Network segmentation for secure network tunneling
AssigneeFortanix, Inc.
InventorsGijsbrecht Natanaël Kwakkel, Jethro Gideon Beekman
Life of this patent
Estimating the term…
Abstract
A request of a VPN client to connect to a second set of one or more networks is received by a first VPN server associated with a first set of one or more networks. The request comprises an identifier of the VPN client, an attestation of an access control server that the VPN client complies with a compliance profile required to access the second set of one or more networks, and a digital signature of the access control server. The digital signature is validated using a public key of the access control server. One or more common networks each included in both the first and second sets of networks are identified. A firewall of the first VPN server is modified to permit the VPN client to connect to the one or more common networks.
Claims20
A method comprising:
- receiving, by a processing device of a first virtual private network (VPN) server associated with a first set of one or more networks, a request of a VPN client to connect to a second set of one or more networks, wherein the request comprises:
- an identifier of the VPN client,
- an attestation of an access control server that the VPN client complies with a compliance profile required to access the second set of one or more networks, and
- a digital signature of the access control server;
- validating the digital signature of the access control server using a public key of the access control server;
- identifying one or more common networks each included in both the first set of one or more networks and the second set of one or more networks;
- and
- modifying a firewall of the first VPN server to permit the VPN client to connect to the one or more common networks.
A system comprising:
- a memory device;
- and
- a processing device coupled to the memory device, the processing device to perform operations comprising:
- receiving, by a first virtual private network (VPN) server associated with a first set of one or more networks, a request of a VPN client to connect to a second set of one or more networks, wherein the request comprises:
- an identifier of the VPN client,
- an attestation of an access control server that the VPN client complies with a compliance profile required to access the second set of one or more networks, and
- a digital signature of the access control server;
- validating the digital signature of the access control server using a public key of the access control server;
- identifying one or more common networks each included in both the first set of one or more networks and the second set of one or more networks;
- and
- modifying a firewall of the first VPN server to permit the VPN client to connect to the one or more common networks.
A non-transitory computer-readable medium comprising instructions that, when executed by a processing device, cause the processing device to perform operations comprising:
- receiving, by a first virtual private network (VPN) server associated with a first set of one or more networks, a request of a VPN client to connect to a second set of one or more networks, wherein the request comprises:
- an identifier of the VPN client,
- an attestation of an access control server that the VPN client complies with a compliance profile required to access the second set of one or more networks, and
- a digital signature of the access control server;
- validating the digital signature of the access control server using a public key of the access control server;
- identifying one or more common networks each included in both the first set of one or more networks and the second set of one or more networks;
- and
- modifying a firewall of the first VPN server to permit the VPN client to connect to the one or more common networks.
Dependencies are inferred from the claim text.