Invocation path security in distributed systems
Systems, methods, and computer program products for an application to securely record and propagate an invocation context for invoking other applications are described. The applications being invoked not only receive a user's authentication token, but also authentication tokens of an entire invocation chain. Accordingly, the applications being invoked can verify a chain of custody through verification of nested, cryptographically signed payloads of a chain of authentication tokens. An application can thus verify identities of each application in the chain of custody, as well as the invocation contexts (e. g. the HTTP request method and path) in which each application in the chain invoked the next application.
1. A method comprising:
receiving, by a midstream application from an upstream application, a first invocation request, the first invocation request being associated with a first token signed by a first private key of the upstream application, the first token specifying permissible audience of the first token;
authenticating the first invocation request, including verifying the first token by the midstream application using a first public key corresponding to the upstream application and stored in a service registry;
verifying that the midstream application is an instance of the permissible audience of the first token;
upon successful verification, generating a second token by the midstream application, including inserting the first token into a parent field of the second token;
signing the second token by the midstream application using a second private key of the midstream application, wherein a corresponding second public key is stored in the service registry; and
submitting, by the midstream application to a downstream application, a second invocation request in association with the signed second token;
receiving, by the downstream application from the midstream application, the second invocation request;
determining, by the downstream application, that the second invocation request received from the midstream application is authenticated based on verifying that the midstream application is an instance of the permissible audience for the first token received from the upstream application; and
in response to determining that the second invocation request is authenticated based on verifying that the midstream application is an instance of the permissible audience for the first token received from the upstream application, authorizing, by the downstream application, the second invocation request,
wherein the upstream, midstream and downstream applications are configured to serve user requests in a chain of invocations within a microservice-based computing platform comprising a plurality of computers.
2. The method of claim 1 , wherein each of the first token and the second token is a JSON Web token (JWT) and is transmitted in a header of a corresponding invocation request.
3. The method of claim 1 , wherein each of the first token and the second token is a single use token.
4. The method of claim 1 , comprising populating the service registry upon startup of the upstream application and the midstream application, the populating including authenticating with the service registry through an existing trust relationship and inserting the first public key and the second public key in the service registry.
5. The method of claim 1 , wherein:
the first token includes an initial token including credentials of a user initiating the chain of invocations including the first invocation request and the second invocation request.
6. The method of claim 5 , comprising authenticating the first invocation request by the midstream application, wherein:
authentication is performed on the first token, using the first public key stored in the service registry, and
authentication is performed on the initial token.
7. The method of claim 5 , comprising authenticating the second invocation request by the downstream application, wherein:
authentication is performed on the second token using the second public key stored in the service registry,
authentication is performed on the first token contained within the second token, using the first public key stored in the service registry, and
authentication is performed on the initial token.
8. The method of claim 1 , comprising authorizing the first invocation request by the midstream application, wherein authorization is based on a security policy that requires presence of one more authenticated tokens.
9. The method of claim 1 , wherein:
the first token includes a request field, the request field describing intended operation to be invoked by the upstream application on the midstream application, and
authenticating the first invocation request by the midstream application comprises determining whether the request field of the first token sufficiently describes the first invocation request.
10. The method of claim 1 , further comprising:
generating, by the upstream application, the first token, the first token specifying the permissible audience of the first token;
generating, by the upstream application, a first wrapper and associating the first token with the first wrapper; and
submitting, by the upstream application to the midstream application, the first invocation request in association with the first token and the first wrapper, wherein:
authenticating the first invocation request further comprises verifying, by the midstream application, a source of the first invocation request received from the upstream application using the first wrapper.
11. The method of claim 10 , further comprising:
discarding, by the midstream application, the first wrapper from the first token;
generating, by the midstream application, a second wrapper and associating the second token with the second wrapper; and
verifying, by the downstream application, a source of the second invocation request received from the midstream application using the second wrapper, wherein:
the downstream application does not have access to the discarded first wrapper.
12. The method of claim 10 , wherein:
generating, by the upstream application, the first wrapper comprises generating the first wrapper using a first private wrapper key, wherein a corresponding first public wrapper key is stored in the service registry; and
verifying, by the midstream application, a source of the first invocation request received from the upstream application using the first wrapper comprises verifying the first wrapper using the first public wrapper key stored in the service registry.
13. A non-transitory computer readable storage medium storing instructions executable by a data processing apparatus and upon such execution cause the data processing apparatus to perform operations comprising:
receiving, by a midstream application from an upstream application, a first invocation request, the first invocation request being associated with a first token signed by a first private key of the upstream application, the first token specifying permissible audience of the first token;
authenticating the first invocation request, including verifying the first token by the midstream application using a first public key corresponding to the upstream application and stored in a service registry;
verifying that the midstream application is an instance of the permissible audience of the first token;
upon successful verification, generating a second token by the midstream application, including inserting the first token into a parent field of the second token;
signing the second token by the midstream application using a second private key of the midstream application, wherein a corresponding second public key is stored in the service registry; and
submitting, by the midstream application to a downstream application, a second invocation request in association with the signed second token;
receiving, by the downstream application from the midstream application, the second invocation request;
determining, by the downstream application, that the second invocation request received from the midstream application is authenticated based on verifying that the midstream application is an instance of the permissible audience for the first token received from the upstream application; and
in response to determining that the second invocation request is authenticated based on verifying that the midstream application is an instance of the permissible audience for the first token received from the upstream application, authorizing, by the downstream application, the second invocation request,
wherein the upstream, midstream and downstream applications are configured to serve user requests in a chain of invocations within a microservice-based computing platform comprising a plurality of computers.
14. The non-transitory computer readable storage medium of claim 13 , wherein:
the first token includes an initial token including credentials of a user initiating the chain of invocations including the first invocation request and the second invocation request.
15. The non-transitory computer readable storage medium of claim 14 , the operations comprising authenticating the first invocation request by the midstream application, wherein:
authentication is performed on the first token, using the first public key stored in the service registry, and
authentication is performed on the initial token.
16. The non-transitory computer readable storage medium of claim 14 , the operations comprising authenticating the second invocation request by the downstream application, wherein:
authentication is performed on the second token using the second public key stored in the service registry,
authentication is performed on the first token contained within the second token, using the first public key stored in the service registry, and
authentication is performed on the initial token.
17. A system comprising:
one or more computers and one or more storage devices on which are stored instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
receiving, by a midstream application from an upstream application, a first invocation request, the first invocation request being associated with a first token signed by a first private key of the upstream application, the first token specifying permissible audience of the first token;
authenticating the first invocation request, including verifying the first token by the midstream application using a first public key corresponding to the upstream application and stored in a service registry;
verifying that the midstream application is an instance of the permissible audience of the first token;
upon successful verification, generating a second token by the midstream application, including inserting the first token into a parent field of the second token;
signing the second token by the midstream application using a second private key of the midstream application, wherein a corresponding second public key is stored in the service registry; and
submitting, by the midstream application to a downstream application, a second invocation request in association with the signed second token;
receiving, by the downstream application from the midstream application, the second invocation request;
determining, by the downstream application, that the second invocation request received from the midstream application is authenticated based on verifying that the midstream application is an instance of the permissible audience for the first token received from the upstream application; and
in response to determining that the second invocation request is authenticated based on verifying that the midstream application is an instance of the permissible audience for the first token received from the upstream application, authorizing, by the downstream application, the second invocation request,
wherein the upstream, midstream and downstream applications are configured to serve user requests in a chain of invocations within a microservice-based computing platform comprising a plurality of computers.
18. The system of claim 17 , wherein:
the first token includes an initial token including credentials of a user initiating the chain of invocations including the first invocation request and the second invocation request.
19. The system of claim 18 , the operations comprising authenticating the first invocation request by the midstream application, wherein:
authentication is performed on the first token, using the first public key stored in the service registry, and
authentication is performed on the initial token.
20. The system of claim 18 , the operations comprising authenticating the second invocation request by the downstream application, wherein:
authentication is performed on the second token using the second public key stored in the service registry,
authentication is performed on the first token contained within the second token, using the first public key stored in the service registry, and
authentication is performed on the initial token.