Zero trust network access connector for customer premises
AssigneeSophos Limited
InventorsVenkata Suresh Reddy Obulareddy, Joju Francis Olakengil
Life of this patent
Estimating the term…
Abstract
A zero trust network access (ZTNA) system provides secure access to applications hosted on a customer premises. The ZTNA system is modified to facilitate distributed and/or cloud-based deployments of components for a control plane and a data plane that cooperate to support a network-accessible front end for the customer's locally hosted applications. A customer-side connector can be further simplified for deployment by moving ZTNA components for, e.g., secure tunneling, authorization, and authentication into the cloud-based infrastructure, and by managing deployment and configuration of the connector through a threat management facility for the customer premises.
Claims20
A system comprising:
- a network component deployed on a customer premises, the network component managing access to the customer premises from an external network;
- a threat management facility configured to:
- remotely provide security services for the customer premises,
- remotely manage the network component on the customer premises through a secure connection, and
- provide a web based user interface for a user to manage the network component through the threat management facility;
- an application hosted on the customer premises;
- a data plane for zero trust network access, wherein:
- the data plane is deployed in a cloud platform external to the customer premises,
- the cloud platform includes authentication components and authorization components for zero trust network access through the data plane, and
- the cloud platform includes tunnel components for creating secure tunnels for zero trust network access traffic;
- and
- a connector, wherein:
- the connector is deployed as a binary executing on the network component,
- the threat management facility associates the connector with the network component,
- the threat management facility provides management of the connector to the user through the web based user interface of the threat management facility,
- the connector is configured to communicate with the data plane through a secure tunnel created using the tunnel components of the cloud platform,
- the connector is configured to manage zero trust network access to the application through the data plane using the authentication components and the authorization components of the cloud platform, and
- the connector is further configured to controllably support zero trust network access to the application through the network component.
A computer program product comprising computer executable code embodied in non-transitory computer readable media that, when executing on one or more computing devices, causes the one or more computing devices to perform the steps of:
- storing authentication components and authorization components for a data plane of a cloud-based zero trust network access service on a cloud platform;
- storing a connector for zero trust network access on a customer premises;
- coupling the connector to a threat management facility;
- receiving configuration information for the connector from the threat management facility, the configuration information identifying an application on the customer premises to offer as a zero trust network access service, wherein the data plane on the cloud platform supports agentless application access to the application and agent-based application access to the application;
- coupling the connector through a secure tunnel to the cloud platform;
- coupling the connector to the application on the customer premises;
- and
- managing zero trust network access to the application by a user through the data plane by authorizing and authenticating the user for the application with the authentication components and the authorization components executing on the cloud platform.
A method comprising:
- storing an authentication component and an authorization component for a data plane of a cloud-based zero trust network access service on a cloud platform;
- storing a connector for zero trust network access on a customer premises;
- executing the connector on a firewall on the customer premises, wherein the connector periodically transmits a heartbeat to a threat management facility, the heartbeat containing health status information for the firewall;
- coupling the connector to the threat management facility for the customer premises;
- receiving configuration information for the connector from the threat management facility, the configuration information identifying an application on the customer premises to offer as a zero trust network access service;
- coupling the connector to a cloud-based data plane for the zero trust network access service;
- coupling the connector to the application on the customer premises;
- and
- managing zero trust network access to the application by a user through the cloud-based data plane by authorizing and authenticating the user for the application with the authentication component and the authorization component configured through the threat management facility and executing in the cloud-based data plane.
Dependencies are inferred from the claim text.