Controlling access to traversal using relays around network address translation (TURN) servers using trusted single-use credentials
Embodiments disclosed provide access to Traversal Using Relays around Network Address Translation (TURN) servers using trusted single-use credentials, and related methods, systems, and computer-readable media. In one embodiment, a method comprises receiving, by a TURN authentication agent, a request for a TURN server credential. Responsive to determining that the request is authorized, the agent generates a trusted single-use credential and transmits it to the requestor. Using this trusted single-use credential allows untrusted clients to access a TURN server without exposing a userid/password combination. In another embodiment, a method comprises receiving, by the TURN server, a request for a TURN service. The server challenges the request, and receives a userid and a password. Responsive to determining that the userid and the password constitute a trusted single-use credential and responsive to determining that the request is authorized, the server provides the TURN service for the requestor.
1. A method for controlling access to Traversal Using Relays around Network Address Translation (TURN) servers, the method comprising:
receiving, by a TURN authentication agent executing on a computing device, a request for a TURN server credential from a requesting Web Real-Time Communications (WebRTC) client;
determining the request for the TURN server credential is authorized;
generating a trusted single-use credential in response to determining the request is authorized, wherein the trusted single-use credential comprises an authentication token, wherein the authentication token comprises a domain address identifying an authorized domain for usage of a TURN server, and wherein generating the trusted single-use credential comprises generating the authentication token and encrypting the authentication token using a secret shared between the TURN authentication agent and the TURN server; and
transmitting the trusted single-use credential to the requesting WebRTC client, wherein the trusted single-use credential enables a TURN service for the requesting WebRTC client.
2. The method of claim 1 , wherein determining the request for the TURN server credential is authorized comprises determining the request originated from an authorized requestor.
3. The method of claim 2 , wherein determining the request originated from the authorized requestor comprises examining an origin header of the request.
4. The method of claim 1 , wherein generating the trusted single-use credential comprises generating the authentication token to include in the trusted single-use credential.
5. The method of claim 4 , wherein the authentication token further comprises a value selected from the group consisting of: an expiration time stamp; a nonce value; a signature; and enterprise policy instructions.
6. The method of claim 1 , wherein the authentication token further comprises enterprise policy instructions.
7. The method of claim 6 , wherein the TURN service is enabled according to the enterprise policy instructions.
8. A system for controlling access to Traversal Using Relays around Network Address Translation (TURN) servers, the system comprising:
a communications interface configured to communicate with a requesting Web Real-Time Communications (WebRTC) client;
a processor coupled with the communications interface; and
a computer-readable medium coupled with and readable by the processor and storing therein a set of TURN authentication agent instructions which, when executed by the processor, cause the processor to:
receive, by a TURN authentication agent executing on the system, a request for a TURN server credential from the requesting WebRTC client;
determine the request for the TURN server credential is authorized;
generate a trusted single-use credential in response to determining the request is authorized, wherein the trusted single-use credential comprises an authentication token, wherein the authentication token comprises a domain address identifying an authorized domain for usage of a TURN server, and wherein generating the trusted single-use credential comprises generating the authentication token and encrypting the authentication token using a secret shared between the TURN authentication agent and the TURN server; and
transmit the trusted single-use credential to the requesting WebRTC client, wherein the trusted single-use credential enables a TURN service for the requesting WebRTC client.
9. The system of claim 8 , wherein the authentication token to include in the trusted single-use credential further comprises a value selected from the group consisting of: an expiration time stamp; a nonce value; a signature; and
enterprise policy instructions.
10. The system of claim 8 , wherein determining the request for the TURN server credential is authorized comprises determining the request originated from an authorized requestor.
11. The system of claim 10 , wherein determining the request originated from the authorized requestor comprises examining an origin header of the request.
12. The system of claim 8 , wherein generating the trusted single-use credential comprises generating the authentication token to include in the trusted single-use credential.
13. The system of claim 8 , wherein the authentication token further comprises enterprise policy instructions.
14. The system of claim 13 , wherein the TURN service is enabled according to the enterprise policy instructions.
15. A non-transitory computer-readable medium storing one or more programs, the one or more programs comprising instructions, which when executed by an electronic device, cause the electronic device to implement a method for controlling access to Traversal Using Relays around Network Address Translation (TURN) servers, the method comprising:
receiving, by a TURN authentication agent, a request for a TURN server credential from a requesting Web Real-Time Communications (WebRTC) client;
determining the request for the TURN server credential is authorized;
generating a trusted single-use credential in response to determining the request is authorized, wherein the trusted single-use credential comprises an authentication token, wherein the authentication token comprises a domain address identifying an authorized domain for usage of a TURN server, and wherein generating the trusted single-use credential comprises generating the authentication token and encrypting the authentication token using a secret shared between the TURN authentication agent and the TURN server; and
transmitting the trusted single-use credential to the requesting WebRTC client, wherein the trusted single-use credential enables a TURN service for the requesting WebRTC client.
16. The medium of claim 15 , wherein determining the request for the TURN server credential is authorized comprises determining the request originated from an authorized requestor.
17. The medium of claim 16 , wherein determining the request originated from the authorized requestor comprises examining an origin header of the request.
18. The medium of claim 15 , wherein the authentication token further comprises a value selected from the group consisting of: an expiration time stamp; a nonce value; a signature; and enterprise policy instructions.
19. The medium of claim 15 , wherein the authentication token further comprises enterprise policy instructions.
20. The medium of claim 19 , wherein the TURN service is enabled according to the enterprise policy instructions.