wherein the primary certificate and each of the plurality of intermediate certificates comprises a signature of the cloud provider, wherein each of the plurality of intermediate certificates is unique;
- send each of the plurality of intermediate certificates to a respective one of a plurality of entities, wherein each entity of the plurality of entities is installed on a respective node of the plurality of nodes;
- and
- deploy each of a plurality of agents to a respective one of the plurality of nodes, wherein the plurality of agents verifies whether communications of the plurality of entities are allowed based on the plurality of intermediate certificates.
A system comprising:
- a processing circuitry;
- and
- a memory, the memory containing instructions that, when executed by the processing circuitry, cause the system to:
- create a primary certificate based on signed data obtained from a cloud provider, wherein the signed data identify a plurality of nodes in a network environment of the cloud provider;
- create a plurality of intermediate certificates based on the primary certificate, wherein the primary certificate and each of the plurality of intermediate certificates comprises a signature of the cloud provider, wherein each of the plurality of intermediate certificates is unique;
- send each of the plurality of intermediate certificates to a respective one of a plurality of entities, wherein each entity of the plurality of entities is installed on a respective node of the plurality of nodes;
- and
- deploy each of a plurality of agents to a respective one of the plurality of nodes, wherein the plurality of agents enforces at least a first firewall policy for respective ones of the plurality of entities based on the plurality of intermediate certificates.
Dependencies are inferred from the claim text.