sayTRUST UZE Post-Zero-Trust Secure Access and Dedicated Communication

Universal Zero Trust Exchange: Controlled Access to Applications, Data, Machines and Locations – Without General Network Access

​

Solution at a Glance

sayTRUST UZE connects the central UZE server with hardware- or software-based UZE clients. Only explicitly authorized communication to a specific application, service, machine or defined location is permitted. Users are not granted general access to the corporate network.

​

The security chain begins with the unique identification of the user before accessing the computer. Only then is the protected client environment activated, security policies and the current security status verified, and the specifically authorized communication established. Post-Zero-Trust forms the foundation of the entire sayTEC security architecture, while sayTRUST UZE is the technical platform that implements this principle.

Conventional concepts are based on today's technology and consist of a VPN server, one or, better, several terminal servers, Citrix servers and storefront clients. Purchasing and putting it into operation would be costly and time-consuming.

​

VPN connects. Zero Trust controls. Post-Zero-Trust isolates authorized communication and moves security decisions consistently ahead of connection establishment.

​

Traditional VPN solutions connect a remote computer to a network or network segment, even when the connection is encrypted. If the client is compromised, this connection itself can become an attack vector. Zero Trust and ZTNA improve access control, but sayTRUST UZE takes the concept further: Instead of opening the network, only the authorized communication channel to a specific application is established.

​

Security Layers and Their Functions

​

1. Identification: The authorized user is uniquely verified before communication and the secure environment are activated.

2. UZE Client: The personal client or device-bound software client is securely activated and monitored.

3. Protected RAM Environment: Session, policy, communication and routing information is processed temporarily in protected memory.

4. Policy and Posture: Permissions, certificates, security policies and device security status are verified before communication begins.

5. Authorized Exchange: The UZE server establishes only explicitly approved application connections or communication channels.

​

Internal and External Workstations Are Protected by the Same Security Principles

sayTRUST UZE is designed not only for home offices and mobile users. Internal workstations, personal devices, third-party access and isolated network segments can all be protected using the same security principles.

​

The key lies in the combination of multiple security layers. This keeps servers and critical resources highly isolated from endpoint devices. Unauthorized systems remain invisible, cannot be freely addressed and cannot be accessed directly.

​

Hardware and Software Clients

​

Hardware- and software-based UZE clients can be used within the same environment. Hardware clients are portable and particularly suitable for environments with high security requirements, while software clients are permanently associated with a specific device.

​

High Availability Without Duplicate Client Licensing

​

For high-availability deployments, a dedicated HA appliance with an integrated HA server operating system is available. It inherits the license scope and connection capacity of the associated UZE master server, eliminating the need to purchase additional client licenses for the redundant system.

​

UZE Plus for Machines, Servers and Locations

​

UZE Plus extends the platform with dedicated machine-to-machine and site-to-site communication. Up to twelve machines or defined networks and subnets can be connected. Here, too, no remote network is granted unrestricted connectivity. Only explicitly authorized systems and communication relationships are permitted to communicate with the respective networks.

​

Benefits and Typical Use Cases

​

• Verified identity as the starting point of the security chain.

• Policy, posture and communication verification before establishing a connection.

• Application-specific access without general network access.

• Zero-Footprint principle with a protected, temporary RAM environment.

• Unified security model for internal and external workstations.

• Controlled access for users, partners and service providers.

• Dedicated communication for machines, servers, networks and locations.

• Reduced visibility of internal infrastructure and a significantly smaller attack surface.

​

Conclusion

​

sayTRUST UZE combines identity verification, secure client activation, protected memory environments, policy enforcement, posture assessment, UZE servers, communication control and Zero Footprint into a comprehensive Post-Zero-Trust security architecture.

​

Instead of granting access to the entire network, sayTRUST UZE establishes secure communication channels exclusively to authorized applications and services.