Secure proxying using network intermediaries

• US 8,799,641 B1
• Filed: 12/16/2011
• Issued: 08/05/2014
• Est. Priority Date: 12/16/2011
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Roth, Gregory B., Baer, Graeme D., Seidenberg, Benjamin E.
• Primary Examiner(s): MOORTHY, ARAVIND K
• Application Number:
  US13/328,803
• Time in Patent Office: 963 Days
• Field of Search: 726/2, 726/3, 726/4, 726/5, 726/6, 726/22, 726/12, 709/201, 709/203, 709/227, 713/153, 713/160, 713/168, 713/170, 713/176
• US Class Current: 713/153
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Methods and apparatus for secure proxying using network intermediaries. A system may include one or more servers and a network intermediary. The network intermediary may generate security metadata associated with a client request, comprising an identification of a source of the client request, and transmit an encoded version of the security metadata and a backend request to a server. The server may determine whether the security metadata is valid. If the security metadata is validated, the server may perform one or more operations in accordance with the backend request and the security metadata.

Claims

1. A system, comprising:

one or more servers; and

a hardware device configured to implement a network intermediary;

wherein the network intermediary is configured to;

receive a client request;

generate security metadata associated with the client request, wherein the security metadata comprises an identification of a source of the client request; and

transmit an encoded version of the security metadata and a backend request corresponding to the client request to a server of the one or more servers, wherein the encoded version is based at least in part on at least a portion of the security metadata and a key held by the network intermediary; and

wherein the server is configured to;

determine whether the security metadata is valid;

in response to determining that the security metadata is valid, perform one or more operations in accordance with the backend request and the security metadata; and

in response to determining that the security metadata is not valid, reject the backend request.

2. The system as recited in claim 1, wherein the network intermediary transmits at least a portion of the backend request to the server in plain text.

3. The system as recited in claim 1, wherein the identification of the source of the client request comprises a network protocol header.

4. The system as recited in claim 1, wherein the network intermediary comprises at least one of:

a load balancer, a proxy server, or a store-and-forward device.

5. The system as recited in claim 1, wherein the security metadata comprises an indication of a completion of a security analysis of the client request at the network intermediary.

6. A method, comprising:

generating security metadata associated with a client request received at a network intermediary, wherein the security metadata comprises an identification of a source of the client request; and

transmitting an encoded version of the security metadata to a server from the network intermediary, wherein the encoded version is based at least in part on at least a portion of the security metadata and a key held by the network intermediary,

determining, at the server, whether the security metadata is valid;

in response to determining that the security metadata is valid, performing one or more operations responsive to the client request and the security metadata at the server; and

in response to determining that the security metadata is not valid, generating an error response.

7. The method as recited in claim 6, wherein the network intermediary comprises at least one of:

a load balancer, a proxy server, or a store-and-forward device.

8. The method as recited in claim 6, further comprising:

prior to generating the security metadata, receiving the client request at the network intermediary over a client connection established between a client and the network intermediary;

wherein said transmitting the encoded version of the security metadata comprises transmitting the encoded version of the security metadata over a server connection established between the network intermediary and the server.

9. The method as recited in claim 6, further comprising:

prior to determining whether the security metadata is valid at the server, transmitting a backend request derived from the client request to the server from the network intermediary over a first server connection established between the network intermediary and the server;

wherein said transmitting the encoded version of the security metadata comprises transmitting the encoded version of the security metadata over a second server connection established between the network intermediary and the server.

10. The method as recited in claim 6, further comprising:

prior to transmitting the encoded version of the security metadata to the server, generating the encoded version using one of;

an asymmetric signing technique, a symmetric signing technique, an encryption technique, or a hash-based message authentication code (HMAC).

11. The method as recited in claim 6, wherein the client request is a non-HTTP request formatted in accordance with the Transmission Control Protocol (TCP).

12. The method as recited in claim 6, wherein the security metadata comprises a secure sockets layer (SSL) certificate received at the network intermediary from a client from which the client request was received.

13. A non-transitory computer-accessible storage medium storing program instructions computer-executable to implement:

receiving, at a network intermediary, a client request for a backend service;

in response to said receiving the client request the network intermediary;

generating security metadata associated with the client request, wherein the security metadata comprises an identification of a source of the client request;

creating an encoded version of the security metadata based at least in part on a key and at least a portion of the security metadata; and

transmitting the encoded version of the security metadata to a backend server configured to identify the source of the client request to perform one or more operations responsive to the client request.

14. The non-transitory computer-accessible storage medium as recited in claim 13, wherein the at least a portion of the encoded version of the security metadata is transmitted as a message header in accordance with at least one of:

the Hypertext Transfer Protocol (HTTP), or the Transmission Control Protocol (TCP).

15. The non-transitory computer-accessible storage medium as recited in claim 13, wherein the instructions are further computer-executable to implement:

transmitting a backend request derived from the client request to the backend server, wherein the backend server is configured to analyze the backend request to perform the one or more operations responsive to the client request.

16. The non-transitory computer-accessible storage medium as recited in claim 15, wherein at least a portion of the backend request is incorporated within a body of a network message, and wherein at least a portion of the encoded version of the security metadata is incorporated with a header of the network message.

17. The non-transitory computer-accessible storage medium as recited in claim 15, wherein at least a portion of the backend request is transmitted to the backend server in plain text.

18. The non-transitory computer-accessible storage medium as recited in claim 13, wherein the client request is received over a client connection from a client, wherein the encoded version of the security metadata is transmitted to the backend server over a server connection, wherein the instructions are further computer-executable to implement:

terminating the client connection after receiving the client request and before transmitting the security metadata to the backend server.

19. The non-transitory computer-accessible storage medium as recited in claim 13, wherein the security metadata comprises one or more of:

an Internet Protocol (IP) address from which the client request is received, an IP address at which the client request is received, a port number at which the client request is received, an IP address of the backend server to which the encoded version of the security metadata is transmitted, a port number of the backend server to which the encoded version of the security metadata is transmitted, or a TCP segment number.

20. The non-transitory computer-accessible storage medium as recited in claim 13, wherein the security metadata comprises an identification of a network interface at which the client request was received.

21. The non-transitory computer-accessible storage medium as recited in claim 13, wherein the security metadata comprises an indication of a completion of a security analysis of the client request.

22. The non-transitory computer-accessible storage medium as recited in claim 13, the instructions are further computer-executable to implement:

prior to transmitting the encoded version of the security metadata to the backend server, selecting the backend server from one or more backend servers based at least in part on a load-balancing algorithm.

23. The non-transitory computer-accessible storage medium as recited in claim 13, wherein the encoded version of the security metadata is generated using a digital signature algorithm.

24. The non-transitory computer-accessible storage medium as recited in claim 13, wherein the security metadata comprises an indication that the Internet Protocol Security (IPSec) protocol was used in receiving the client request.

25. The non-transitory computer-accessible storage medium as recited in claim 13, wherein the security metadata comprises a secure sockets layer (SSL) certificate received from a client from which the client request was received.