Highly secure access to data, applications and networks

Universal ZeroTrust Exchange (UZE) – the Post ZeroTrust secure access solution from SAYTEC

sayTRUST UZE Post Zero Trust Secure Access is a groundbreaking new Zero Trust technology for encrypted internal and external access to corporate networks. It enables highly secure communication and data exchange with no back doors and no possibility of manipulation whatsoever.

sayTRUST provides a highly secure working environment – in the home office or on the move. It offers the highest level of communication security by identifying and eliminating the vulnerabilities between the user and the network to be protected. With the nine-layer “Defence in Depth” technology, users can work securely both within their own network and from external sites, home offices or mobile hotspots.

Why sayTRUST Post ZeroTrust?

At SAYTEC, security starts with the user’s identity and authorisation – before the tunnel, before communication starts, before an application or security environment is approved.

sayTRUST connects the central UZE server with hardware- or software-based UZE clients. Only the authorised communication relationship with a specific application, service, machine or defined site is enabled. The user is never given general access to the corporate network.

The security chain begins with the unambiguous identification of the user at the computer. Only then is the protected client environment activated, policies and security status checked, and the specifically permitted communication established.

Post Zero Trust underpins the entire SAYTEC architecture; sayTRUST UZE is the technical platform that puts this principle into practice.

Common Criteria EAL4+ certification

Post ZeroTrust instead of VPN –
we have taken Zero Trust further:

  • Lower costs
  • Easy to use
  • Communication at application level instead of network-to-network coupling
  • Nine-layer access security
  • Security begins before the tunnel
  • No software or access credentials on the client PC
  • Personal identification of the user (PKI)
  • Proprietary, tamper-proof and protected certificates
  • Up to 80% less administrative effort

More – sayTRUST UZE overview: Post-Zero-Trust secure access and dedicated communication, PDF in German (opens in a new tab)

sayTRUST UZE USB client and laptop

The sayTRUST Access USB client (1) is highly secure and flexible:

  • When it is plugged into any PC, the user is prompted to authenticate (2).
  • Once authentication is complete, the sayTRUST menu (3) starts.
  • From the sayTRUST menu, the connection to each application is established directly from encrypted RAM, so no traces remain on the PC.

Essentially, the solution consists of a server and a client component, for example in the form of a USB access stick. The server can run as an appliance or as software. USB sticks are available with two-factor authentication (2FA) or three-factor authentication (3FA).

– Post-Zero-Trust access protectionSECURE WORKINGWITHOUT OPENING THE NETWORKIdentity & tokenRAM tunnelApp controlBiometrics / PIN / MFA /Certificate / SSO / OTPtemporary keys,no eavesdroppingauthorised appsinstead of networksACCESS AUTHORISEDSecure session establishedAUTHORISED ACCESSGRANTEDACCESS DEVICEACTIVATEDUSERVERIFIEDMFA VERIFIEDMICROPROCESSOR TOKENnot a flash USB stick

Internal and external workstations are protected by the same principle

sayTRUST UZE is not designed solely for home-office and mobile users. Internal workstations, private devices, service-provider access and segregated network areas can all be handled according to the same security logic. What matters is the interplay of several security layers. As a result, servers and critical resources remain shielded from end devices to the greatest possible extent. Unauthorised systems are not visible, not freely addressable and not directly reachable.

Why the tunnel alone is not enough

Conventional VPN solutions technically couple a remote computer to a network or network segment, despite encryption. If the client is compromised, this connection can itself become an attack path. Zero Trust and ZTNA improve control; sayTRUST UZE takes the idea further: the network is no longer opened – only the authorised communication relationship with a specifically approved resource, such as an application, a service, machine access or voice and video communication.

The password manager for single sign-on (SSO) ensures the highest level of security. Logins to a wide range of applications and/or platforms are carried out with the respective passwords via the user’s encrypted database. Whenever an application is opened, the SSO module handles secure authentication in the background. The individual applications naturally remain protected by different passwords.

In companies, this is how the separation into sales, production and administration networks is implemented. In hospitals, for example, patient records are made accessible only to authorised medical and administrative staff.

InternetCRM tunnelPowerPoint tunnelExcel tunnelblockedapplicationClient approvedfor data accessLocalhost 127.0.0.1Data access withoutnetwork-to-network coupling

In addition to generally recognised standards (SSL, TLS, X.509 certificates with 2048 bits, Diffie-Hellman Perfect Forward Secrecy depending on the personal user certificate), further unique features have been implemented. These include establishing the connection at application level rather than in the tunnel (instead of the usual Layer 2 or Layer 3 VPN). Malware is thus detected and blocked at the very entrance to the tunnel. With its own certificate authority (CA), certificates are created “on demand” rather than obtained from a third party.

All communication is established from the encrypted memory (RAM) of the client computer. As a result, no data remnants that would allow later analysis remain on the computer or along the connection path. This protection also makes the “man-in-the-middle attack” so popular with hackers impossible.

Encrypted communication requires neither a dedicated virtual network card nor a separate IP address from the network to be protected. The network and its associated information are invisible from outside. The connection is also invisible on the client PC: the device neither has nor knows any network information about the remote network to be protected.

A particular convenience for users is that they always carry their personal working environment with them. They can work with a high level of security from any PC.

The administrator centrally configures the permissions – and with them the user’s working environment and access to applications and directories. A single login provides automatic access to all authorised applications, without the hassle of entering passwords again and again.