Abstract: Techniques for a multi-level authentication within a cloud environment are disclosed. A first authentication request is received by an identity and access management (IAM) service from a device associated with a user. The first request is to authenticate the user for accessing one or more cloud resources through a gateway of the cloud environment. Responsive to the first authentication request, a redirection is performed to submit a second authentication request to an identity provider (IdP) to authenticate the user. A first token indicating a first identity for the user based on the first authentical is received by the IAM service, here the first authentication was performed by the IdP. The IAM service performs a second authentication of the user. The IAM service issues a second token indicating a second identity for the user. The device gains access to the one or more cloud resources, based on the second token.

Abstract: Techniques for a multi-level authentication within a cloud environment are disclosed. A first authentication request is received by an identity and access management (IAM) service from a device associated with a user. The first request is to authenticate the user for accessing one or more cloud resources through a gateway of the cloud environment. Responsive to the first authentication request, a redirection is performed to submit a second authentication request to an identity provider (IdP) to authenticate the user. A first token indicating a first identity for the user based on the first authentical is received by the IAM service, here the first authentication was performed by the IdP. The IAM service performs a second authentication of the user. The IAM service issues a second token indicating a second identity for the user. The device gains access to the one or more cloud resources, based on the second token.

Abstract: Techniques are described for using a zero trust packet routing (ZPR) architecture to enforce ZPR policy language (ZPL) statements. Instead of being restricted to perimeter-based security and defining and creating rules that are difficult to maintain, techniques described allow users to create data-centric, intent-based policies using ZPL that are enforced using a ZPR architecture at different enforcement points within one or more networks. According to some configurations, ZPL is used to define the policy statements that specifies who/what (e.g., users, computing resources) can access data and where that data is allowed to travel throughout one or more networks. In this way, packets are not transmitted from an enforcement point to a next hop until the rules are evaluated by the enforcement point and the enforcement point determines that the transmission is authorized by the policy.

Abstract: Techniques are described for performing zero trust packet routing (ZPR) in one or more networks. ZPR allow users to create data-centric, intent-based policies that are evaluated and enforced at different enforcement points within one or more networks to control data flow. The policy statements specify who/what (e.g., users, computing resources) can access data and where that data is allowed to travel throughout one or more networks. ZPL policy statements are focused on allowing/denying tagged resources (users, compute instances, . . . ) to allow/deny access to tagged data that is also tagged. Generally, when packets are transmitted/received, the enforcement points evaluate the ingress or egress rules associated with the policy. In this way, packets are not transmitted from an enforcement point to a next hop until the rules are evaluated by the enforcement point and the enforcement point determines that the transmission is authorized by the policy.

Abstract: Techniques are described for performing packet level data centric protection enforcement. Instead of being restricted to perimeter-based security and defining and creating rules that are difficult to maintain, techniques described herein allow users to create data-centric, intent-based policies that are enforced at different enforcement points within one or more networks. In some examples, a method comprises receiving a packet at an enforcement point (EP) within one or more networks that include a plurality of enforcement points (EPs); accessing enforcement data that indicates allowed communications between the EP and one or more other EPs, wherein the data are generated from a policy that specifies how traffic flows the one or more networks and a determination of possible data movements between at least two of EPs in the plurality of EPs; and enforcing the flow of the packet at the EP based on the data.

Abstract: A sampling approach for time-window based multi-stage sampling. The sampling system defines multiple time windows for sampling communications received by a computing system. The time windows are segmented into multiple time intervals. A portion of the multiple time intervals are randomly selected for sampling. A portion of the communications received during the selected time intervals are captured for security assurance purposes.