Permission based access control for offloaded services

• US 10,104,085 B2
• Filed: 12/07/2015
• Issued: 10/16/2018
• Est. Priority Date: 12/07/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Horii, Hiroshi H., Mishina, Takuya
• Primary Examiner(s): Williams, Jeffery
• Application Number:
  US14/960,963
• Publication Number:
  US 20170163644A1
• Time in Patent Office: 1,044 Days
• Field of Search: None
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70

Abstract

Systems and methods for network access control, including sending a service request from an on-premise system to one or more offloaded front-end services on one or more offloading servers. The requests by the offloaded services to access back-end services in one or more on-premise systems are monitored, and access requests by the offloaded services for unauthorized back-end services are denied. The service request is redirected and locally executed to generate logs of the back-end services used to perform the service request if the access requests are denied. A permission mapping in a firewall between the offloaded services and the logged back-end services is updated to permit future access requests by the offloaded services.

Claims

1. A method for network access control, comprising:

sending a service request from an on-premise system to one or more offloaded front-end services on one or more offloading servers;

monitoring requests by the offloaded services to access back-end services in one or more on-premise systems, wherein access requests by the offloaded services for unauthorized back-end services are denied;

redirecting and locally executing the service request to generate logs of the back-end services used to perform the service request if the access requests are denied; and

updating a permission mapping in a firewall between the offloaded services and the logged back-end services to permit future access requests by the offloaded services.

2. The method as recited in claim 1, wherein the service request is speculatively sent to the offloading servers.

3. The method as recited in claim 1, wherein the offloading servers are located in a public cloud.

4. The method as recited in claim 1, wherein the on-premise systems are located in a private cloud.

5. The method as recited in claim 1, wherein a firewall policy is generated and dynamically maintained in real-time based on the updated permission mappings in the firewall.

6. The method as recited in claim 1, wherein an error is returned to a router if requests for unauthorized back-end services are detected, and the router redirects execution of the service request to an on-premise system in response to the error.

7. The method as recited in claim 4, wherein the private cloud includes a router for sending and redirecting the service request.

8. The method as recited in claim 6, wherein the firewall notifies the offloaded service of the error, and the offloaded service notifies the router of the error.

9. The method as recited in claim 1, further comprising determining, using a firewall, whether access to particular back-end services in the private cloud is authorized to the offloaded services, wherein the firewall returns an error to the offloaded services and the offloaded services return an error to an on-premise router if the access is unauthorized.

10. A system for network access control, comprising:

a controller for sending a service request from an on-premise system to one or more offloaded front-end services on one or more offloading servers;

a network monitor for detecting requests by the offloaded services to access back-end services in one or more on-premise systems,

wherein access requests by the offloaded services for unauthorized back-end services are denied, and

wherein the controller redirects and locally executes the service request to generate logs of the back-end services used to perform the service request if the access requests are denied; and

a firewall configured to permit the access requests by the offloaded services by updating a permission mapping in the firewall between the offloaded services and the logged back-end services.

11. The system as recited in claim 10, wherein the service request is speculatively sent to the offloading servers.

12. The system as recited in claim 10, wherein the offloading servers are located in a public cloud.

13. The system as recited in claim 10, wherein the on-premise systems are located in a private cloud.

14. The system as recited in claim 10, wherein a firewall policy of the firewall is generated and dynamically maintained in real-time based on the updated permission mapping in the firewall.

15. The system as recited in claim 10, wherein an error is returned to a router if requests for unauthorized back-end services are detected, and the router redirects execution of the service request to an on-premise system in response to the error.

16. The system as recited in claim 13, wherein the private cloud includes a router for sending and redirecting the service request.

17. The system as recited in claim 15, wherein the firewall notifies the offloaded service of the error, and the offloaded service notifies the router of the error.

18. The system as recited in claim 10, wherein the firewall is further configured to determine whether access to particular back-end services in the private cloud is authorized to the offloaded services, wherein the firewall returns an error to the offloaded services and the offloaded services return an error to an on-premise router if the access is unauthorized.

19. A computer readable storage medium comprising a computer readable program for providing access to one or more back-end services in a private cloud by one or more offloaded services in a public cloud, wherein the computer readable program when executed on a computer causes the computer to perform the steps of:

sending a service request from the private cloud to one or more offloaded front-end services in the public cloud;

monitoring requests by the offloaded services to access back-end services in the private cloud, wherein access requests by the offloaded services for unauthorized back-end services are detected and denied;

redirecting and locally executing the service request to generate logs of the back-end services used to perform the service request if the access requests are denied; and

updating a permission mapping in a firewall between the offloaded services and the logged back-end services to permit future access requests by the offloaded services.

20. The computer readable storage medium as recited in claim 19, wherein the service request is speculatively sent to the offloading servers using an on-premise router.