Method and apparatus for authentication token-based service redirection
A method, apparatus, and computer readable medium is provided. According to an embodiment, a method includes, receiving a message from a client. The method further includes, forwarding the message to a first service when the message includes an authentication token, where the authentication token indicates that the client can access the first service. The method further includes, forwarding the message to a second service when the message excludes the authentication token. The receiving the message from the client and the forwarding the message to the first service occur over a confidential channel.
1. A method, comprising:
receiving, at an application router, a message from a client;
forwarding, at the application router, the message to a first service when the message comprises an authentication token, wherein the authentication token indicates that the client can access the first service;
creating, at the application router, a connection between the client and the first service when the application router forwards the message to the first service, wherein the first service sends a response message to the client over the connection; and
forwarding, at the application router, the message to a second service when the message excludes the authentication token,
wherein the receiving the message from the client, the forwarding the message to the first service, and the sending the response message by the first service to the client occur over a confidential channel, wherein the confidential channel is made confidential by encrypting the message received from the client, the message forwarded to the first service, and the response message sent by the first service to the client.
2. The method of claim 1 ,
wherein the first service is one of a class of first services,
wherein the second service is one of a class of second services, and
wherein the authentication token indicates that the client can access the class of first services.
3. The method of claim 1 , wherein the authentication token comprises a prefix, wherein the prefix is a structure of a fixed length that is attached to the message.
4. The method of claim 3 , wherein the prefix comprises an extensible markup language packet, a binary data stream, a text string, or a set of data.
5. The method of claim 1 , wherein the authentication token comprises a certificate.
6. The method of claim 5 , wherein the certificate comprises an electronic document which uses a digital signature to bind together a public key with an identity.
7. The method of claim 1 , wherein the message comprises a connection request.
8. The method of claim 1 , wherein the receiving of the message from the client further comprises receiving the message over a sequential, stream-oriented protocol.
9. The method of claim 1 , wherein the client requests and receives the authentication token before the client sends a message.
10. The method of claim 9 , wherein the authentication token is stored in a configuration file, a database, a lookup table, or a service.
11. The method of claim 1 , wherein the authentication token is stored locally at the client.
12. The method of claim 1 ,
wherein the first service is a covert service that is only exposed to a client that includes an authentication token within the message, and
wherein the second service is an alternate service that is exposed to any client regardless of whether the client includes an authentication token within the message.
13. The method of claim 1 , further comprising:
requesting that the client provide the authentication token;
receiving the authentication token from the client in response to the request.
14. An apparatus, comprising:
a memory configured to store instructions; and
a processor configured to execute the instructions stored on the memory,
wherein the processor is further configured, when executing the instructions stored on the memory, to,
receive a message from a client,
forward the message to a first service when the message comprises an authentication token, wherein the authentication token indicates that the client can access the first service,
create a connection between the client and the first service when the application router forwards the message to the first service, wherein the first service sends a response message to the client over the connection, and
forward the message to a second service when the message excludes the authentication token, and
wherein the processor is further configured, when executing the instructions stored on the memory, to receive a message from the client, to forward the message to the first service, and to facilitate the sending of the response message by the first service to the client over a confidential channel, wherein the confidential channel is made confidential by encrypting the message received from the client, the message forwarded to the first service, and the response message sent by the first service to the client.
15. The apparatus of claim 14 ,
wherein the first service is one of a class of first services,
wherein the second service is one of a class of second services, and
wherein the prefix indicates that the client can access the class of first services.
16. The apparatus of claim 14 ,
wherein the first service is a covert service that is only exposed to a client that includes an authentication token within the message, and
wherein the second service is an alternate service that is exposed to any client regardless of whether the client includes an authentication token within the message.
17. The apparatus of claim 14 , wherein the processor is further configured, when executing the instructions stored on the memory, to,
request that the client provide the authentication token, and
receive the authentication token from the client in response to the request.
18. A non-transitory computer readable medium having a computer program stored thereon that, when executed by a processor, causes the processor to implement a method, the method comprising:
receiving a message from a client;
forwarding the message to a first service when the message comprises an authentication token, wherein the authentication token indicates that the client can access the first service;
creating a connection between the client and the first service when the application router forwards the message to the first service, wherein the first service sends a response message to the client over the connection; and
forwarding the message to a second service when the message excludes the authentication token,
wherein the receiving the message from the client, the forwarding the message to the first service, and the sending the response message by the first service to the client occur over a confidential channel, wherein the confidential channel is made confidential by encrypting the message received from the client, the message forwarded to the first service, and the response message sent by the first service to the client.
19. The non-transitory computer readable medium of claim 18 ,
wherein the first service is one of a class of first services,
wherein the second service is one of a class of second services, and
wherein the authentication token indicates that the client can access the class of first services.
20. The non-transitory computer readable medium of claim 18 ,
wherein the first service is a covert service that is only exposed to a client which includes an authentication token within the message, and
wherein the second service is an alternate service that is exposed to any client regardless of whether the client includes an authentication token within the message.
21. The non-transitory computer readable medium of claim 18 , the instructions further comprising:
requesting that the client provide the authentication token; and
receiving the authentication token from the client in response to the request.