System and method for resource access with identity impersonation

• US 9,509,684 B1
• Filed: 10/14/2015
• Issued: 11/29/2016
• Est. Priority Date: 10/14/2015
• Status: Active Grant

• Current Assignee: FullArmor Corporation
• Original Assignee: FullArmor Corporation
• Inventors: Dixson-Boles, Christopher Ryan, Davis, Charles A., Kim, Danny
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US14/883,017
• Time in Patent Office: 412 Days
• Field of Search: 726/4, 726/12, 726/7, 726/15, 726/1, 726/25, 726/10
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A gateway device comprising a processor and a memory, the processor is configured to receive a resource request message from an endpoint associated with a user, the resource request message including an external token, a resource operation, and a resource identifier. The processor is also configured to retrieve, from the memory, an authentication identifier associated with one of the endpoint and the user based on the external token and authorize the resource operation with a directory service using the authentication identifier. The processor is further configured to receive an authorization token from the directory service and initiate the resource operation with an internal resource using the authorization token.

Claims

1. A gateway device comprising a processor and a memory, the processor is configured to:

receive, by the gateway device, a resource request message from an endpoint associated with a user, the resource request message including an external token, a resource operation, and a resource identifier, the gateway device is not the endpoint;

retrieve, from the memory of the gateway device, an authentication identifier associated with one of the endpoint and the user based on the external token;

authorize, by the gateway device, the resource operation with a directory service using the authentication identifier;

receive, by the gateway device, an authorization token from the directory service; and

initiate, by the gateway device, the resource operation with an internal resource associated with the resource identifier using the authorization token.

2. The gateway device of claim 1, wherein the gateway device resides in an internal network, wherein the endpoint resides in an external network separated from the internal network such that the endpoint is restricted from performing the authentication request directly with the directory service.

3. The gateway device of claim 1, wherein the authentication identifier is a Ticket to Grant Tickets (TGT), wherein authorizing the resource operation with the directory service further includes transmitting the TGT to the directory service, wherein the processor is further configured to receive a service ticket from the directory service.

4. The gateway device of claim 1, wherein the external token is a session token associated with a communication path between the endpoint and the gateway device.

5. The gateway device of claim 1, wherein the processor is further configured to:

provide a plurality of resource controllers for a plurality of resource types, each resource controller of the plurality of resource controllers is configured to initiate resource operations on a particular type of internal resource;

determine a first resource type based on the resource request message; and

identify a first resource controller from the plurality of resource controllers based on the first resource type, wherein the identified first resource controller is associated with the first resource type, and wherein the internal resource is of the first resource type.

6. The gateway device of claim 1, wherein the gateway device is further configured to:

define a plurality of application program interface (API) calls, each API call of the plurality of API calls including an input schema and an output schema, wherein the resource request message is formatted based on the input schema;

receive response data from the internal resource based on initiating the resource operation;

construct a response message formatted based on the output schema and including the response data; and

transmit the response message to the endpoint.

7. The gateway device of claim 1, wherein the processor is further configure to perform a second layer authorization of the resource operation based on permissions associated with the user within a secondary user system, wherein the second layer authorization is configured to restrict at least one resource operation for the user that is authorized by the directory service.

8. A method for pass-through impersonation, the method comprising:

receiving, by a gateway, a resource request message from an endpoint associated with a user, the resource request message including an external token, a resource operation, and a resource identifier, the gateway is not the endpoint;

retrieving, from a memory of the gateway, an authentication identifier associated with one of the endpoint and the user based on the external token;

authorizing, by the gateway, the resource operation with a directory service using the authentication identifier;

receiving, by the gateway, an authorization token from the directory service; and

initiating, by the gateway, the resource operation with an internal resource associated with the resource identifier using the authorization token.

9. The method of claim 8, wherein the method is performed by a gateway device residing in an internal network, wherein the endpoint resides in an external network separated from the internal network such that the endpoint is restricted from performing the authentication request directly with the directory service.

10. The method of claim 8, wherein the authentication identifier is a Ticket to Grant Tickets (TGT), wherein authorizing the resource operation with the directory service further includes transmitting the TGT to the directory service, the method further comprising receiving a service ticket from the directory service.

11. The method of claim 8, wherein the resource request message is an application program interface (API) message formatted as a hypertext transfer protocol (HTTP) representational state transfer (REST) message.

12. The method of claim 8 further comprising:

providing a plurality of resource controllers for a plurality of resource types, each resource controller of the plurality of resource controllers is configured to initiate resource operations on a particular type of internal resource;

determining a first resource type based on the resource request message; and

identifying a first resource controller from the plurality of resource controllers based on the first resource type, wherein the identified first resource controller is associated with the first resource type, and wherein the internal resource is of the first resource type.

13. The method of claim 8 further comprising:

defining a plurality of application program interface (API) calls, each API call of the plurality of API calls including an input schema and an output schema, wherein the resource request message is formatted based on the input schema;

receiving response data from the internal resource based on initiating the resource operation;

constructing a response message formatted based on the output schema and including the response data; and

transmitting the response message to the endpoint.

14. The method of claim 8 further comprising performing a second layer authorization of the resource operation based on permissions associated with the user within a secondary user system, wherein the second layer authorization is configured to restrict at least one resource operation for the user that is authorized by the directory service.

15. A machine-readable storage medium storing a set of instructions that, when executed by at least one processor, causes the at least one processor to perform operations comprising:

receiving a resource request message from an endpoint associated with a user, the resource request message including an external token, a resource operation, and a resource identifier, the at least one processor is not the endpoint;

retrieving, from a memory, an authentication identifier associated with one of the endpoint and the user based on the external token;

authorizing the resource operation with a directory service using the authentication identifier;

receiving an authorization token from the directory service; and

initiating the resource operation with an internal resource associated with the resource identifier using the authorization token.

16. The machine-readable medium of claim 15, wherein the at least one processor is a part of a gateway device residing in an internal network, wherein the endpoint resides in an external network separated from the internal network such that the endpoint is restricted from performing the authentication request directly with the directory service.

17. The machine-readable medium of claim 15, wherein the authentication identifier is a Ticket to Grant Tickets (TGT), wherein authorizing the resource operation with the directory service further includes transmitting the TGT to the directory service, the operations further comprising receiving a service ticket from the directory service.

18. The machine-readable medium of claim 15, wherein the resource request message is an application program interface (API) message formatted as a hypertext transfer protocol (HTTP) representational state transfer (REST) message.

19. The machine-readable medium of claim 15, the operations further comprising:

providing a plurality of resource controllers for a plurality of resource types, each resource controller of the plurality of resource controllers is configured to initiate resource operations on a particular type of internal resource;

determining a first resource type based on the resource request message; and

identifying a first resource controller from the plurality of resource controllers based on the first resource type, wherein the identified first resource controller is associated with the first resource type, and wherein the internal resource is of the first resource type.

20. The machine-readable medium of claim 15, the operations further comprising:

defining a plurality of application program interface (API) calls, each API call of the plurality of API calls including an input schema and an output schema, wherein the resource request message is formatted based on the input schema;

receiving response data from the internal resource based on initiating the resource operation;

constructing a response message formatted based on the output schema and including the response data; and

transmitting the response message to the endpoint.