Granted Patent B2

US 12,355,770 · App. 18/740,622 · Granted Jul 8, 2025

Inventors: Carlos Ulderico Cirello Filho (South San Francisco, CA); Philip D. Hassey (Rye, CO); Kevin David Jamieson (North Vancouver, CA); Justin Allan McCarthy (Redwood City, CA); Amol Kabe (Palo Alto, CA); Karim Fanous (Seattle, WA)

Assignee: strongDM, Inc.

H04L63/10G06F9/45558H04L63/029H04L63/08H04L63/1425H04L63/20G06F2009/45587G06F2009/45595

Abstract

Claims (109)

1. A method for managing access to network resources in a network using one or more processors that are configured to execute instructions, wherein the execution of the instructions enables performance of actions, comprising:

determining a first mesh agent on a logical edge of an overlay network that is configured to provide a client with access via a secure tunnel provided by the overlay network that includes a plurality of mesh agents;

determining a route for a connection in the overlay network for one or more requests to access a resource from the client that is received by the first mesh agent, wherein a last mesh agent in the route is configured to provide access to the resource over the connection;

employing the first mesh agent to determine an identity and an activity associated with the one or more requests based on network traffic, wherein the identity corresponds to an entity that is authenticated to access the overlay network and the resource, and wherein the activity corresponds to one or more of an application or an application protocol that is operative or available in the overlay network;

determining a policy container that is associated with the activity and based on one or more characteristics of the one or more requests by performance of further actions, including:

determining the application protocol associated with the one or more requests based on a payload included in the one or more requests;

parsing the payload based on the application protocol;

determining a portion of the one or more policies associated with the parsed payload based on the identity and one or more of a protocol fragment, a regular expression, or a rule; and

executing one or more actions associated with the portion of the one or more policies to validate the one or more requests;

wherein the policy container includes one or more policies that are associated with a declared definition for relevancy of the activity that is based on one or more of a local requirement or a local circumstance; and

distributing the policy container to the plurality of mesh agents for validation of the one or more requests based on the one or more policies included in the policy container associated with the activity, wherein the one or more validated requests are forwarded to the resource and one or more invalidated requests are discarded, and wherein persistence of the connection is maintained during the validation of the one or more requests; and

updating the policy container with an association with another activity that is associated with one or more other requests, wherein the updated policy container is selectively distributed to the plurality of mesh agents to locally cause further actions, including:

determining one or more updated policies based on the updated policy container and another declared definition for relevancy of the other activity that is based on one or more of another local requirement or another local circumstance; and

validating the one or more other requests based on the one or more updated policies included in the updated policy container, wherein the one or more other validated requests are forwarded to the resource via the overlay network.

2. The method of claim 1 , further comprising:

updating the policy container at an infrastructure security computer that is separate from the first mesh agent and separate from the resource based on one or more of a rule or a user input; and

communicating the updated policy container to the first mesh agent and each of the plurality of mesh agents.

3. The method of claim 1 , wherein authentication of the identity, further comprises:

communicating one or more credentials associated with the entity that corresponds to the identity to an infrastructure security computer associated with the overlay network; and

verifying that the one or more credentials are associated with the entity and with a privilege to access the overlay network and another privilege to access the resource.

4. The method of claim 1 , wherein validating the one or more requests, further comprises:

determining one or more credentials associated with the entity, wherein the one or more credentials enable the entity to access the overlay network;

determining a set of acceptable credentials associated with the one or more policies; and

in response to the one or more credentials being absent from the set of acceptable credentials, invalidating the one or more requests.

5. A network computer for managing access to a plurality of network resources, comprising:

a memory that stores at least instructions; and

one or more processors that execute instructions that are configured to cause actions, including:

determining a first mesh agent on a logical edge of an overlay network that is configured to provide a client with access via a secure tunnel provided by the overlay network that includes a plurality of mesh agents;

determining a route for a connection in the overlay network for one or more requests to access a resource from the client that is received by the first mesh agent, wherein a last mesh agent in the route is configured to provide access to the resource over the connection;

employing the first mesh agent to determine an identity and an activity associated with the one or more requests based on network traffic, wherein the identity corresponds to an entity that is authenticated to access the overlay network and the resource, and wherein the activity corresponds to one or more of an application or an application protocol that is operative or available in the overlay network;

determining a policy container that is associated with the activity and based on one or more characteristics of the one or more requests by performance of further actions, including:

determining the application protocol associated with the one or more requests based on a payload included in the one or more requests;

parsing the payload based on the application protocol;

determining a portion of the one or more policies associated with the parsed payload based on the identity and one or more of a protocol fragment, a regular expression, or a rule; and

executing one or more actions associated with the portion of the one or more policies to validate the one or more requests;

wherein the policy container includes one or more policies that are associated with a declared definition for relevancy of the activity that is based on one or more of a local requirement or a local circumstance; and

distributing the policy container to the plurality of mesh agents for validation of the one or more requests based on the one or more policies included in the policy container associated with the activity, wherein the one or more validated requests are forwarded to the resource and one or more invalidated requests are discarded, and wherein persistence of the connection is maintained during the validation of the one or more requests; and

updating the policy container with an association with another activity that is associated with one or more other requests, wherein the updated policy container is selectively distributed to the plurality of mesh agents to locally cause further actions, including:

determining one or more updated policies based on the updated policy container and another declared definition for relevancy of the other activity that is based on one or more of another local requirement or another local circumstance; and

validating the one or more other requests based on the one or more updated policies included in the updated policy container, wherein the one or more other validated requests are forwarded to the resource via the overlay network.

6. The network computer of claim 5 , wherein the one or more processors execute instructions that are configured to cause actions, further comprising:

updating the policy container at an infrastructure security computer that is separate from the first mesh agent and separate from the resource based on one or more of a rule or a user input; and

communicating the updated policy container to the first mesh agent and each of the plurality of mesh agents.

7. The network computer of claim 5 , wherein authentication of the identity, further comprises:

communicating one or more credentials associated with the entity that corresponds to the identity to an infrastructure security computer associated with the overlay network; and

verifying that the one or more credentials are associated with the entity and with a privilege to access the overlay network and another privilege to access the resource.

8. The network computer of claim 5 , wherein validating the one or more requests, further comprises:

determining one or more credentials associated with the entity, wherein the one or more credentials enable the entity to access the overlay network;

determining a set of acceptable credentials associated with the one or more policies; and

in response to the one or more credentials being absent from the set of acceptable credentials, invalidating the one or more requests.

9. A processor readable non-transitory storage media that includes instructions configured for managing access to a plurality of network resources over a network, wherein execution of the instructions by one or more processors on one or more network computers performs actions, comprising:

determining a first mesh agent on a logical edge of an overlay network that is configured to provide a client with access via a secure tunnel provided by the overlay network that includes a plurality of mesh agents;

determining a route for a connection in the overlay network for one or more requests to access a resource from the client that is received by the first mesh agent, wherein a last mesh agent in the route is configured to provide access to the resource over the connection;

employing the first mesh agent to determine an identity and an activity associated with the one or more requests based on network traffic, wherein the identity corresponds to an entity that is authenticated to access the overlay network and the resource, and wherein the activity corresponds to one or more of an application or an application protocol that is operative or available in the overlay network;

determining a policy container that is associated with the activity and based on one or more characteristics of the one or more requests by performance of further actions, including:

determining the application protocol associated with the one or more requests based on a payload included in the one or more requests;

parsing the payload based on the application protocol;

determining a portion of the one or more policies associated with the parsed payload based on the identity and one or more of a protocol fragment, a regular expression, or a rule; and

executing one or more actions associated with the portion of the one or more policies to validate the one or more requests; wherein the policy container includes one or more policies that are associated with a declared definition for relevancy of the activity that is based on one or more of a local requirement or a local circumstance; and

distributing the policy container to the plurality of mesh agents for validation of the one or more requests based on the one or more policies included in the policy container associated with the activity, wherein the one or more validated requests are forwarded to the resource and one or more invalidated requests are discarded, and wherein persistence of the connection is maintained during the validation of the one or more requests; and

updating the policy container with an association with another activity that is associated with one or more other requests, wherein the updated policy container is selectively distributed to the plurality of mesh agents to locally cause further actions, including:

determining one or more updated policies based on the updated policy container and another declared definition for relevancy of the other activity that is based on one or more of another local requirement or another local circumstance; and

validating the one or more other requests based on the one or more updated policies included in the updated policy container, wherein the one or more other validated requests are forwarded to the resource via the overlay network.

10. The media of claim 9 , wherein determining the policy container, further comprises:

determining the application protocol associated with the one or more requests based on a payload included in the one or more requests;

parsing the payload based on the application protocol;

determining a portion of the one or more policies associated with the parsed payload based on the identity and one or more of a protocol fragment, a regular expression, or a rule; and

executing one or more actions associated with the portion of the one or more policies to validate the one or more requests.

11. The media of claim 9 , further comprising:

updating the policy container at an infrastructure security computer that is separate from the first mesh agent and separate from the resource based on one or more of a rule or a user input; and

communicating the updated policy container to the first mesh agent and each of the plurality of mesh agents.

12. The media of claim 9 , wherein authentication of the identity, further comprises:

communicating one or more credentials associated with the entity that corresponds to the identity to an infrastructure security computer associated with the overlay network; and

verifying that the one or more credentials are associated with the entity and with a privilege to access the overlay network and another privilege to access the resource.

13. The media of claim 9 , wherein validating the one or more requests, further comprises:

determining one or more credentials associated with the entity, wherein the one or more credentials enable the entity to access the overlay network;

determining a set of acceptable credentials associated with the one or more policies; and

in response to the one or more credentials being absent from the set of acceptable credentials, invalidating the one or more requests.

14. A system for managing access to network resources, comprising:

a network computer, comprising:

a memory that stores at least instructions; and

one or more processors that execute instructions that are configured to cause actions, including:

determining a first mesh agent on a logical edge of an overlay network that is configured to provide a client with access via a secure tunnel provided by the overlay network that includes a plurality of mesh agents;

determining a route for a connection in the overlay network for one or more requests to access a resource from the client that is received by the first mesh agent, wherein a last mesh agent in the route is configured to provide access to the resource over the connection;

employing the first mesh agent to determine an identity and an activity associated with the one or more requests based on network traffic, wherein the identity corresponds to an entity that is authenticated to access the overlay network and the resource, and wherein the activity corresponds to one or more of an application or an application protocol that is operative or available in the overlay network;

determining a policy container that is associated with the activity and based on one or more characteristics of the one or more requests by performance of further actions, including:

determining the application protocol associated with the one or more requests based on a payload included in the one or more requests;

parsing the payload based on the application protocol;

determining a portion of the one or more policies associated with the parsed payload based on the identity and one or more of a protocol fragment, a regular expression, or a rule; and

executing one or more actions associated with the portion of the one or more policies to validate the one or more requests; wherein the policy container includes one or more policies that are associated with a declared definition for relevancy of the activity that is based on one or more of a local requirement or a local circumstance; and

distributing the policy container to the plurality of mesh agents for validation of the one or more requests based on the one or more policies included in the policy container associated with the activity, wherein the one or more validated requests are forwarded to the resource and one or more invalidated requests are discarded, and wherein persistence of the connection is maintained during the validation of the one or more requests; and

updating the policy container with an association with another activity that is associated with one or more other requests, wherein the updated policy container is selectively distributed to the plurality of mesh agents to locally cause further actions, including:

determining one or more updated policies based on the updated policy container and another declared definition for relevancy of the other activity that is based on one or more of another local requirement or another local circumstance; and

validating the one or more other requests based on the one or more updated policies included in the updated policy container, wherein the one or more other validated requests are forwarded to the resource via the overlay network.

15. The system of claim 14 , wherein determining the policy container, further comprises:

determining the application protocol associated with the one or more requests based on a payload included in the one or more requests;

parsing the payload based on the application protocol;

determining a portion of the one or more policies associated with the parsed payload based on the identity and one or more of a protocol fragment, a regular expression, or a rule; and

executing one or more actions associated with the portion of the one or more policies to validate the one or more requests.

16. The system of claim 14 , wherein the one or more processors of the network computer execute instructions that are configured to cause actions, further comprising:

updating the policy container based on one or more of a rule or a user input; and

communicating the updated policy container to the first mesh agent and each of the plurality of mesh agents.

17. The system of claim 14 , wherein authentication of the identity, further comprises:

communicating one or more credentials associated with the entity that corresponds to the identity to an infrastructure security computer associated with the overlay network; and

verifying that the one or more credentials are associated with the entity and with a privilege to access the overlay network and another privilege to access the resource.

18. The system of claim 14 , wherein validating the one or more requests, further comprises:

determining one or more credentials associated with the entity, wherein the one or more credentials enable the entity to access the overlay network;

determining a set of acceptable credentials associated with the one or more policies; and

in response to the one or more credentials being absent from the set of acceptable credentials, invalidating the one or more requests.

Assignments (2)

Continuity (2)

References Cited (400)

Cited By (4)

US 12,432,242 US 12,603,921 US 12,670,246 US 12,695,793