Remote server isolation utilizing zero trust architecture
View Patent ↗A zero trust cloud environment provides access to a secure network, and secure network applications. The zero trust cloud environment performs authentication of a user account, and upon successful completion initiates a secure network application, such as an SSH session to a server in a secure network. The server is instructed to generate an isolated network namespace through which a virtual network interface is bridged to the default network namespace. A firewall of the default network namespace does not permit network traffic from the virtual network interface to pass if it is directed to an address of the secure network.
1 . A method comprising:
receiving a request to authenticate an identity from a client device, the identity including at least a unique identifier of a user;
receiving a request to access a cryptographically secure network application (CSNA) on a remote server through the zero trust cloud environment, the remote server deployed in a secure network environment, and having a default network namespace (DNN), wherein the request includes session credentials for logging in to the CSNA, and wherein the secure network environment is communicatively coupled with the zero trust cloud environment;
piping communication between the client device and the remote server through the zero trust cloud environment; and
configuring the remote server to:
generate an isolated network namespace (INN);
generate a bridge between the INN and the DNN;
assign a name from the INN to a virtual network interface (VNI); and
generate a new CSNA in the INN.
2 . The method of claim 1 , further comprising: configuring a DNN firewall of the remote server to drop data packets from the INN directed to the secure network environment.
3 . The method of claim 2 , further comprising: configuring the DNN firewall to forward data packets from the INN which are not directed to the secure network environment.
4 . The method of claim 1 , further comprising:
accessing a policy engine to determine a policy matching: the identity, the session credentials, and a combination thereof.
5 . The method of claim 4 , further comprising:
piping the communication based on the determined policy.
6 . The method of claim 1 , wherein the CSNA is an SSH session.
7 . The method of claim 1 , wherein the zero trust cloud environment includes any one of: a frontend CSNA server, an access portal server, a backend server, and any combination thereof.
8 . The method of claim 7 , wherein the backend server is configured to connect to a connector deployed in the secure network environment.
9 . The method of claim 7 , wherein the client device is configured to communicate with the frontend CSNA server.
10 . A non-transitory computer-readable medium comprising instructions executable by at least one processor to:
receive a request to authenticate an identity from a client device, the identity including at least a unique identifier of a user;
receive a request to access a cryptographically secure network application (CSNA) on a remote server through the zero trust cloud environment, the remote server deployed in a secure network environment, having a default network namespace (DNN), wherein the request includes session credentials for logging in to the CSNA, and wherein the secure network environment is communicatively coupled with the zero trust cloud environment;
pipe communication between the client device and the remote server through the zero trust cloud environment; and
configure the remote server to:
generate an isolated network namespace (INN);
generate a bridge between the INN and the DNN;
assign a name from the INN to a virtual network interface (VNI); and
generate a new CSNA in the INN.
11 . A system comprising:
a processing circuitry; and
a non-transitory computer-readable medium comprising instructions executable by the processing circuitry; to:
receive a request to authenticate an identity from a client device, the identity including at least a unique identifier of a user;
receive a request to access a cryptographically secure network application (CSNA) on a remote server through the zero trust cloud environment, the remote server deployed in a secure network environment, having a default network namespace (DNN), wherein the request includes session credentials for logging in to the CSNA, and wherein the secure network environment is communicatively coupled with the zero trust cloud environment;
pipe communication between the client device and the remote server through the zero trust cloud environment; and
configure the remote server to:
generate an isolated network namespace (INN);
generate a bridge between the INN and the DNN;
assign a name from the INN to a virtual network interface (VNI); and
generate a new CSNA in the INN.
12 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
configure a DNN firewall of the remote server to drop data packets from the INN directed to the secure network environment.
13 . The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
configure the DNN firewall to forward data packets from the INN which are not directed to the secure network environment.
14 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
access a policy engine to determine a policy matching: the identity, the session credentials, and a combination thereof.
15 . The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
pipe the communication based on the determined policy.
16 . The system of claim 11 , wherein the CSNA is an SSH session.
17 . The system of claim 11 , wherein the zero trust cloud environment includes any one of: a frontend CSNA server, an access portal server, a backend server, and any combination thereof.
18 . The system of claim 17 , wherein the backend server is configured to connect to a connector deployed in the secure network environment.
19 . The system of claim 17 , wherein the client device is configured to communicate with the frontend CSNA server.