Credential Proxying for Secure Remote Access to Service Resources
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud-based applications deployed in remote environments are prevented from accessing service-owned credentials, hindering their ability to manage service-owned resources, despite the need for such access to perform tasks like publishing internal logs to service-owned endpoints.
Innovation Solution
A proxy-based approach is implemented, where a customer proxy agent in the remote environment intercepts requests from the application, redirects them to a service proxy in the service environment, applies service credentials, and manages access scoping, while a two-way proxy mechanism ensures responses are processed without exposing service credentials to the remote environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If service applications are deployed directly to user or remote environment, then the application can be managed locally with simplified deployment, but the application is prevented from accessing service-owned credentials and cannot manage service-owned resources
Solution Approach 1:
A proxy service is introduced as an intermediary component that runs within the remote environment alongside the service application. This proxy acts as a mediator between the application and service-owned resources, allowing the application to access credentials and resources through the proxy without directly possessing them. The proxy maintains security boundaries while enabling necessary access, thus resolving the contradiction between local deployment simplicity and access capability.
2Adaptability or versatility
If service credentials are provided to remote applications, then the application can access service-owned resources directly, but security is compromised by exposing credentials outside the service environment
Solution Approach 1:
The proxy service serves as a secure intermediary that holds and manages service credentials within the protected service environment. Instead of exposing credentials to the remote application, the proxy receives authenticated requests from the application and forwards them to service-owned resources using the secured credentials. This maintains security while enabling resource access.
Solution Approach 2:
The system is segmented into distinct components: the service application running in the remote environment, the proxy service running in the same environment but with elevated privileges, and the service-owned resources in the protected environment. This segmentation allows the application to operate without credentials while the proxy handles credential-based operations, thus preventing credential exposure.
3Object-affected harmful factors
If a proxy-based approach is implemented to enable credential proxying, then remote applications can access service-owned resources securely, but the system complexity increases with additional proxy components
Solution Approach 1:
The proxy functionality is merged with the existing service infrastructure by deploying the proxy as a component within the same remote environment as the service application. Rather than introducing entirely separate infrastructure, the proxy integrates with the application's deployment context, reducing overall system complexity while maintaining security benefits.
Solution Approach 2:
The proxy service is designed as a universal component that can serve multiple service applications within the same remote environment. A single proxy instance can handle credential proxying for multiple applications, reducing the need for separate proxy infrastructure for each application and thereby reducing overall system complexity.
Data Source
AI summary
An application in a remote environment can manage service-owned resources in a service environment. A two-way proxying mechanism can include a proxy agent in the remote environment and a service proxy endpoint in the service environment. When an application in the remote environment submits a call to the service environment, that request can be intercepted by the proxy agent and redirected to the service proxy endpoint. The service proxy endpoint, inside the service environment, can change the credentials of the request to the appropriate service credentials, perform scoping for the request, then redirect the request to the appropriate service endpoint. A corresponding response can be processed by the service proxy endpoint to remove service credentials, add credentials for the remote environment, then direct the request to the proxy agent, which can direct to the application to process the response without knowledge that proxying or request modification was performed.