Systems and methods for context based access control in a bridge server
Systems, devices, and methods are discussed for context protected access to an air-gapped network resource via a bridge server.
1. A method for performing context based security for an isolated network element, the method comprising:
resolving, by a bridge server, a requested resource using a proxy included in a received command, wherein the requested resource is an air-gapped resource associated with an air-gapped network that is accessible to an outside network only via the bridge server;
accessing, by the bridge server, a security policy associated with the requested resource;
analyzing, by the bridge server, the received command based at least in part on a context of the received command and the security policy; and
based upon a determination that the received command is acceptable, transferring a communication corresponding to the command to the requested resource.
2. The method of claim 1 , wherein the communication corresponding to the command includes a command component of the received command.
3. The method of claim 2 , wherein the communication corresponding to the command additionally includes a source address identifying the bridge server.
4. The method of claim 2 , wherein the communication corresponding to the command additionally includes a source address identifying a source of the received command.
5. The method of claim 1 , wherein the received command is a first received command, wherein the proxy is a first proxy, the method further comprising:
resolving, by the bridge server, the requested resource using a second proxy included in a second received command;
accessing, by the bridge server, the security policy associated with the requested resource;
analyzing, by the bridge server, the second received command based at least in part on a context of the second received command and the security policy; and
based upon a determination that the second received command is not acceptable, deleting the second received command.
6. The method of claim 1 , wherein the security policy applies at least one context based decision, and wherein the context based decision is based upon a context selected from a group consisting of: an identity of an individual generating the received command, an origin of the received command, a submission time of the received command, and an intent of the command.
7. The method of claim 6 , wherein the security policy applies at least one context based decision, and wherein the context based decision is based upon a context including two or more of: an identity of an individual generating the received command, an origin of the received command, a submission time of the received command, and an intent of the command.
8. The method of claim 1 , the method further comprising:
receiving, by the bridge server, an encrypted information packet from a network element via a communication network; and
decrypting, by the processing resource, the encrypted information packet to yield the received command.
9. A bridge server for performing context based security for an isolated network element, the bridge server comprising:
a processing resource;
a non-transitory computer readable medium coupled to the processing resource and having stored therein instructions that when executed by the processing resource cause the processing resource to:
resolve a requested resource using a proxy included in a received command, wherein the requested resource is an air-gapped resource associated with an air-gapped network that is accessible to an outside network only via the bridge server;
access a security policy associated with the requested resource;
analyze the received command based at least in part on a context of the received command and the security policy; and
based upon a determination that the received command is acceptable, transfer a communication corresponding to the command to the requested resource.
10. The bridge server of claim 9 , wherein the communication corresponding to the command includes a command component of the received command.
11. The bridge server of claim 10 , wherein the communication corresponding to the command additionally includes a source address identifying the bridge server.
12. The bridge server of claim 10 , wherein the communication corresponding to the command additionally includes a source address identifying a source of the received command.
13. The bridge server of claim 9 , wherein the received command is a first received command, wherein the proxy is a first proxy, and wherein the non-transient computer readable medium has stored therein instructions that when executed by the processing resource further cause the processing resource to:
resolve the requested resource using a second proxy included in a second received command;
access the security policy associated with the requested resource;
analyze the second received command based at least in part on a context of the second received command and the security policy; and
based upon a determination that the second received command is not acceptable, delete the second received command.
14. The bridge server of claim 9 , wherein the security policy applies at least one context based decision, and wherein the context based decision is based upon a context selected from a group consisting of: an identity of an individual generating the received command, an origin of the received command, a submission time of the received command, and an intent of the command.
15. The bridge server of claim 14 , wherein the security policy applies at least one context based decision, and wherein the context based decision is based upon a context including two or more of: an identity of an individual generating the received command, an origin of the received command, a submission time of the received command, and an intent of the command.
16. The bridge server of claim 9 , wherein the instructions further cause the processing resource to:
receive an encrypted information packet from a network element via a communication network; and
decrypt the encrypted information packet to yield the received command.
17. A non-transitory computer readable medium having stored therein instructions that when executed by a processing resource of a bridge server cause the processing resource to:
resolve a requested resource using a proxy included in a received command, wherein the requested resource is an air-gapped resource associated with an air-gapped network that is accessible to an outside network only via the bridge server;
access a security policy associated with the requested resource;
analyze the received command based at least in part on a context of the received command and the security policy; and
based upon a determination that the received command is acceptable, transfer a communication corresponding to the command to the requested resource.
18. The non-transitory computer readable medium of claim 17 , wherein the security policy applies at least one context based decision, and wherein the context based decision is based upon a context including two or more of: an identity of an individual generating the received command, an origin of the received command, a submission time of the received command, and an intent of the command.
19. The non-transitory computer readable medium of claim 17 , wherein the communication corresponding to the command includes a command component of the received command.
20. The non-transitory computer readable medium of claim 19 , wherein the communication corresponding to the command additionally includes a source address identifying the bridge server.