Methods and systems for use in authorizing access to a networked resource
A control system authorizes access to a networked resource. The control system includes a client agent associated with a client resource running at a user device, and a destination agent associated the networked resource. The client agent transparently injects one or more identity tokens associated with the client resource and one or more access tokens associated with the networked resource into a network request issued by the client resource and directed to the networked resource. The destination agent intercepts the network request and uses the access tokens to selectively route the network request in accordance with one or more security policies associated with the access tokens.
1. A computer-implemented method for authorizing access to a networked resource, the method comprising:
running a client resource at a user device;
identifying, at a first agent associated with the client resource, a network request transmitted from the client resource and directed to the networked resource;
classifying one or more of the client resource or the networked resource into one or more type groups;
generating one or more access tokens associated with the respectively classified resource based on the one or more type groups;
transparently injecting one or more identity tokens associated with the client resource and the one or more access tokens associated with the networked resource into the network request en route to the networked resource; and
using the one or more access tokens to selectively route the network request in accordance with one or more security policies associated with the one or more access tokens.
2. The computer-implemented method of claim 1 further comprising identifying the client resource using a fingerprint of the user device.
3. The computer-implemented method of claim 1 further comprising detecting the client resource running at the user device by identifying one or more application layer protocols used by the client resource, wherein the one or more identity tokens are injected independent of the one or more application layer protocols.
4. The computer-implemented method of claim 1 further comprising generating a registration request associated with the client resource for use in registering the client resource with a controller.
5. The computer-implemented method of claim 1 further comprising removing one or more credentials associated with the client resource from the network request.
6. The computer-implemented method of claim 1 further comprising encrypting the network request for transmission to a second agent associated with the networked resource through an encrypted channel.
7. The computer-implemented method of claim 1 further comprising tracking the network request using the one or more identity tokens.
8. The computer-implemented method of claim 1 further comprising:
determining whether at least one token of the one or more identity tokens or the one or more access tokens is expired; and
on condition that the at least one token is expired, refreshing the at least one token.
9. A control system for authorizing access to a networked resource, the control system comprising:
a controller configured to classify one or more of a client resource or the networked resource into one or more type groups and generate one or more access tokens associated with the respectively classified resource based on the one or more type groups;
a client agent associated with the client resource running at a user device, the client agent configured to transparently inject one or more identity tokens associated with the client resource and the one or more access tokens associated with the networked resource into a network request issued by the client resource and directed to the networked resource, and
a destination agent associated with the networked resource, the destination agent configured to intercept the network request and use the one or more access tokens to selectively route the network request in accordance with one or more security policies associated with the one or more access tokens.
10. The control system of claim 9 , further comprising a wherein the controller is configured to:
scan a plurality of host systems including the user device to detect the one or more of the client resource or the networked resource;
register the one or more of the client resource or the networked resource with a service identity platform, the one or more of the client resource or the networked resource assigned with a unique identifier.
11. The control system of claim 9 , further comprising a wherein the controller is configured to: classify one or more of the client resource or the networked resource into one or more type groups; and associate the one or more of the client resource or the networked resource with the one or more security policies based on the one or more type groups.
12. The control system of claim 9 , wherein the client agent is configured to remove one or more credentials associated with the client resource from the network request.
13. The control system of claim 9 , wherein the client agent is configured to transparently encrypt the network request.
14. The control system of claim 9 , wherein the client agent is configured to track the network request using the one or more identity tokens.
15. The control system of claim 9 , wherein the client agent is configured to:
determine whether at least one token of the one or more identity tokens or the one or more access tokens is expired; and
on condition that the at least one token is expired, generate a request for refreshing the at least one token.
16. A system for facilitating communication between a client resource and a networked resource, the system comprising:
a controller configured to classify one or more of the client resource or the networked resource into one or more type groups and generate one or more access tokens associated with the respectively classified resource based on the one or more type groups;
an injection mechanism that intercepts a network request issued by the client resource and directed to the networked resource, and transparently injects one or more identity tokens associated with the client resource and the one or more access tokens associated with the networked resource into the network request; and
an interception mechanism that selectively routes the network request to the networked resource in accordance with one or more security policies associated with the one or more access tokens.
17. The system of claim 16 , wherein the injection mechanism is configured to remove one or more credentials associated with the client resource from the network request.
18. The system of claim 16 , wherein the injection mechanism is configured to track the network request using the one or more identity tokens.