Skip to main content

Glossary

The Corsha mIDP uses common terms for elements and processes in the platform that have a specific meaning in context. This topic provides a conceptual overview of this terminology and how they relate and apply in different use cases.

Admin​

A Console user account with full administrative privileges and RBAC-configurable scopes.

Agentless Integration​

Proxy mode deployment that manages machine identities via external identity providers (like Microsoft Entra ID) without deploying Authenticators on client machines.

Allow by Default Mode​

Firewall mode enforcement where all traffic is permitted by default, with connection rules blocking specific unwanted connections—ideal for transitioning from observation to enforcement.

Auth Server​

Your dedicated entrypoint to the Corsha backend platform, providing endpoints for the Primer Service, API Proxy, and Authenticator to communicate with the DLN.

AuthN From Banned Country Violation​

Security violation triggered when an authentication token request originates from a country banned by security policy, indicating a potential bypass of regional controls.

Authenticator​

Lightweight agent that generates dynamic MFA credentials and maintains continuous identity streams through the DLN in proxy mode deployments. See Authenticator.

Banned Country Traffic Violation​

Security violation triggered when network traffic is detected from a country banned by security policy, indicating a potential attempt to bypass geo-blocking controls.

Block by Default Mode​

Firewall mode enforcement where all traffic is blocked except explicitly permitted connections—the zero-trust security posture for production deployments.

Dual Gatekeeper​

Proxy mode deployment where a single Gatekeeper instance both adds MFA credentials to outbound calls and validates MFA credentials on inbound traffic, eliminating the need for separate components.

Connection Rule​

Policies defining how machines can communicate and are synchronized to Gatekeepers in firewall mode (can be overridden by protocol enforcement rules).

Control Plane​

Customer-specific deployment containing the Auth Server and web-based Console for platform administration.

Console​

Web-based administrative interface for managing the Corsha platform. See Console.

Gatekeeper​

Component that secures access to protected services in two modes: Firewall Mode (layer 2, microsecond latency, passive discovery and connection rules) and Proxy Mode (layer 7, millisecond latency, MFA validation). Deployed standalone or integrated with API gateways.

Distributed Ledger Network (DLN)​

Corsha's patented distributed ledger providing identity validation (proxy mode) and rule synchronization (firewall mode) for the mIDP.

Enforcement Mode​

The security posture of a firewall mode Gatekeeper: Observe-Only, Allow by Default, or Block by Default.

Expired Secret Violation​

Security violation that occurs when a secret has passed its expiration date, leading to authentication failures and loss of trust.

Excessive Validity Period Violation​

Security violation when a secret is issued with an excessive validity period, increasing the risk of unauthorized access or misuse.

Firewall Mode​

Operational mode where Gatekeepers passively discover machines and enforce connection-based access control at layer 2 with microsecond latency. See Firewall Mode.

Machine Group​

Logical grouping of machines by function, role, security zone, or criticality to simplify management. See Machine Groups.

Machine Identity​

The representation of a machine in the mIDP, established via Authenticators (proxy mode), external identity providers (agentless proxy mode), or passive network discovery (firewall mode).

MFA Cred​

One-time-use, dynamic API credentials generated by Authenticators that pin API access to specific trusted machines in proxy mode deployments.

mIDP (Machine Identity Provider)​

Corsha's patented platform providing dynamic identity and access management for machines via proxy mode (API-level MFA validation) or firewall mode (connection-based access control).

Observe-Only Mode​

Firewall mode enforcement where machines and connections are discovered and logged without blocking traffic—used during initial deployment for visibility.

Passive Discovery​

The method by which firewall mode Gatekeepers discover machines by observing network traffic without requiring agents or instrumentation.

Protocol Enforcement Rule​

Global policies allowing or blocking network traffic by port and transport protocol (TCP/UDP), supporting port ranges and overriding connection rules when conflicts occur.

Proxy Mode​

Operational mode where Gatekeepers validate API authentication at layer 7, supporting Authenticator-based MFA or agentless integration. See Proxy Mode.

Reused Machine Identity Violation​

Security violation when a single machine identity sends traffic from multiple IP addresses, suggesting identity reuse or unauthorized access.

Secret Age Violation​

Security violation when a secret has existed for too long, increasing the risk of unauthorized access or misuse.

Shared IP violation​

Security violation when a single IP address is associated with multiple machine identities, indicating potential misconfiguration or a man-in-the-middle attack.