Method for securing the rendezvous connection in a cloud service using routing tokens
Systems and methods for establishing a secure connection are described. A server receives a plurality of routing tokens for establishing a service connection between a service node and the server along a network path through a plurality of network devices. The routing tokens can be validated by a corresponding network device. The server transmits a packet including the routing tokens to a first network device. The first network device validates a first routing token associated therewith, then directs the packet along the network path to a second network device, and so forth, until each of the network device receives and validates their routing token. The server establishes a cryptographic context between the service node and server for establishing a secure channel between the service node and the server. The server transmits a service node routing token to the service node via the secure channel for validation.
1. A method for establishing a secure connection, the method comprising:
receiving, by a server executing a service, a plurality of routing tokens for establishing a service connection between a service node and the server, along a network path through a plurality of network devices intermediary between the server and the service node, each of the routing tokens configured to be validated by a corresponding network device of the plurality of network devices;
transmitting, by the server towards the service node, a first packet comprising the plurality of routing tokens to a first network device of the plurality of network devices, to cause the first network device to validate a first routing token of the plurality of routing tokens and to direct the first packet along the network path to a second network device of the plurality of network devices using the first routing token for the first network device;
establishing a cryptographic context between the service node and the server, to establish a secure channel between the service node and the server along the network path; and
transmitting, from the server to the service node via the secure channel, a service node routing token to be validated by the service node.
2. The method of claim 1 , further comprising:
validating, by each of at least one of the server or the service node, the other one of the at least one of the server or the service node during negotiation of the cryptographic context.
3. The method of claim 1 , further comprising:
transmitting, from the server to the service node, handshake data for establishing the cryptographic context between the service node and the server.
4. The method of claim 3 , wherein the first packet includes the handshake data, and wherein the routing tokens are removed from the handshake data prior to the handshake data being received by the service node.
5. The method of claim 3 , further comprising:
responsive to establishing the service connection along the network path using the plurality of routing tokens, performing, by the server, negotiation of the cryptographic context directly with the service node using the handshake data.
6. The method of claim 1 , wherein each of the plurality of routing tokens is valid for a predetermined duration of time.
7. The method of claim 1 , wherein each of the plurality of routing tokens is valid for one-time use by a respective network device of the plurality of network devices.
8. The method of claim 1 , further comprising:
communicating, by the server, network traffic with the service node using the established cryptographic context, without decrypting or re-encrypting the network traffic at each of the plurality of network devices.
9. The method of claim 1 , further comprising:
causing the service node to validate the service connection between the service node and the server, using the service node routing token;
causing the service node to identify, using the service node routing token, a client connection between the client and the service node, the client connection having a local cryptographic context; and
causing the service node to communicate network traffic between the client and the server, using the local cryptographic context across the client connection, and using the established cryptographic context across the service connection between the service node and the server.
10. The method of claim 9 , further comprising validating, by the server, the service connection by authenticating the service node.
11. A system for establishing a secure connection, the system comprising:
a server in communication with a plurality of network devices intermediary between the server and a service node, the server providing a service to a client, the server configured to:
receive a plurality of routing tokens for establishing a service connection between the service node and the server, along a network path through the plurality of network devices, each of the routing tokens configured to be validated by a corresponding network device of the plurality of network devices;
transmit a first packet comprising the plurality of routing tokens to a first network device of the plurality of network devices, to cause the first network device to validate a first routing token of the plurality of routing tokens and to direct the first packet along the network path to a second network device of the plurality of network devices using the first routing token for the first network device;
establish a cryptographic context between the service node and server, to establish a secure channel between the service node and the server along the network path; and
transmit, from the server to the service node via the secure channel, a service node routing token to be validated by the service node.
12. The system of claim 11 , further comprising the service node, wherein each of at least one of the server or the service node is configured to validate the other one of the at least one of the server or the service node during negotiation of the cryptographic context.
13. The system of claim 11 , wherein the server is further configured to transmit handshake data to the service node for establishing the cryptographic context between the service node and server.
14. The system of claim 13 , wherein the first packet comprises the handshake data, and wherein the routing tokens are removed from the handshake data prior to the handshake data being received by the service node.
15. The system of claim 13 , wherein the server is further configured to: responsive to establishing the service connection along the network path using the plurality of routing tokens, perform negotiation of the cryptographic context directly with the service node using the handshake data.
16. The system of claim 11 , wherein each of the plurality of routing tokens are valid for a predetermined duration of time.
17. The system of claim 11 , wherein each of the plurality of routing tokens are valid for one-time use by a respective network device of the plurality of network devices.
18. The system of claim 11 , wherein the server is configured to communicate network traffic with the service node using the established cryptographic context, without decrypting or re-encrypting the network traffic at each of the plurality of network devices.
19. The system of claim 11 , wherein the server is further configured to: cause the service node to validate the service connection between the service node and the server, using the service node routing token;
cause the service node to identify, using the service node routing token, a client connection between the client and the service node, the client connection having a local cryptographic context; and
cause the service node to communicate network traffic between the client and the server, using the local cryptographic context across the client connection, and using the established cryptographic context across the service connection between the service node and the server.
20. The system of claim 19 , wherein the server is further configured to validate the service connection by authenticating the service node.