Confining lateral traversal within a computer network
Confining lateral traversal within a network. An authorization request identifies a credential, a protected first resource, and an identifier of a protected second resource for which authorization is requested. A lateral traversal policy associated with the second resource is identified, which constrains access to the second resource to only resources that belong to a subset of resources including the second resource. When it is determined that the credential is configured for access to the second resource, and when it is determined that the first resource belongs to the subset of resources including the second resource, an authorization token is issued, which authorizes the credential to access the second resource via the first resource. Alternatively, when it is determined that the credential is granted access to the second resource, and when it is determined that the first resource is outside of the particular subset of resources, the authorization request is denied.
1. A method, implemented at a computer system that includes a processor, for confining lateral traversal within a computer network, the method comprising:
receiving an authorization request that includes (a) an authentication token that identifies a credential and a first protected resource within the computer network, and (b) an identifier of a second protected resource within the computer network for which authorization is requested;
determining, based on a capability of the credential, that the credential is configured for access to the second protected resource and is valid for accessing the second protected resource, wherein the capability of the credential is a group membership associated with the credential;
identifying a lateral traversal policy associated with the second protected resource, the lateral traversal policy:
defining the second protected resource to be part of a particular subset of resources to which the second protected resource belongs; and
constraining access to the second protected resource to only resources within the computer network that belong to the particular subset of resources to which the second protected resource belongs;
determining that the first protected resource does not belong to the particular subset of resources to which the second protected resource belongs; and
denying the authorization request based on the first protected resource not belonging to the particular subset of resources to which the second protected resource belongs, even though the credential is valid for accessing the second protected resource.
2. The method of claim 1 , further comprising logging denial of the authorization request, including logging the credential, the first protected resource, and the second protected resource.
3. The method of claim 1 , further comprising configuring a network to deny network communications from the first protected resource to the second protected resource.
4. The method of claim 1 , further comprising, prior to denying the authorization request, determining that no exception applies to a lateral traversal denial between the first protected resource and the second protected resource.
5. The method of claim 1 , wherein the authentication token is a ticket-granting ticket (TGT), and the authorization token is a client-to-server ticket issued by a ticket-granting service (TGS).
6. The method of claim 1 , wherein the credential is configured for access to the second protected resource just-in-time.
7. The method of claim 1 , wherein determining whether or not the first protected resource belongs to the particular subset of resources to which the second protected resource belongs comprises comparing a first subset membership attribute of the first protected resource with a second subset membership attribute of the second protected resource.
8. The method of claim 1 , wherein the authentication token also identifies one or more attributes of the first protected resource, and wherein the one or more attributes of the first protected resource are utilized for at least one of:
(a) the determining whether or not the credential is configured for access to the second protected resource, or
(b) the determining whether or not the first protected resource belongs to the particular subset of resources to which the second protected resource belongs.
9. The method of claim 1 , wherein the method further comprises determining the capability of the credential by performing a lookup in a directory.
10. A computer system for confining lateral traversal within a computer network, comprising:
a processor; and
a hardware storage device that stores computer-executable instructions that are executable by the processor to cause the computer system to at least:
receive an authorization request that includes (a) an authentication token that identifies a credential and a first protected resource within the computer network, and (b) an identifier of a second protected resource within the computer network for which authorization is requested;
determine, based on a capability of the credential, that the credential is configured for access to the second protected resource and is valid for accessing the second protected resource, wherein the capability of the credential is a group membership associated with the credential;
identify a lateral traversal policy associated with the second protected resource, the lateral traversal policy:
defining the second protected resource to be part of a particular subset of resources to which the second protected resource belongs; and
constraining access to the second protected resource to only resources within the computer network that belong to the particular subset of resources to which the second protected resource belongs;
determine that the first protected resource does not belong to the particular subset of resources to which the second protected resource belongs; and
deny the authorization request based on the first protected resource not belonging to the particular subset of resources to which the second protected resource belongs, even though the credential is valid for accessing the second protected resource.
11. The computer system of claim 10 , wherein the authentication token is a ticket-granting ticket (TGT), and the authorization token is a client-to-server ticket issued by a ticket-granting service (TGS).
12. The computer system of claim 10 , wherein the credential is configured for access to the second protected resource just-in-time.
13. The computer system of claim 10 , wherein the computer-executable instructions are also executable by the processor to cause the computer system to log denial of the authorization request, including logging the credential, the first protected resource, and the second protected resource.
14. The computer system of claim 10 , wherein the computer-executable instructions are also executable by the processor to cause the computer system to configure a network to deny network communications from the first protected resource to the second protected resource.
15. The computer system of claim 10 , wherein the computer-executable instructions are also executable by the processor to cause the computer system to, prior to denying the authorization request, determine that no exception applies to a lateral traversal denial between the first protected resource and the second protected resource.
16. The computer system of claim 10 , wherein determining whether or not the first protected resource belongs to the particular subset of resources to which the second protected resource belongs comprises comparing a first subset membership attribute of the first protected resource with a second subset membership attribute of the second protected resource.
17. The computer system of claim 10 , wherein the authentication token also identifies one or more attributes of the first protected resource, and wherein the one or more attributes of the first protected resource are utilized for at least one of:
(a) the determining whether or not the credential is configured for access to the second protected resource, or
(b) the determining whether or not the first protected resource belongs to the particular subset of resources to which the second protected resource belongs.
18. A computer readable hardware storage device that stores computer-executable instructions that are executable by a processor to cause a computer system to confine lateral traversal within a computer network, the computer-executable instructions including instructions that are executable by the processor to cause the computer system to at least:
receive an authorization request that includes (a) an authentication token that identifies a credential and a first protected resource within the computer network, and (b) an identifier of a second protected resource within the computer network for which authorization is requested;
determine, based on a capability of the credential, that the credential is configured for access to the second protected resource and is valid for accessing the second protected resource, wherein the capability of the credential is a group membership associated with the credential;
identify a lateral traversal policy associated with the second protected resource, the lateral traversal policy:
defining the second protected resource to be part of a particular subset of resources to which the second protected resource belongs; and
constraining access to the second protected resource to only resources within the computer network that belong to the particular subset of resources to which the second protected resource belongs;
determine that the first protected resource does not belong to the particular subset of resources to which the second protected resource belongs; and
deny the authorization request based on the first protected resource not belonging to the particular subset of resources to which the second protected resource belongs, even though the credential is valid for accessing the second protected resource.
19. The computer readable hardware storage device of claim 18 , wherein the instructions are also executable by the processor to cause the computer system to log denial of the authorization request, including logging the credential, the first protected resource, and the second protected resource.
20. The computer readable hardware storage device of claim 18 , wherein the instructions are also executable by the processor to cause the computer system to configure a network to deny network communications from the first protected resource to the second protected resource.