Techniques for network process identity enablement
View Patent ↗Techniques for network process identity enablement are provided. Inter-server communications within a network are intercepted so that unique identity-based information is gathered and recorded before a sending process is permitted to release a communication over the network to a receiving process. Moreover, the receiving process cannot process the communication being sent until identifying information is gathered again and independently validated against the prior recorded information.
1. A computer-implemented method that is adapted to executed by a processor to perform the method, comprising:
intercepting a communication sent from an application on a first server that is directed to a second server, the application is a legacy application not enabled with identity processing and the application unaware of interaction occurring with an identity service and the legacy application lacks the ability to communicate over a network using network communication associated with the identity processing;
collecting information as metrics on the first server to uniquely identify the communication and the application and to assign a unique identity;
passing the information to an identity service, wherein the identity service subsequently assigns the unique identity for the communication using the information collected and provides validation services for the identity when the second server receives the communication from the application and before the second server processes the communication, and the identity is a unique verifiable identity specific to the communication based on the information collected; and
releasing the communication from the first server to the second server.
2. The method of claim 1 , wherein intercepting further includes acquiring the communication when a network layer of the first server attempts to use an operating system (OS) of the first server to open a network port connection to the second server.
3. The method of claim 2 , wherein acquiring further includes using a kernel layer module of the OS to intercept the communication before the network port connection is opened for the application.
4. The method of claim 1 , wherein collecting the information further includes acquiring the information as a process identifier for the application, port specific metrics that the application is using on the first server, and network card metrics for the first server.
5. The method of claim 4 , wherein acquiring further includes identifying the network card metrics as a media access control (MAC) address for the first server, a host name for the first server, and a Transmission Control Protocol/Internet Protocol (TCP/IP) address for the first server.
6. The method of claim 1 , wherein passing further includes using, by the identity service, the information to generate the identity as a random unique identity that is specific to the communication between the application on the first server and the second server.
7. The method of claim 1 further comprising, assigning a policy to be associated with processing the communication on the second server at the identity service in response to the information and the assigned identity.
8. A computer-implemented method that is adapted to executed by a processor to perform the method, comprising:
receiving information for a communication that is being sent from an application that processes on a first server to a second server, the application is a legacy application that is not enabled with identity processing and the application is unaware of interaction with the method processing and the legacy application lacks the ability to communicate over a network using network communication associated with the identity processing;
obtaining additional information from the second server when the second server receives the communication and before the second server handles the communication; and
ensuring that the additional information received from the second server matches the information received from the first server and when it does permitting the communication to be processed by the second server,
wherein the information and the additional information are specific to the communication;
wherein the information and the additional information are used to form a unique verifiable identity for the communication;
wherein the information and the additional information are metrics for the communication and the information to uniquely identify both the communication and the application, and also to assign a unique verifiable identity.
9. The method of claim 8 , wherein receiving further includes establishing a temporary identity for the information.
10. The method of claim 9 , wherein establishing further includes assigning a processing policy for the temporary identity to enforce on the second server when the additional information matches the information and is associated with the temporary identity.
11. The method of claim 8 , wherein receiving further includes receiving the information from a kernel process of an operating system (OS) that executes on the first server.
12. The method of claim 8 , wherein obtaining further includes obtaining the additional information from a kernel process of an operating system (OS) that executes on the second server.
13. The method of claim 8 , wherein ensuring further includes evaluating policy when a match occurs before permitting the communication to be processed by the second server.
14. The method of claim 8 , wherein ensuring further includes terminating or preventing the communication from being processed by the second server when no match occurs between the information and the additional information.
15. A machine-implemented system adapted to be executed on one or more processors, comprising:
a first security service implemented in a computer-readable storage medium and that processes on a first operating system of a first server;
a second security service implemented in a computer-readable storage medium and that processes on a second operating system of a second server;
wherein the first security service intercepts a communication being sent from an application that processes on the first server, the application is a legacy application not enabled with identity processing and the application is unaware of the processing associated with the first security service, and the legacy application lacks the ability to communicate over a network using network communication associated with the identity processing, and the communication being sent by the application to the second server, the first security service gathers information as metrics regarding the application and first server and reports that information to an identity service before the communication is released to the second server, and
wherein the second security service intercepts the communication released to the second server before the communication is processed and gathers additional information as other metrics regarding the application and the first server for that communication, the second security service provides the additional information to the identity service and releases the communication for processing by the second server when the identity service provides authorization,
wherein the information and the additional information are specific to the communication,
wherein the information and the additional information are used to form a unique verifiable identity for the communication, to uniquely identify the communication and the application, and to assign the unique verifiable identity.
16. The system of claim 15 , wherein the first security service gathers the information as a Transmission Control Protocol/Internet Protocol address for the first server, a port number for a port that the first application uses on the first server, a process identifier for the first application, and network interface controller data for the first server.
17. The system of claim 15 , wherein the second security service acquires the additional information via metadata received with the communication from the second server, and wherein the metadata includes a Transmission Control Protocol/Internet Protocol address for the first server, a port number for a port that the first application uses on the first server, a process identifier for the first application, and network interface controller data for the first server.
18. The system of claim 15 , wherein the first security service is a kernel process of the first operating system.
19. The system of claim 15 , wherein the second security service is a kernel process of the second operating system.
20. The system of claim 19 , wherein the identity service supplies policy to the second security service for the second security service to enforce against the communication when it is processed on the second server.
21. A machine-implemented system adapted to be executed by one or more processors, comprising:
an identity service implemented in a computer-readable storage medium and processed by a processor of a network;
a first server processing on the network; and
a second server processing on the network;
wherein when a first application attempts to send a communication to the second server from the first server, the first application is a legacy application that is not enabled for identity processing and the first application is unaware of interaction occurring with the identity service, and the legacy application lacks the ability to communicate over the network using network communication associated with the identity processing, and information regarding the first application and the first server is gathered as metrics and provided to the identity service to uniquely identify the communication before releasing the communication to the second server, and
wherein when the second server receives the communication, additional information is gathered as other metrics for the communication and sent to the identity service, and the identity service validates the communication by comparing the information against the additional information and authorizes the second server to process the communication when there is a match,
wherein the information and the additional information are used to form a unique verifiable identity for the communication, to uniquely identify the communication and the first application, and to assign a unique verifiable identity.
22. The system of claim 21 , wherein a first kernel process of a first operating system on the first server intercepts the communication sent from the first application before it is released to the second server and gathers the information that is sent to the identity service.
23. The system of claim 22 , wherein a second kernel process of a second operating system on the second server intercepts the communication before the second server processes the communication and gathers the additional information that is sent to the identity service.
24. The system of claim 21 , wherein the identity service supplies policy to the second server to enforce on the second server when the communication is processed on the second server, and wherein the policy is identified in response to the match and additional information.