OPEN SESAME
Disclosed in some examples are methods, systems, machine-readable mediums, and computing devices for improved network security for network-based services. A firewall service protecting one or more provider computing devices that providing the network-based service may block all traffic by default. This prevents any network intrusions. A client computing device wishing to access a network-based service contacts an authority computing device of the network-based service. If the client computing device is authenticated by the authority computing device, the authority device provides a network address of a provider computing device which provides the network-based service for the account that was authenticated. The authority computing device also sends a message to a firewall service providing the firewall for the provider computing device to open a temporary hole in the firewall for the client computing device.
1 . A method for network security, the method comprising:
at a first computing device:
receiving, over a network, an access request from an application on a second computing device for access to a network-based service;
authenticating the second computing device;
determining a third computing device, the third computing device providing the network-based service; and
causing a firewall protecting the third computing device to allow a connection between the third computing device and the second computing device, the firewall denying all connections unless first allowed by the first computing device.
2 . The method of claim 1 , further comprising:
sending an address of the third computing device to the second computing device.
3 . The method of claim 1 , wherein the causing the firewall protecting the third computing device to allow a connection between the third computing device and the second computing device comprises allow the connection between the third computing device and the second computing device for a limited time, and wherein the firewall denies the connection from the second computing device after the limited time.
4 . The method of claim 1 , wherein the firewall denies the connection from the second computing device after a predetermined period of not receiving a communication from the second computing device.
5 . The method of claim 1 , wherein the firewall is provided by a service of the third computing device.
6 . The method of claim 1 , wherein the network-based service is a file access service.
7 . The method of claim 1 , wherein the method further comprises:
responsive to authenticating the second computing device, identifying one or more access conditions, the access conditions comprising one or more of: a list of allowable network identifiers, a list of prohibited network identifiers, a list of allowed geolocations, a list of prohibited geolocations, a list of allowed times of day, a list of prohibited times of day; and
determining that the second computing device meets the access conditions and wherein the causing the firewall protecting the third computing device to allow a connection between the third computing device and the second computing device is done responsive to determining that the second computing device meets the access conditions.
8 . A computing device for network security, the computing device comprising:
a processor;
a memory, the memory storing instructions, which when executed by the processor, cause the computing device to perform operations comprising:
receiving, over a network, an access request from an application on a second computing device for access to a network-based service;
authenticating the second computing device;
determining a third computing device, the third computing device providing the network-based service; and
causing a firewall protecting the third computing device to allow a connection between the third computing device and the second computing device, the firewall denying all connections unless first allowed by the computing device.
9 . The computing device of claim 8 , wherein the operations further comprise:
sending an address of the third computing device to the second computing device.
10 . The computing device of claim 8 , wherein the operations of causing the firewall protecting the third computing device to allow the connection between the third computing device and the second computing device comprises causing the firewall protecting the third computing device to allow the connection between the third computing device and the second computing device for a limited time, and wherein the firewall denies the connection from the second computing device after the limited time.
11 . The computing device of claim 8 , wherein the firewall denies the connection from the second computing device after a predetermined period of not receiving a communication from the second computing device.
12 . The computing device of claim 8 , wherein the firewall is provided by a service of the third computing device.
13 . The computing device of claim 8 , wherein the network-based service is a file access service.
14 . The computing device of claim 8 , wherein the operations further comprise responsive to authenticating the second computing device, identifying one or more access conditions, the access conditions comprising one or more of: a list of allowable network identifiers, a list of prohibited network identifiers, a list of allowed geolocations, a list of prohibited geolocations, a list of allowed times of day, a list of prohibited times of day; and
determining that the second computing device meets the access conditions and wherein the causing the firewall protecting the third computing device to allow a connection between the third computing device and the second computing device is done responsive to determining that the second computing device meets the access conditions.
15 . A system for network security, the system comprising:
a first computing device comprising:
a processor;
a memory, the memory storing instructions, which when executed by the processor, cause the first computing device to perform operations comprising:
receiving, over a network, an access request from an application on a second computing device for access to a network-based service;
authenticating the second computing device;
determining a third computing device, the third computing device providing the network-based service; and
sending a message causing a firewall device protecting the third computing device to allow a connection between the third computing device and the second computing device, the firewall device denying all connections unless first allowed by the first computing device; and
the firewall device, comprising:
a second processor;
a second memory, the second memory storing second instructions, which when executed by the second processor, cause the firewall device to perform second operations comprising:
maintaining a list of allowed traffic to the third computing device, the list of allowed traffic being initially empty;
blocking all network traffic to the third computing device that is not on the list of allowed traffic;
receiving from the first computing device the message to allow the connection between the third computing device and the second computing device;
responsive to receiving the message from the first computing device, storing a source address of the third computing device and a source address of the second computing device in the list of allowed traffic; and
subsequent to receiving from the first computing device the message, allowing traffic from the second computing device to the third computing device for a limited time, and upon expiry of the limited time, removing the source address of the third computing device and a source address of the second computing device in the list of allowed traffic such that subsequent network traffic from the second computing device is blocked unless another message is first received from the first computing device to allow the traffic.
16 . The system of claim 15 , wherein the operations executed by the processor further comprise sending an address of the third computing device to the second computing device.
17 . The system of claim 15 , wherein the firewall device is the third computing device.
18 . The system of claim 15 , wherein the operations executed by the second processor further comprise:
responsive to receiving from the first computing device the message and prior to being contacted by the second computing device, performing one or more of: initializing a data structure used to service an expected request from the second computing device; starting a software application used to service the expected request from the second computing device; reserving computing resources to service the expected request from the second computing device; or creating a user interface descriptor to service the expected request from the second computing device.
19 . The system of claim 15 , wherein the network-based service is a file access service.
20 . The system of claim 15 , wherein the operations executed by the processor further comprise responsive to authenticating the second computing device, identifying one or more access conditions, the access conditions comprising one or more of: a list of allowable network identifiers, a list of prohibited network identifiers, a list of allowed geolocations, a list of prohibited geolocations, a list of allowed times of day, a list of prohibited times of day; and
determining that the second computing device meets the access conditions and wherein the causing the firewall device protecting the third computing device to allow a connection between the third computing device and the second computing device is done responsive to determining that the second computing device meets the access conditions.