Continuous universal trust architecture and method
A method for continuous “universal” trust (CUT) leverages a core network that manages authentication set-up and continuous trust logic for entities that use the network. During communications through the network, and regardless of source or destination, CUT logic is applied to each entity independently, and without requiring authentication to be done directly between entities that desire to communicate with one another. In a typical implementation involving a user and a service, CUT authenticates both user and service independently. To facilitate both initial and continuous authentication, a CUT engine applies authentication factors to an entity, independently of factors that may be applied by the CUT entity to any other entity that uses the network. In this solution, the CUT engine continues to authenticate and maintain trust between each entity and the core network, irrespective of the underlying communication to be carried out or occurring between the entities themselves.
1. A method of continuous and universal trust in a network operating environment, comprising:
configuring a secure communication path between each of a set of first entities, and a second entity, wherein each of the set of first entities and the second entity are each authenticated independently and separately from one another and all traffic and data flows between a first entity and the second entity pass through the secure communication path;
during a communication session originating by each first entity and directed to the second entity:
determining whether an authentication requirement associated with a permitted access to a protected resource associated with the second entity has been met, wherein the authentication requirement is specified in a security policy associated with a trust circle, and wherein the set of first entities comprise a trust circle;
upon a determination that the authentication requirement has been met, permitting the first entity to access the protected resource associated with the second entity via the secure communication path;
based on one or more authentication factors and other data, determining whether the authentication requirement should be modified;
upon a determination that the authentication factor should be modified, adjusting the authentication requirement; and
enforcing the adjusted authentication requirement for at least some remaining portion of the communication session;
wherein for, at least first and second first entities, authentication requirements are dynamically adjusted during the communication sessions with the second entity such that the first and second first entities have differing authentication requirements in their respective communication sessions.
2. The method as described in claim 1 , wherein the trust circle is associated with a security policy.
3. The method as described in claim 1 , further including registering each first entity of the set of first entities in the trust circle.
4. The method as described in claim 1 , wherein the authentication factors include one or more ambient authentication factors, one or more active authentication factors, and combinations thereof.
5. The method as described in claim 1 , wherein adjusting the authentication requirement is one of: maintaining the authentication requirement, an authentication step-up, and an authentication step-down.
6. The method as described in claim 1 , provided as-a-service.
7. The method as described in claim 1 , wherein the other data comprises telemetry collected in association with the first entity.
8. The method as described in claim 1 , wherein the traffic and data flows include a request for the protected resource, and a response to the request.
9. The method as described in claim 1 , wherein the request and the response are encrypted end-to-end through the secure communication path.
10. A computing infrastructure for continuous and universal trust in a network operating environment, comprising:
at least first and second first entities;
a second entity distinct from the at least first and second first entities; and
a core network configured to establish and maintain a secure communication path between the first or second first entity and the second entity, each of the first and second first entities and the second entity authenticated to the core network independently and separately from one another;
the core network comprising a relay through which all traffic and data flows between the first or second first entity and the second entity pass, and a controller, the controller configured for each respective first or second first entity to:
determine whether an authentication requirement associated with a permitted access to a protected resource associated with the second entity has been met, wherein the authentication requirement is specified in a security policy;
upon a determination that the authentication requirement has been met, permitting the respective first or second first entity to access the protected resource associated with the second entity via the secure communication path;
based on one or more authentication factors and other data, determining whether the authentication requirement should be modified;
upon a determination that the authentication factor should be modified, adjusting the authentication requirement; and
enforcing the adjusted authentication requirement for at least some remaining portion of the communication session;
wherein authentication requirements are dynamically adjusted during the communication sessions with the second entity such that the first and second first entities have differing authentication requirements in their respective communication sessions.
11. The computing infrastructure as described in claim 10 , wherein the first and second first entities and the second entity are organized in a trust circle associated with the security policy.
12. The computing infrastructure as described in claim 10 , wherein the core network is configured as an overlay network in association with the network operating environment.
13. The computing infrastructure as described in claim 10 , wherein the core network is configured as a standalone network in association with the network operating environment.
14. The computing infrastructure as described in claim 10 , wherein authentication requirements applied to the first first entity different from authentication requirements applied to the second first entity.
15. The computing infrastructure as described in claim 10 , wherein an authentication requirement is associated with one of: an ambient authentication factor, an active authentication factor, and a combination of an ambient authentication factor and an active authentication factor.