Transparently enhanced authentication and authorization between networked services
A control system facilitates communication between a plurality of networked services. The control system includes a client agent associated with a first service of the networked services, and a destination agent associated with a second service of the networked services. The client agent includes an injection mechanism that intercepts a network request issued by the first service, transparently injects a token into the network request while the network request is in transit, and automatically transmits the network request to the second service in accordance with one or more security policies associated with the second service. The destination agent includes an interception mechanism that intercepts the network request, extracts the tokens from the network request, and determines whether to forward the network request to the second service.
1. A computer-implemented method for facilitating communication between a plurality of networked services, the method comprising
identifying, at a first host system, a first service of the plurality of networked services;
deploying, to the first host system, a first agent associated with the first service, the first agent including one or more identity tokens associated with the first service and one or more access tokens associated with a second service of the plurality of networked services;
identifying, at the first agent, a communication transmitted from the first service and directed to the second service;
determining whether the communication includes a network request; and
on condition that the communication includes the network request, transparently injecting the one or more identity tokens into the communication for use in authenticating and authorizing the first service, and automatically transmitting the communication to the second service in accordance with one or more security policies associated with the one or more access tokens.
2. The computer-implemented method of claim 1 , wherein identifying the first service of the plurality of networked services comprises identifying the first service using a fingerprint of the first host system, and further comprising:
assigning the first service with a unique identifier; and
classifying the first service into one or more type groups.
3. The computer-implemented method of claim 1 further comprising detecting the first service running at the first host system by identifying one or more application layer protocols used by the first service, wherein transparently injecting the one or more identity tokens comprises injecting the one or more identity tokens independent of the one or more application layer protocols.
4. The computer-implemented method of claim 1 further comprising removing, at the first agent, one or more credentials associated with the first service from the network request.
5. The computer-implemented method of claim 1 further comprising:
determining, at a second agent associated with the second service, whether the one or more identity tokens satisfy a predetermined security threshold;
on condition that the predetermined security threshold is satisfied, validating the one or more identity tokens, and forwarding the network request to the second service; and
on condition that the predetermined security threshold is not satisfied, blocking the communication from being transmitted to the second service.
6. The computer-implemented method of claim 1 further comprising:
encrypting, at the first agent, the communication for transmission to a second agent associated with the second service through an encrypted channel;
decrypting, at the second agent, the communication;
extracting, at the second agent, the one or more identity tokens from the communication; and
cryptographically validating, at the second service, the one or more identity tokens.
7. The computer-implemented method of claim 1 further comprising tracking the communication using the one or more identity tokens.
8. The computer-implemented method of claim 1 further comprising:
determining whether at least one token of the one or more identity tokens or the one or more access tokens is expired; and
on condition that the at least one token is expired, refreshing the at least one token.
9. A system for facilitating communication between a plurality of networked services, the system comprising:
a client agent associated with a first service of the plurality of networked services, the client agent comprising an injection mechanism configured to intercept a network request issued by the first service for a second service of the plurality of networked services, transparently inject one or more identity tokens into the network request while the network request is in transit to the second service, and automatically transmitting the network request to the second service in accordance with one or more security policies associated with the second service; and
a destination agent associated with the second service, the destination agent comprising an interception mechanism configured to intercept the network request issued by the first service, extract the one or more identity tokens from the network request, determine whether the one or more identity tokens satisfy a predetermined destination security threshold, and, on condition that the predetermined destination security threshold is satisfied, forward the network request to the second service.
10. The system of claim 9 , wherein the client agent is configured to identify the first service using a fingerprint of a host system associated with the client agent, and further comprising a controller comprising a service identity platform configured to assign the first service with a unique identifier, and classify the first service into one or more type groups.
11. The system of claim 9 further comprising a controller configured to retrieve the one or more security policies, generate one or more access tokens using the one or more security policies, and transmit the one or more access tokens to the client agent.
12. The system of claim 9 , wherein the client agent is configured to detect the first service running at a host system associated with the client agent by identifying one or more application layer protocols used by the first service, and inject the one or more identity tokens independent of the one or more application layer protocols.
13. The system of claim 9 , wherein the client agent is configured to remove one or more credentials associated with the first service from the network request.
14. The system of claim 9 , wherein the client agent is configured to transparently encrypt the network request while the network request is in the transit to the second service such that the network request is transmitted through an encrypted channel, and the destination agent is configured to decrypt the network request.
15. The system of claim 9 , wherein the destination agent is configured to extract the one or more identity tokens from the network request, and cryptographically validate the one or more identity tokens.
16. The system of claim 9 , wherein the destination agent is configured to block the network request from being transmitted to the second service and generate an error response for transmission to the first service on condition that the predetermined destination security threshold is not satisfied.
17. The system of claim 9 further comprising a controller, wherein the destination client is configured to communicate with the controller to obtain one or more security policies associated with the first service.
18. The system of claim 9 , wherein the client agent is configured to track the network request using the one or more identity tokens.
19. The system of claim 9 , wherein the client agent is configured to determine whether at least one token of the one or more identity tokens is expired, and, on condition that the at least one token is expired, generate a request for refreshing the at least one token.
20. A computing system for facilitating communication between a plurality of networked services, the computing system comprising:
a memory device storing data associated with at least a first service of the plurality of networked services, and computer-executable instructions; and
a processor configured to execute the computer-executable instructions to:
identify, at the computing system, the first service of the plurality of networked services;
generate, for transmission to a controller, a registration request associated with the identified first service for use in registering the first service with the controller;
receive, from the controller, one or more identity tokens associated with the first service and one or more access tokens associated with a second service of the plurality of networked services;
identify a communication transmitted from the first service and directed to the second service of the plurality of networked services;
determine whether the communication includes a network request; and
on condition that the communication includes the network request, transparently inject the one or more identity tokens into the communication for use in authenticating and authorizing the first service, and automatically transmitting the communication to the second service in accordance with one or more security policies associated with the one or more access tokens.