Network security dynamic access control and policy enforcement
A network security system and method provide dynamic access control for a protected resource using a client-initiated ticket generation scheme. A client application receives, from an access control manager, a limited-use access ticket and may include the limited-use access ticket within application program interface (API) calls to a service application. The service application may forward the limited-use access ticket as a service access ticket to a ticket-based access control layer. A transaction monitor monitors run-time transaction information generated by the API calls to the service application and if the limited-use access ticket is detected in the run-time transaction information, forward the limited-use access ticket to the access control manager to perform validation of the limited-use access ticket. The ticket-based access control layer compares the service access ticket to the validated limited-use access ticket and determine whether to grant the client application access to the protected resource based on the comparison.
1. A method comprising:
receiving, from an access control manager, a limited-use access ticket at a client application;
including the limited-use access ticket within application program interface (API) calls to a service application, the API calls to request data from a protected resource;
forwarding the limited-use access ticket as a service access ticket to a ticket-based access control layer;
monitoring run-time transaction information generated by the API calls to the service application, wherein a transaction monitor monitors the run-time transaction information and forwards the limited-use access ticket to the access control manager for a validation of the limited-use access ticket;
in response to detecting the limited-use access ticket in the run-time transaction information, performing the validation of the limited-use access ticket;
comparing, by the ticket-based access control layer, the service access ticket to the validated limited-use access ticket;
in response to determining that the service access ticket matches the validated limited-use ticket, granting the client application access to the protected resource.
2. The method of claim 1 , wherein the limited-use access ticket is a randomized limited-use access ticket.
3. The method of claim 1 , wherein the service access ticket is forwarded by the service application to the ticket-based access control layer while the service application performs application functions on behalf of the client application.
4. The method of claim 1 , wherein the limited-use access ticket is forwarded to the access control manager with an indication that the limited-use access ticket originates from the client application.
5. The method of claim 4 , further comprising:
providing, by the access control manager, the validated limited-use access ticket to the ticket-based access control layer.
6. The method of claim 1 , further comprising:
in response to determining that the service access ticket does not match the validated limited-use ticket, denying the client application access to the protected resource.
7. The method of claim 1 , wherein the validated limited-use ticket is one ticket in a list of validated access tickets stored on the ticket-based access control layer.
8. A system comprising:
a memory; and
a processor operatively coupled to the memory, the processor to:
receive, from an access control manager, a limited-use access ticket at a client application;
include the limited-use access ticket within application program interface (API) calls to a service application, the API calls to request data from a protected resource;
forward the limited-use access ticket as a service access ticket to a ticket-based access control layer;
monitor run-time transaction information generated by the API calls to the service application, wherein the processor uses a transaction monitor to monitor the run-time transaction information and forward the limited-use access ticket to the access control manager for a validation of the limited-use access ticket;
in response to detecting the limited-use access ticket in the run-time transaction information, perform the validation of the limited-use access ticket;
compare, by the ticket-based access control layer, the service access ticket to the validated limited-use access ticket;
in response to determining that the service access ticket matches the validated limited-use ticket, grant the client application access to the protected resource.
9. The system of claim 8 , wherein the limited-use access ticket is a randomized limited-use access ticket.
10. The system of claim 8 , wherein the processor forwards the service access ticket to the ticket-based access control layer using the service application while the service application performs application functions on behalf of the client application.
11. The system of claim 8 , wherein the limited-use access ticket is forwarded to the access control manager with an indication that the limited-use access ticket originates from the client application.
12. The system of claim 11 , wherein the processor is further to:
provide, by the access control manager, the validated limited-use access ticket to the ticket-based access control layer.
13. The system of claim 8 , wherein the processor is further to:
in response to determining that the service access ticket does not match the validated limited-use ticket, deny the client application access to the protected resource.
14. The system of claim 8 , wherein the validated limited-use ticket is one ticket in a list of validated access tickets stored on the ticket-based access control layer.
15. A non-transitory computer-readable medium having instructions stored thereon which, when executed by a processor, cause the processor to:
receive, from an access control manager, a limited-use access ticket at a client application;
include the limited-use access ticket within application program interface (API) calls to a service application, the API calls to request data from a protected resource;
forward the limited-use access ticket as a service access ticket to a ticket-based access control layer;
monitor run-time transaction information generated by the API calls to the service application, wherein the processor uses a transaction monitor to monitor the run-time transaction information and forward the limited-use access ticket to the access control manager for a validation of the limited-use access ticket;
in response to detecting the limited-use access ticket in the run-time transaction information, perform the validation of the limited-use access ticket;
compare, by the ticket-based access control layer, the service access ticket to the validated limited-use access ticket;
in response to determining that the service access ticket matches the validated limited-use ticket, grant the client application access to the protected resource.
16. The non-transitory computer-readable medium of claim 15 , wherein the limited-use access ticket is a randomized limited-use access ticket.
17. The non-transitory computer-readable medium of claim 15 , wherein the processor forwards the service access ticket to the ticket-based access control layer using the service application while the service application performs application functions on behalf of the client application.
18. The non-transitory computer-readable medium of claim 15 , wherein the limited-use access ticket is forwarded to the access control manager with an indication that the limited-use access ticket originates from the client application.
19. The non-transitory computer-readable medium of claim 18 , wherein the processor is further to:
provide, by the access control manager, the validated limited-use access ticket to the ticket-based access control laver.
20. The non-transitory computer-readable medium of claim 15 , wherein the processor is further to: in response to determining that the service access ticket does not match the validated limited-use ticket, deny the client application access to the protected resource.