Identity defined secure connect
Systems and methods for network security are provided. Various embodiments issue single use certificates for validating remote endpoints access to the private network. Some embodiments use a triage zone (or triage gateway) to which remote device can calls into using a static issued certificate. However, instead of granting complete access to the virtual private network, the use of this static certificate only grants access to the triage zone where further validation of the endpoint without any access to sensitive content on the private network. The endpoint can be connected to an ID manager within the triage zone. The endpoint can then send the username and password to the ID manager that can create a single use certificate (e.g., valid for a limited period of time). While valid, the single use certificate can be used by the remote device to gain access to the production zone using a VPN tunnel.
1. A system for computer security, the system comprising:
a triage zone and a production zone logically or physically separate from the triage zone, wherein a set of protected resource can be accessed through the production zone but cannot be accessed through the triage zone, and wherein:
the triage zone is adapted to obtain an authentication request associated with a client device, the triage zone including:
an identity manager to, upon successful validation in association with the authentication request, generate an ephemeral token and enable an associated dynamic certificate set to expire at a specific time, and to create or update a stored entry based on the dynamic certificate, wherein the ephemeral token is adapted to be provided to the client device to allow access to the production zone, and not the triage zone, based on the associated dynamic certificate;
the production zone adapted to:
establish a connection with the client device based on the dynamic certificate, ephemeral token, and a username; and
verify, by accessing the stored entry, that the authentication request provided by the client device is valid.
2. The system of claim 1 , wherein the authentication request is verified using a common name associated with the dynamic certificate.
3. The system of claim 1 , wherein successful validation comprises validating a correct username and password, validating a last token or validating a fingerprint.
4. The system of claim 1 , wherein the client device establishes a connection to the triage zone using a static certificate and the ephemeral token.
5. The system of claim 1 , wherein the client device establishes a subsequent connection to the triage zone using a rolling token.
6. The system of claim 1 , wherein the rolling token is refreshed using an identity loop established with the first identity manager or the production zone.
7. The system of claim 1 , wherein verifying that the authentication request provided by the client is valid comprises verifying that a common name associated with the authentication request matches the stored entry and the dynamic certificate is enabled.
8. A method, for network security, comprising:
providing a triage zone and a production zone logically or physically separate from the triage zone, wherein a set of protected resource can be accessed through the production zone but cannot be accessed through the triage zone, and wherein:
the triage zone is adapted to obtain an authentication request associated with a client device, the triage zone including:
an identity manager to, upon successful validation in association with the authentication request, generate an ephemeral token and enable an associated dynamic certificate set to expire at a specific time, and to create or update a stored entry based on the dynamic certificate, wherein the ephemeral token is adapted to be provided to the client device to allow access to the production zone, and not the triage zone, based on the associated dynamic certificate;
wherein the production zone is adapted to:
establish a connection with the client device based on the dynamic certificate, ephemeral token, and a username; and
verify, by accessing the stored entry, that the authentication request provided by the client device is valid.
9. The method of claim 8 , wherein the authentication request is verified using a common name associated with the dynamic certificate.
10. The method of claim 8 , wherein successful validation comprises validating a correct username and password, validating a last token or validating a fingerprint.
11. The method of claim 8 , wherein the client device establishes a connection to the triage zone using a static certificate and the ephemeral token.
12. The method of claim 8 , wherein the client device establishes a subsequent connection to the triage zone using a rolling token.
13. The method of claim 8 , wherein the rolling token is refreshed using an identity loop established with the first identity manager or the production zone.
14. The method of claim 8 , wherein verifying that the authentication request provided by the client is valid comprises verifying that a common name associated with the authentication request matches the stored entry and the dynamic certificate is enabled.
15. A non-transitory computer readable medium, comprising instructions for:
providing a triage zone and a production zone logically or physically separate from the triage zone, wherein a set of protected resource can be accessed through the production zone but cannot be accessed through the triage zone, and wherein:
the triage zone is adapted to obtain an authentication request associated with a client device, the triage zone including:
an identity manager to, upon successful validation in association with the authentication request, generate an ephemeral token and enable an associated dynamic certificate set to expire at a specific time, and to create or update a stored entry based on the dynamic certificate, wherein the ephemeral token is adapted to be provided to the client device to allow access to the production zone, and not the triage zone, based on the associated dynamic certificate;
wherein the production zone is adapted to:
establish a connection with the client device based on the dynamic certificate, ephemeral token, and a username; and
verify, by accessing the stored entry, that the authentication request provided by the client device is valid.
16. The non-transitory computer readable medium of claim 15 , wherein the authentication request is verified using a common name associated with the dynamic certificate.
17. The non-transitory computer readable medium of claim 15 , wherein successful validation comprises validating a correct username and password, validating a last token or validating a fingerprint.
18. The non-transitory computer readable medium of claim 15 , wherein the client device establishes a connection to the triage zone using a static certificate and the ephemeral token.
19. The non-transitory computer readable medium of claim 15 , wherein the client device establishes a subsequent connection to the triage zone using a rolling token.
20. The non-transitory computer readable medium of claim 15 , wherein the rolling token is refreshed using an identity loop established with the first identity manager or the production zone.
21. The non-transitory computer readable medium of claim 15 , wherein verifying that the authentication request provided by the client is valid comprises verifying that a common name associated with the authentication request matches the stored entry and the dynamic certificate is enabled.