US 2023/0403304 A1Published application

Testing Network Communication Within a Zero Trust Security Model

AssigneeT-Mobile Innovations LLC

InventorsMarouane Balmakhtar, Serge Manning, Greg Schumacher

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method of testing a communication system implementing a zero trust architecture. The method comprises sending a request by a test equipment platform to access a microsegment to a policy enforcement point (PEP); sending an authorization request by the PEP to a policy decision point (PDP); authorizing access of the test equipment platform to the microsegment by the PDP; sending authorization of access of the test equipment platform to the microsegment by the PDP to the PEP; establishing a secure tunnel by the PEP between the test equipment platform and the microsegment; sending a command to provide test data by the test equipment platform via the secure tunnel to a probe in the microsegment; analyzing the test data by the test equipment platform; and producing a test result by the test equipment platform based on analyzing the test data.

Claims20

Dependent claims

A method of testing a communication system implementing a zero trust architecture, comprising:

sending a first request by a test equipment platform to access a first microsegment to a first policy enforcement point (PEP);
sending a first authorization request by the first PEP to a policy decision point (PDP);
in response to the first authorization request, requesting attributes associated with the test equipment platform by the PDP;
based on attributes associated with the test equipment platform received by the PDP, authorizing a first access level of the test equipment platform to the first microsegment by the PDP;
sending authorization of the first access level of the test equipment platform to the first microsegment by the PDP to the first PEP;
in response to the authorization of the first access level of the test equipment platform to the first microsegment, establishing a first secure tunnel by the first PEP between the test equipment platform and the first microsegment;
sending a second request by the test equipment platform to access a second microsegment to a second PEP;
sending a second authorization request by the second PEP to the PDP;
based on attributes associated with the test equipment platform received by the PDP, authorizing a second access level of the test equipment platform to the second microsegment by the PDP;
sending authorization of the second access level of the test equipment platform to the second microsegment by the PDP to the second PEP;
in response to the authorization of the second access level of the test equipment platform to the second microsegment, establishing a second secure tunnel by the second PEP between the test equipment platform and the second microsegment;
sending a first command by the test equipment platform to perform a first testing activity via the first secure tunnel to a first probe located in the first microsegment;
enforcing that the first command is consistent with the first access level by the first PEP;
sending the first command by the first PEP to the first probe;
sending a second command by the test platform to perform a second testing activity via the second secure tunnel to a second probe located in the second microsegment;
enforcing that the second command is consistent with the second access level by the second PEP;
sending the second command by the second PEP to the second probe;
sending first test data associated with the first testing activity by the first probe via the first secure tunnel to the test equipment platform;
sending second test data associated with the second testing activity by the second probe via the second secure tunnel to the test equipment platform;
analyzing the first test data and the second test data by the test equipment platform;
and
producing a test result by the test equipment platform based on the analyzing.

19 more elements

A communication system implementing a zero trust architecture, comprising:

a policy decision point (PDP);
a plurality of microsegments of the communication system, each microsegment comprising at least one execution platform and at least one test probe, wherein the at least one test probe is authorized to conduct unencrypted communication with the at least one execution platform;
a plurality of policy enforcement points (PEPs), each PEP associated with one of the plurality of microsegments, wherein each PEP is configured to enforce authorization determinations received from the PDP on communication entering and exiting its associated microsegment and to enforce that authorized communication entering and exiting its associated microsegment takes place via a secure tunnel;
a test equipment platform comprising
a processor,
a non-transitory memory, and
a testing application stored in the non-transitory memory that, when executed by the processor, establishes a secure tunnel with one of the plurality of PEPs, communicates via the secure tunnel with the at least one test probe within the microsegment associated with the one PEP to obtain information about the execution platform in the microsegment, analyzes the information obtained about the execution, and produces a test result based on analyzing the information.

4 more elements

A method of testing a communication system implementing a zero trust architecture, comprising:

sending a first request by a test equipment platform to access a first microsegment to a first policy enforcement point (PEP);
sending a first authorization request by the first PEP to a policy decision point (PDP);
authorizing access of the test equipment platform to the first microsegment by the PDP;
sending authorization of access of the test equipment platform to the first microsegment by the PDP to the first PEP;
in response to the authorization of access of the test equipment platform to the first microsegment, establishing a first secure tunnel by the first PEP between the test equipment platform and the first microsegment;
sending a command to provide test data by the test equipment platform via the first secure tunnel to a first probe in the first microsegment;
receiving first test data by the test equipment platform via the first secure tunnel from the first probe;
analyzing the first test data by the test equipment platform;
and
producing a first test result by the test equipment platform based on analyzing the first test data.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/836,987Filed 9 Jun 2022
Published: 14 Dec 2023
Term ends: Not estimatedThe source records don’t support an estimate.

Classification4 codes

H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general
H04L 63/10
Network architectures or network communication protocols for network security: for controlling access to devices or network resources
H04L 63/105
For controlling access to devices or network resources: multiple levels of security
H04L
Digital communication