Identity-based distributed cloud firewall for access and network segmentation

An apparatus for controlling access to network resources, comprising at least one processor and at least one non-transient computer readable medium for storing instructions that, when executed by the at least one processor, causes the apparatus to perform operations comprising:

• receiving an authentication request from a user device to a core security service;
• upon authentication of the user by the core security service, authorizing the user device to connect to a private cloud, and connecting the user device to the private cloud comprising a gateway and a firewall and retrieving user-specific, segmented firewall rules stored in the private cloud;
• routing a request by the user device to access an outer resource to the gateway;
• evaluating the request against the segmented firewall rules;
• if the request meets the segmented firewall rules, routing the request through security measures of the firewall;
• and
• if the request does not meet the segmented firewall rules, denying the user device access to the outer resource.

One or more non-transitory computer readable media having instructions stored thereon which, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• receiving an authentication request from a user device to a core security service;
• upon authentication of the user by the core security service authorizing the user device to connect to a private cloud, and connecting the user device to the private cloud comprising a gateway and a firewall and retrieving user-specific, segmented firewall rules stored in the private cloud;
• routing a request by the user device to access an outer resource to the gateway;
• evaluating the request against the segmented firewall rules;
• if the request meets the segmented firewall rules, routing the request through security measures of the firewall;
• and
• if the request does not meet the segmented firewall rules, denying the user device access to the outer resource.