Cloud-based zero trust network access service
Infrastructure for zero trust network access (ZTNA) is deployed as a cloud-based service remotely from a customer premises where user applications are hosted. By connecting an appliance on the customer premises to the cloud-based service through a secure tunnel or the like, an application hosted on the customer premises can then be accessed externally as a ZTNA application without the customer premises opening a firewall to public networks or otherwise exposing potential attack surfaces to the customer premises.
1. A system for zero trust network access to a customer application comprising:
an application hosted on a customer premises;
a threat management facility configured to manage security for the customer premises;
a cloud computing platform hosted remotely from the customer premises, the cloud computing platform configured to provide a cloud-based data plane for zero trust network access to the application by a device operated by a user associated with the customer premises, the cloud computing platform including:
a service proxy configured to couple the device to the application hosted on the customer premises,
a reverse proxy server connected to the service proxy, the reverse proxy server configured to securely connect to the customer premises, and
an authentication server securely coupled to the threat management facility and configured to create a secure tunnel to the customer premises by authenticating a secure connection to the reverse proxy server; and
a zero trust network access appliance hosted on the customer premises, the zero trust network access appliance configured to initiate the secure connection to the reverse proxy server, and the zero trust network access appliance configured to operatively couple the application hosted on the customer premises through the cloud-based data plane to the device operated by the user.
2. The system of claim 1 , wherein the zero trust network access appliance is configured to authenticate the user for access to the application.
3. The system of claim 2 , wherein the zero trust network access appliance is configured to authenticate the user with a username and a password managed by the customer premises.
4. The system of claim 2 , wherein the zero trust network access appliance is configured to authenticate the user with two or more authentication factors.
5. The system of claim 2 , wherein the zero trust network access appliance authenticates the user with a third party identity management platform external to the customer premises.
6. The system of claim 1 , wherein the threat management facility is hosted remotely from the customer premises and coupled in a secure communicating relationship with the customer premises.
7. The system of claim 1 , wherein the threat management facility provides a control plane for zero trust network access to the application hosted on the customer premises.
8. The system of claim 1 , wherein the zero trust network access appliance is configured to:
make an outbound connection to the reverse proxy server of the cloud computing platform;
authenticate to the reverse proxy server with the authentication server;
establish the secure tunnel between the zero trust network access appliance and the reverse proxy server; and
use the secure tunnel to provide zero trust network access to the application hosted on the customer premises by the user of the device.
9. The system of claim 1 , wherein the threat management facility is configured to provide a user interface for administrative configuration of the zero trust network access appliance.
10. The system of claim 9 , wherein the user interface for administrative configuration is configured to receive a Domain name system record identifying an address for the cloud computing platform.
11. The system of claim 9 , wherein the zero trust network access appliance is user-configurable through the threat management facility to operate as either (a) a zero trust network access gateway exposed to a public network through a firewall for the customer premises or (b) a zero trust network access connector coupled through the secure tunnel to the cloud-based data plane hosted on the cloud computing platform.
12. The system of claim 1 , wherein the application is an agentless application.
13. The system of claim 1 , wherein the application is an agent-based application.
14. The system of claim 1 , wherein the cloud computing platform provides a network address for zero trust network access to the application from a public network.
15. The system of claim 1 , wherein the cloud computing platform provides a fully qualified domain name for zero trust network access to the application.
16. The system of claim 1 , further comprising a connector configured to selectively couple the application to external users through a firewall for the customer premises and a secure tunnel to the cloud-based data plane, wherein the connector authenticates the user accessing the application through the secure tunnel.
17. The system of claim 1 , wherein the threat management facility is hosted remotely from the customer premises and coupled in a secure communicating relationship with the customer premises and the cloud computing platform.
18. The system of claim 1 , wherein the zero trust network access appliance is configured to authenticate the user with at least one of a biometric authentication factor, a hardware-based authentication factor, or a software-based authentication factor.
19. The system of claim 1 , wherein the zero trust network access appliance is configured to authenticate the user with a heartbeat from a user device.
20. The system of claim 1 , wherein the cloud computing platform is configured to authenticate the user for zero trust network access to the application.