Secure multiplexed routing
Methods and systems for managing data transmissions. The methods disclosed herein may involve receiving requests for a first and a second service, and routing communications with the second service through the first service without requiring the firewall to be reconfigured to allow communications with the second service.
1. A method of managing data transmissions, the method comprising:
receiving, by a first request for a first service executing at a router, wherein the first request for the first service originates inside a firewall, the first service executes outside the firewall, and the firewall is configured to allow communications from inside the firewall to the router;
receiving, by the first service, a second request for a second service, wherein the second request for the second service originates inside the firewall, the second service executes outside the firewall, and the firewall is configured to not allow communications from inside the firewall to the second service;
determining, by the first service, that the second request is directed to the second service, wherein the determination is made based on a map file that maps a name specified by the second request to the second service;
sending, by the first service, the second request to the second service; and
routing, using the router, communications from inside the firewall to the second service, wherein the routing is performed without requiring the firewall to be reconfigured to allow the communications to the second service.
2. The method of claim 1 , wherein
the communications to the first service and the communications to the second service are transport layer security (TLS) communications.
3. The method of claim 1 , wherein
the second request comprises a server name indication (SNI) field, and
the SNI field specifies the name of the second service.
4. The method of claim 1 , wherein
the router is a load balancer.
5. The method of claim 1 , wherein
the communications to the second service are routed without decryption.
6. The method of claim 1 , wherein
the second service is a cloud storage service.
7. The method of claim 6 , wherein
the cloud storage service is specified in either a host header or a URL associated with the second request for the second service.
8. A system for managing data transmissions, the system comprising:
an interface configured to receive:
a first request for a first service executing at a router, wherein the first request for the first service originates inside a firewall, the first service executes outside the firewall, and the firewall is configured to allow communications from inside the firewall to the router, and
a second request for a second service, wherein the second request for the second service originates inside the firewall, the second service executes outside the firewall, and the firewall is configured to not allow communications from inside the firewall to the second service; and
the router configured to:
determine, using the first service, that the second request is directed to the second service, wherein the determination is made based on a map file that maps a name specified by the second request to the second service;
send the second request to the second service; and
route communications from inside the firewall to the second service, wherein the routing is performed without requiring the firewall to be configured to allow the communications to the second service.
9. The system of claim 8 , wherein
the communications to the first service and the communications to the second service are transport layer security (TLS) communications.
10. The system of claim 8 , wherein
the second request comprises a server name indication (SNI) field, and the SNI field specifies the name of the second service.
11. The system of claim 8 , wherein
the router is a load balancer.
12. The system of claim 8 , wherein
the communications to the second service are routed without decryption.
13. The system of claim 8 , wherein
the second service is a cloud storage service.
14. The system of claim 13 , wherein
the cloud storage service is specified in either a host header or a URL associated with the second request for the second service.
15. A method for routing communications without requiring firewall configuration, the method comprising:
receiving a transport layer security (TLS) communication at a router, the communication comprising a server name indication (SNI) field, wherein the TLS communication originates inside a firewall, the router is outside the firewall, and the firewall is configured to not allow communications from inside the firewall to a destination indicated by the SNI field;
determining, by the router, that the TLS communication is directed to the destination, wherein the determination is made based on a map file that maps a name indicated by the SNI field to the destination; and
routing, using the router, the TLS communication to the destination specified in the SNI field.
16. The method of claim 15 , wherein
the destination specified refers to a backend service.
17. The method of claim 15 , wherein
the SNI field is used to by the router to multiplex a plurality of platform services.
18. The method of claim 15 , wherein
the TLS communication is routed without decryption.
19. The method of claim 15 , wherein
the destination refers to a cloud storage service.
20. The method of claim 19 , wherein
receiving the TLS communication includes intercepting the TLS communication, and the method further includes validating the cloud storage service.