Securing internal services in a distributed environment
Disclosed herein are methods, systems, and processes to secure internal services in a distributed environment. A service call initiated by a client process of a client is intercepted. In this example, the service call is a request for an internal service provided by a server deployed in a target appliance. The client is deployed in a source appliance. The service call includes an identifier, and the identifier identifies the internal service. If one or more rules are specified for the identifier, a service packet is generated by multiplexing client information associated with the client process as well as information in the service call. The service packet is forwarded to the target appliance.
1. A method comprising:
intercepting a service call initiated by a client process of a client, wherein
the client is deployed in a source appliance,
the service call is a request for provision of an internal service by a server deployed in a target appliance,
the service call comprises an identifier, and
the identifier identifies the internal service;
determining whether one or more rules of a plurality of rules are specified for the identifier; and
in response to a determination that the one or more rules are specified for the identifier,
generating a service packet by multiplexing client information and information specified in the service call, and
forwarding the service packet to the target appliance.
2. The method of claim 1 , further comprising:
accessing source kernel memory of the source appliance; and
retrieving the client information from source kernel memory, wherein
the client information comprises one or more client process properties of a plurality of client process properties associated with the client process.
3. The method of claim 2 , further comprising:
intercepting the service packet forwarded to the target appliance;
demultiplexing the service packet to retrieve the client information;
processing one or more attributes of at least one rule using the client information; and
forwarding the service call to the server, if the processing indicates that the forwarding the service call is allowable.
4. The method of claim 3 , wherein
the plurality of client process properties comprise a user context, a user group context, a client program name, a parent process name, or a terminal type.
5. The method of claim 4 , wherein
each rule of the one or more rules comprises one or more attributes, and
each attribute of the one or more attributes corresponds to a client process property of the plurality of client process properties.
6. The method of claim 4 , further comprising:
forwarding the service call to the server if no rule is specified for the identifier.
7. The method of claim 4 , wherein
the processing comprises
determining whether each attribute of at least one rule matches a corresponding client process property.
8. The method of claim 7 , wherein
the one or more rules are part of a rule set,
the rule set is part of
a source service call filter module, and
a target service call filter module,
the source kernel comprises a multiplexing module that performs the multiplexing, and
the target kernel comprises a demultiplexing module that performs the demultiplexing.
9. The method of claim 8 , further comprising:
accessing the rule set to determine whether the internal service identified by the identifier is unprotected or protected.
10. The method of claim 9 , wherein
the internal service is protected if the rule set comprises at least one rule of the plurality of rules for the identifier specified in the service call, and
the internal service is unprotected if the rule set does not comprise at least one rule of the plurality of rules for the identifier specified in the service call.
11. A non-transitory computer readable storage medium storing program instructions executable to:
intercept a service call initiated by a client process of a client, wherein
the client is deployed in a source appliance,
the service call is a request for provision of an internal service by a server deployed in a target appliance,
the service call comprises an identifier, and
the identifier identifies the internal service;
determine whether one or more rules of a plurality of rules are specified for the identifier; and
in response to a determination that the one or more rules are specified for the identifier,
generate a service packet by multiplexing client information and information specified in the service call, and
forward the service packet to the target appliance.
12. The non-transitory computer readable storage medium of claim 11 , further comprising:
accessing source kernel memory of the source appliance; and
retrieving the client information from source kernel memory, wherein
the client information comprises one or more client process properties of a plurality of client process properties associated with the client process, and
the plurality of client process properties comprise a user context, a user group context, a client program name, a parent process name, or a terminal type.
13. The non-transitory computer readable storage medium of claim of claim 12 , further comprising:
intercepting the service packet forwarded to the target appliance;
demultiplexing the service packet to retrieve the client information;
processing one or more attributes of at least one rule using the client information; and
forwarding the service call to the server, if the processing indicates that the forwarding the service call is allowable.
14. The non-transitory computer readable storage medium of claim of claim 13 , wherein
each rule of the one or more rules comprises one or more attributes, and
each attribute of the one or more attributes corresponds to a client process property of the plurality of client process properties.
15. The non-transitory computer readable storage medium of claim of claim 14 , wherein
the processing comprises
determining whether each attribute of at least one rule matches a corresponding client process property.
16. A system comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
intercept a service call initiated by a client process of a client, wherein
the client is deployed in a source appliance,
the service call is a request for provision of an internal service by a server deployed in a target appliance,
the service call comprises an identifier, and
the identifier identifies the internal service;
determine whether one or more rules of a plurality of rules are specified for the identifier; and
in response to a determination that the one or more rules are specified for the identifier,
generate a service packet by multiplexing client information and information specified in the service call, and
forward the service packet to the target appliance.
17. The system of claim 16 , further comprising:
accessing source kernel memory of the source appliance; and
retrieving the client information from source kernel memory, wherein
the client information comprises one or more client process properties of a plurality of client process properties associated with the client process, and
the plurality of client process properties comprise a user context, a user group context, a client program name, a parent process name, or a terminal type.
18. The system of claim 17 , further comprising:
intercepting the service packet forwarded to the target appliance;
demultiplexing the service packet to retrieve the client information;
processing one or more attributes of at least one rule using the client information; and
forwarding the service call to the server, if the processing indicates that the forwarding the service call is allowable.
19. The system of claim of claim 18 , wherein
each rule of the one or more rules comprises one or more attributes, and
each attribute of the one or more attributes corresponds to a client process property of the plurality of client process properties.
20. The system of claim of claim 19 , wherein
the processing comprises
determining whether each attribute of at least one rule matches a corresponding client process property.