Kerberos Relay with Dynamic Filtering for Secure Cloud Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In a Kerberos environment, accessing internal resources from cloud-based services is challenging due to security boundaries, as local firewalls typically block requests from external sources, and setting up special incoming connections can compromise security.
Innovation Solution
A system utilizing a Kerberos relay with dynamic filtering, which establishes a secure connection between cloud-based applications and local resources, allowing access to local resources using existing ticket granting and authentication services without requiring special firewall configurations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If firewall ports are opened to accept requests from outside security boundary, then cloud-based applications can access local resources, but security is compromised
Solution Approach 1:
A Kerberos relay service is introduced as an intermediary component that sits between cloud-based applications and the local KDC. The relay service receives authentication requests from external applications, forwards them to the internal KDC, and relays responses back. This mediator enables external access without opening firewall ports to the KDC directly, maintaining security while allowing functionality.
Solution Approach 2:
The system segments the authentication process into multiple components: external application, Kerberos relay service, and internal KDC. The relay service acts as a separate layer that handles external communications securely, while the KDC remains isolated behind firewall boundaries. This segmentation allows controlled access without exposing the core security infrastructure.
2Reliability
If Layer 4 filtering is used on source of request, then some security is established, but intelligent least access cannot be maintained
Solution Approach 1:
The relay service implements dynamic filtering that adapts to specific authentication requests. Instead of static Layer 4 filtering, the system dynamically evaluates Kerberos authentication context, ticket types, and user credentials to make authorization decisions. This dynamic approach enables intelligent least-privilege access control while maintaining security.
Solution Approach 2:
The system changes the filtering parameter from network layer (Layer 4 source IP) to application layer (Kerberos authentication context). By operating at Layer 7, the relay service can filter based on authentication state, ticket validity, and user permissions, enabling intelligent access control that adapts to each request's security context.
3Ease of operation
If special incoming connections are configured through firewall, then cloud applications can reach KDC, but security protocols are compromised
Solution Approach 1:
Instead of allowing incoming connections to the KDC (traditional approach), the system inverts the architecture: the Kerberos relay service initiates outbound connections to the KDC on behalf of external applications. This reversal maintains firewall security by keeping all KDC connections outbound-only, while still enabling cloud access through the relay's authenticated sessions.
Data Source
AI summary
A system and method for providing secure access to an organization's internal resources by an application running on an external network. An agent accepts queries from the application which are passed to a relay with a dynamic filter. The relay establishes a secure connection with a connector through the organization's firewall and passes requests from the application to an authentication service running on the internal network to confirm that a user of the application is authorized and issue an authentication ticket which is returned to the application. The application then sends a request to access a specific internal resource based on the authentication ticket, which is passed to a ticket granting service running on the internal network, to verify that said user is authorized to access the specific internal resource, and, if so, issue a service ticket to grant access the application for that resource.