Policy based privileged remote access in zero trust private networks
Systems and methods for policy based privileged remote access in zero trust private networks. Various embodiments include receiving a request to an end system; determining available end systems based on one or more criteria associated with the request, wherein the one or more criteria are analyzed based on policy; and providing access to the end system based on the one or more criteria, wherein the access includes remote pixel rendering protocols integrated with a zero trust architecture.
1 . A method comprising steps of:
receiving a request to an end system;
determining available end systems based on one or more criteria associated with the request, wherein the one or more criteria are analyzed based on policy; and
providing access to the end system based on the one or more criteria, wherein the access includes remote pixel rendering protocols integrated with a zero trust architecture, wherein the remote pixel rendering protocols establish connectivity dynamically through a private access connector and an exporter module implemented on a server or application connector configured to perform a handshake identifying a specific remote console or desktop session associated with the requested end system based on zero trust policies evaluating real-time context comprising user identity, client security posture, and trust level of the end user network, wherein the handshake directly specifies connectivity information including hostname, IP address, and port dynamically obtained from private access configurations, wherein the handshake further comprises transmitting a connect instruction establishing a remote desktop rendering session through the private access connector, and verifying a fingerprint of a certificate or public key of the end system prior to completing the remote pixel rendering session.
2 . The method of claim 1 , wherein the end system is an Operational Technology (OT) system.
3 . The method of claim 1 , wherein the dynamically established connection to the end system is one of a Secure Shell (SSH) connection, a Remote Desktop Protocol (RDP) connection, and a Virtual Network Computing (VNC) connection, wherein for the RDP connection the handshake is proxied through the private access connector and includes transmitting a browser-native remote desktop rendering connect instruction compliant with an HTML5-based remote pixel rendering protocol to specify a hostname, IP address, and port retrieved from zero-trust private access configurations.
4 . The method of claim 3 , wherein the steps further include verifying an end system certificate or public key by calculating a fingerprint and checking that it equals an expected fingerprint prior to allowing the dynamically established connection.
5 . The method of claim 1 , wherein responsive to the end system being accessed for a first time, the steps further include performing initial discovery of a fingerprint of a public key or certificate associated with the end system.
6 . The method of claim 5 , wherein the fingerprint is added to a database, thereby allowing the end system to be verified automatically based on the stored fingerprint during subsequent connections.
7 . The method of claim 1 , wherein the steps include utilizing any of control groups and process priorities to reduce traffic load.
8 . The method of claim 1 , wherein the steps further include recording sessions associated with the access.
9 . A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:
receiving a request to an end system;
determining available end systems based on one or more criteria associated with the request, wherein the one or more criteria are analyzed based on policy; and
providing access to the end system based on the one or more criteria, wherein the access includes remote pixel rendering protocols integrated with a zero trust architecture, wherein the remote pixel rendering protocols establish connectivity dynamically through a private access connector and an exporter module implemented on a server or application connector configured to perform a handshake identifying a specific remote console or desktop session associated with the requested end system based on zero trust policies evaluating real-time context comprising user identity, client security posture, and trust level of the end user network, wherein the handshake directly specifies connectivity information including hostname, IP address, and port dynamically obtained from private access configurations, wherein the handshake further comprises transmitting a connect instruction establishing a remote desktop rendering session through the private access connector, and verifying a fingerprint of a certificate or public key of the end system prior to completing the remote pixel rendering session.
10 . The non-transitory computer-readable medium of claim 9 , wherein the end system is an Operational Technology (OT) system.
11 . The non-transitory computer-readable medium of claim 9 , wherein the dynamically established connection to the end system is one of a Secure Shell (SSH) connection, a Remote Desktop Protocol (RDP) connection, and a Virtual Network Computing (VNC) connection.
12 . The non-transitory computer-readable medium of claim 11 , wherein the steps further include verifying an end system certificate or public key by calculating a fingerprint and checking that it equals an expected fingerprint prior to allowing the dynamically established connection.
13 . The non-transitory computer-readable medium of claim 9 , wherein responsive to the end system being accessed for a first time, the steps further include performing initial discovery of a fingerprint of a public key or certificate associated with the end system.
14 . The non-transitory computer-readable medium of claim 13 , wherein the fingerprint is added to a database, thereby allowing the end system to be verified automatically based on the stored fingerprint during subsequent connections.
15 . The non-transitory computer-readable medium of claim 9 , wherein the steps include utilizing any of control groups and process priorities to reduce traffic load.
16 . The non-transitory computer-readable medium of claim 9 , wherein the steps further include recording sessions associated with the access.
17 . A cloud-based system comprising:
one or more processors and memory storing instructions that, when executed, cause the one or more processors to:
receive a request to an end system;
determine available end systems based on one or more criteria associated with the request, wherein the one or more criteria are analyzed based on policy; and
provide access to the end system based on the one or more criteria, wherein the access includes remote pixel rendering protocols integrated with a zero trust architecture, wherein the remote pixel rendering protocols establish connectivity dynamically through a private access connector and an exporter module implemented on a server application connector configured to perform a handshake identifying a specific remote console or desktop session associated with the requested end system based on zero trust policies evaluating real-time context comprising user identity, client security posture, and trust level of the end user network, wherein the handshake directly specifies connectivity information including hostname, IP address, and port dynamically obtained from private access configurations, wherein the handshake further comprises transmitting a connect instruction establishing a remote desktop rendering session through the private access connector, and verifying a fingerprint of a certificate or public key of the end system prior to completing the remote pixel rendering session.
18 . The cloud-based system of claim 17 , wherein the end system is an Operational Technology (OT) system.
19 . The cloud-based system of claim 17 , wherein the dynamically established connection to the end system is one of a Secure Shell (SSH) connection, a Remote Desktop Protocol (RDP) connection, and a Virtual Network Computing (VNC) connection.
20 . The cloud-based system of claim 19 , wherein the instructions further cause the one or more processors to verify an end system certificate or public key by calculating a fingerprint and checking that it equals an expected fingerprint prior to allowing the dynamically established connection.