Identity defined secure connect
Systems and methods for network security are provided. Various embodiments issue single use certificates for validating remote endpoints access to the private network. Some embodiments use a triage zone (or triage gateway) to which remote device can calls into using a static issued certificate. However, instead of granting complete access to the virtual private network, the use of this static certificate only grants access to the triage zone where further validation of the endpoint without any access to sensitive content on the private network. The endpoint can be connected to an ID manager within the triage zone. The endpoint can then send the username and password to the ID manager that can create a single use certificate (e.g., valid for a limited period of time). While valid, the single use certificate can be used by the remote device to gain access to the production zone using a VPN tunnel.
1. A system with multi-zoned security within a network, the system comprising:
a triage zone, an identification database, and a production zone logically or physically separate from the triage zone, wherein a set of protected resources can be accessed through the production zone but cannot be accessed through the triage zone, and wherein:
the triage zone is configured to receive an authentication package from a client device, the triage zone including:
a first identity manager to generate, upon successful validation of the authentication package, a production access package that includes an ephemeral token and a dynamic certificate with a common name set to expire at a specific date and time and transmit at least the ephemeral token and the dynamic certificate to the client device, wherein the ephemeral token and dynamic certificate are adapted to allow access to the production zone;
the identification database in communication with the first identity manager and configured to receive, from the first identity manager, information to update or create an entry based on the dynamic certificate; and
the production zone including:
a production zone gateway to establish a connection with the client device based on the dynamic certificate, ephemeral token, and a username; and
a second identity manager in communication with the identification database and the production zone gateway, the second identity manager to verify, by accessing the identification database, that the dynamic certificate provided by the client device is valid.
2. The system of claim 1 , wherein the triage zone further includes a triage gateway, and wherein the client device establishes a connection to the triage gateway using an issued static certificate.
3. The system of claim 1 , wherein the client device includes a security agent under control of a processor of the client device, the security agent including:
an identity defined secure connect component to develop a device profile based on hardware and software configurations of the client device; and
a virtual private networking component to establish a tunnel between the client device and the triage zone and transfer, via the tunnel, a fingerprint to be validated by the firstidentity manager.
4. The system of claim 1 , wherein an authentication package includes a username and password, device fingerprint, and previous ephemeral token.
5. The system of claim 1 , wherein first identity manager receives a device fingerprint in response to delivery of the ephemeral token to the client device.
6. The system of claim 5 , wherein the dynamic certificate is based, at least in part, on the device fingerprint.
7. The system of claim 5 , wherein the device fingerprint is based, at least in part, on a media access control address, universally unique identifier (UUID), central processing unit (CPU) computation time, CPU type, uptime, operating system version, memory type, memory amount, storage type, or storage partitions.
8. A method for multi-zoned security within a network, comprising:
providing a triage zone, an identification database, and a production zone logically or physically separate from the triage zone, wherein the triage zone includes a first identity manager, the production zone includes a production zone gateway and a second identity manager, and a set of protected resources can be accessed through the production zone but cannot be accessed through the triage zone;
receiving an authentication package from a client device at the triage zone;
generating by the first identity manager, upon successful validation of the authentication package, a production access package that includes an ephemeral token and a dynamic certificate with a common name set to expire at a specific date and time and transmit at least the ephemeral token and the dynamic certificate to the client device, wherein the ephemeral token and dynamic certificate are adapted to allow access to the production zone;
receiving, at the identification database, information from the first identity manager, wherein the information is adapted to update or create an entry based on the dynamic certificate;
establishing, by the production zone gateway, a connection with the client device based on the dynamic certificate, ephemeral token, and a username; and
verifying, by the second identity manager, the dynamic certificate provided by the client device is valid by accessing the identification database.
9. The method of claim 8 , wherein the triage zone further includes a triage gateway, and wherein the client device establishes a connection to the triage gateway using an issued static certificate.
10. The method of claim 8 , wherein the client device includes a security agent under control of a processor of the client device, the security agent including:
an identity defined secure connect component to develop a device profile based on hardware and software configurations of the client device; and
a virtual private networking component to establish a tunnel between the client device and the triage zone and transfer, via the tunnel, a fingerprint to be validated by the first identity manager.
11. The method of claim 8 , wherein an authentication package includes a username and password, device fingerprint, and previous ephemeral token.
12. The method of claim 8 , wherein first identity manager receives a device fingerprint in response to delivery of the ephemeral token to the client device.
13. The method of claim 12 , wherein the dynamic certificate is based, at least in part, on the device fingerprint.
14. The method of claim 12 , wherein the device fingerprint is based, at least in part, on a media access control address, universally unique identifier (UUID), central processing unit (CPU) computation time, CPU type, uptime, operating system version, memory type, memory amount, storage type, or storage partitions.
15. A non-transitory computer readable medium for multi-zoned security within a network, comprising instructions for:
providing a triage zone, an identification database, and a production zone logically or physically separate from the triage zone, wherein the triage zone includes a first identity manager, the production zone includes a production zone gateway and a second identity manager, and a set of protected resources can be accessed through the production zone but cannot be accessed through the triage zone;
receiving an authentication package from a client device at the triage zone;
generating by the first identity manager, upon successful validation of the authentication package, a production access package that includes an ephemeral token and a dynamic certificate with a common name set to expire at a specific date and time and transmit at least the ephemeral token and the dynamic certificate to the client device, wherein the ephemeral token and dynamic certificate are adapted to allow access to the production zone;
receiving, at the identification database, information from the first identity manager, wherein the information is adapted to update or create an entry based on the dynamic certificate;
establishing, by the production zone gateway, a connection with the client device based on the dynamic certificate, ephemeral token, and a username; and
verifying, by the second identity manager, the dynamic certificate provided by the client device is valid by accessing the identification database.
16. The non-transitory computer readable medium of claim 15 , wherein the triage zone further includes a triage gateway, and wherein the client device establishes a connection to the triage gateway using an issued static certificate.
17. The non-transitory computer readable medium of claim 15 , wherein the client device includes a security agent under control of a processor of the client device, the security agent including:
an identity defined secure connect component to develop a device profile based on hardware and software configurations of the client device; and
a virtual private networking component to establish a tunnel between the client device and the triage zone and transfer, via the tunnel, a fingerprint to be validated by the first identity manager.
18. The non-transitory computer readable medium of claim 15 , wherein an authentication package includes a username and password, device fingerprint, and previous ephemeral token.
19. The non-transitory computer readable medium of claim 15 , wherein first identity manager receives a device fingerprint in response to delivery of the ephemeral token to the client device.
20. The non-transitory computer readable medium of claim 19 , wherein the dynamic certificate is based, at least in part, on the device fingerprint.
21. The non-transitory computer readable medium of claim 19 , wherein the device fingerprint is based, at least in part, on a media access control address, universally unique identifier (UUID), central processing unit (CPU) computation time, CPU type, uptime, operating system version, memory type, memory amount, storage type, or storage partitions.