Method for distributed application segmentation through authorization
Methods and supporting systems for managing secure communications and establishing authenticated communications between processes of a computer application operating across network domains are provided. Authentication agents operate on servers hosting application processes, wherein each authentication agent has access to policies related to each of the application processes. An authentication agent operating on an originating server intercepts transmissions from an originating application processes and appends a trust profile associated with the originating application process. The transmission is released to a receiving server, where it is intercepted and validated at the receiving server by a second authentication agent on the receiving server. If the validation succeeds the transmission is forwarded to the receiving application process where it is executed, processed or otherwise acted upon acted upon, and the receiving server provides an acknowledgement transmission to the originating server confirming the transmission was received and processed by the receiving application process.
1. A method for establishing authenticated communications among application processes, the method comprising:
providing authentication agents to a plurality of servers, each of the plurality of servers hosting one or more application processes and operating in different domains, wherein each authentication agent accesses policies related to each of the one or more application processes;
intercepting a transmission from an originating application process executing on an originating server by a first authentication agent on the originating server prior to transmission to a receiving application process executing on a receiving server;
appending a trust profile associated with the originating application process to the transmission;
releasing the transmission to the receiving server;
intercepting and validating the transmission at the receiving server by a second authentication agent on the receiving server,
wherein the validation comprises validating a digital signature placed in a payload of the transmission by the first authentication agent and comparing the trust profile received with the transmission to one of the policies, and
wherein the one of the policies comprises permitted interactions between the originating application process and the receiving application process;
removing the trust profile from the transmission and, when the validation is successful:
forwarding the transmission to the receiving application process for processing thereby; and
providing an acknowledgement transmission from the receiving server to the originating server confirming the transmission was received and processed by the receiving application process; and
when the validation is not successful, dropping the transmission such that it does not reach the receiving application process and no acknowledgement transmission is sent to the originating application process.
2. The method of claim 1 wherein the trust profile comprises a process identifier and a context.
3. The method of claim 2 wherein the context comprises one of a production environment, a testing environment and a development environment.
4. The method of claim 1 wherein the originating and receiving application processes support a common application.
5. The method of claim 1 wherein the policies are provided by a common policy server accessing a single policy store.
6. The method of claim 1 wherein providing the acknowledgment transmission comprises:
intercepting the acknowledgement transmission by the second authentication agent on the receiving server prior to transmission;
associating a trust profile associated with the receiving application process to the acknowledgement transmission; and
transmitting the acknowledgement transmission from the receiving server to the originating server; and
further comprising, at the originating server:
intercepting the acknowledgement transmission prior to reaching the originating application process;
validating the trust profile associated with the receiving application process; and
forwarding the acknowledgment transmission to the originating application process.
7. The method of claim 6 wherein validating the trust profile associated with the receiving application process comprises comparing the trust profile received with the acknowledgement transmission to one of the policies, and wherein the one of the policies comprises permitted interactions between the originating application process and the receiving application process.
8. The method of claim 7 further comprising permitting subsequent transmissions between the originating application process and receiving application process without interception by the first authentication agent or the second authentication agent.
9. A system for managing communication among application processes, the system comprising:
at least one memory for storing computer-executable instructions; and
at least one processing unit for executing the instructions stored on the at least one memory, wherein execution of the instructions programs the at least one processing unit to perform operations comprising:
providing authentication agents to a plurality of servers, each of the plurality of servers hosting one or more application processes and operating in different domains, wherein each authentication agent accesses policies related to each of the one or more application processes;
intercepting a transmission from an originating application process executing on an originating server by a first authentication agent on the originating server prior to transmission to a receiving application process processes executing on a receiving server;
appending a trust profile associated with the originating application process to the transmission;
releasing the transmission to the receiving server;
intercepting and validating the transmission at the receiving server by a second authentication agent on the receiving server,
wherein the validation comprises validating a digital signature placed in a payload of the transmission by the first authentication agent and comparing the trust profile received with the transmission to one of the policies, and
wherein the one of the policies comprises permitted interactions between the originating application process and the receiving application process;
removing the trust profile from the transmission and, when the validation is successful succeeded:
forwarding the transmission to the receiving application process for processing thereby; and
providing an acknowledgement transmission from the receiving server to the originating server confirming the transmission was received and processed by the receiving application process; and
when the validation is not successful, dropping the transmission such that it does not reach the receiving application process and no acknowledgement transmission is sent to the originating application process.
10. The system of claim 9 wherein the trust profile comprises a process identifier and a context.
11. The system of claim 10 wherein the context comprises one of a production environment, a testing environment and a development environment.
12. The system of claim 9 wherein the originating and receiving application processes support a common application.
13. The system of claim 9 further comprising a common policy server for providing the policies from a single policy store.
14. The system of claim 9 wherein providing the acknowledgment transmission comprises:
intercepting the acknowledgement transmission by the second authentication agent on the receiving server prior to transmission;
associating a trust profile associated with the receiving application process to the acknowledgement transmission; and
transmitting the acknowledgement transmission from the receiving server to the originating server; and
further comprising, at the originating server:
intercepting the acknowledgement transmission prior to reaching the originating application process;
validating the trust profile associated with the receiving application process; and
forwarding the acknowledgment transmission to the originating application process.
15. The system of claim 14 wherein validating the trust profile associated with the receiving application process comprises comparing the trust profile received with the acknowledgement transmission to one of the policies, and wherein the one of the policies comprises permitted interactions between the originating application process and the receiving application process.
16. The system of claim 15 wherein subsequent transmissions between the originating application process and receiving application process are permitted without interception by the first authentication agent or the second authentication agent.