Secure in-band service detection
Approaches described herein allow an appliance to receive a message from a client device when the client device is attempting to connect to a service other than the appliance. For instance, a client device might connect to a service on a private network, however if the client device is not on the private network, it may encounter an appliance such as a gateway. The appliance is configured to return a message to a client device indicating that it is an appliance, and the client device returns a certificate to the appliance that allows the client to indicate a first purpose of a connection and a second purpose of the connection. In approaches described herein, the second purpose is used by the appliance to perform an action related to providing the service with a certificate that allows for the first purpose, which can include information to create a secure connection between the service and the client device.
1. An appliance, comprising:
a memory storing a set of instructions; and
one or more processors configured to execute the set of instructions to cause the appliance to:
acquire a first handshake message from a client device, wherein the first handshake message is intended for a service;
provide a second handshake message for the client device, wherein the second handshake message includes a first certificate referring to the appliance;
acquire, from the client device, a second certificate indicating a first function of a connection and a second function of the connection subsequent to when the client device determines that the appliance is authorized to assist with providing a secure connection between the client device and the service based on results of the client device's examination of the first certificate; and
determine, based on the second function, an action associated with providing the service with the second certificate indicating the first function.
2. The appliance of claim 1 , wherein information indicating the second function is included in an extension of the second certificate.
3. The appliance of claim 1 , wherein the action includes determining a location of the service to send the second certificate.
4. The appliance of claim 1 , wherein the first function is to facilitate authentication of the client device at the service.
5. The appliance of claim 1 , wherein the second function indicates a type of data included in a payload.
6. The appliance of claim 5 , wherein the action includes determining a destination of the payload, and wherein the destination of the payload is determined at least in part by the type of data included in the payload.
7. The appliance of claim 6 , wherein the action includes denying the providing of the second certificate to the service.
8. A method for transmitting data, the method being performed by one or more processors and comprising:
acquiring a first handshake message from a client device, wherein the first handshake message is intended for a service;
providing a second handshake message for the client device, wherein the second handshake message includes a first certificate referring to an appliance;
acquiring, from the client device, a second certificate indicating a first function of a connection and second function of a connection subsequent to when the client device determines that the appliance is authorized to assist with providing a secure connection between the client device and the service based on results of the client device's examination of the first certificate; and
determining, based on the second function, an action associated with providing the service with the second certificate indicating the first function.
9. The method of claim 8 , wherein information indicating the second function is included in an extension of the second certificate.
10. The method of claim 8 , wherein the action includes determining a location of the service to send the second certificate.
11. The method of claim 8 , wherein the first function is to facilitate an authentication of the client device at the service.
12. The method of claim 8 , wherein the second function indicates a type of data included in a payload.
13. The method of claim 12 , wherein the action includes determining a destination of the payload, and wherein the destination of the payload is determined at least in part by the type of data included in the payload.
14. The method of claim 13 , wherein the type of data is selected from the group consisting of:
data associated with medical records, data associated with legal documents, data associated with source code, financial information, banking information, data associated with human resources, and data associated with privacy information.
15. A nontransitory computer readable storage medium storing a set of instructions that are executable by at least one processor of an appliance, to cause the appliance to perform a method for transmitting data, the method comprising:
acquiring a first handshake message from a client device, wherein the first handshake message is intended for a service;
providing a second handshake message for the client device, wherein the second handshake message includes a first certificate referring to the appliance;
acquiring, from the client device, a second certificate indicating a first function of a connection and second function of a connection subsequent to when the client device determines that the appliance is authorized to assist with providing a secure connection between the client device and the service based on results of the client device's examination of the first certificate; and
determining, based on the second function, an action associated with providing the service with the second certificate indicating the first function.
16. The nontransitory computer readable storage medium of claim 15 , wherein information indicating the second function is included in an extension of the second certificate.
17. The nontransitory computer readable storage medium of claim 15 , wherein the action includes determining a location of the service to send the second certificate.
18. The nontransitory computer readable storage medium of claim 15 , wherein the first function is to facilitate authentication of the client device at the service.
19. The nontransitory computer readable storage medium of claim 15 , wherein the second function indicates a type of data included in a payload.
20. The nontransitory computer readable storage medium of claim 15 , wherein the action includes determining a destination of the payload, and wherein the destination of the payload is determined at least in part by the type of data included in the payload.
21. A client device, comprising:
a memory storing a set of instructions; and
one or more processors configured to execute the set of instructions to cause the client device to:
provide a handshake message intended for a service;
acquire a first certificate;
perform an examination of the first certificate;
if the examination indicates that the first certificate was provided by the service, provide a second certificate indicating a first function of the connection to the service; and
if the examination indicates that the first certificate was provided by an appliance other than the service, provide a third certificate indicating the first function of a connection and a second function of the connection to the appliance, wherein the second function is configured to cause the appliance to perform an action associated with providing the third certificate to the service.