Service Call Filter for Internal Service Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed computing environments, internal services are vulnerable to security attacks from external clients within the same network, as firewalls cannot prevent access and attacks from within the network, and modifying internal services to enhance security is not feasible due to their unmodifiable nature.
Innovation Solution
A method is introduced to secure internal services by intercepting service calls, processing client information against predefined rules, and forwarding service packets only if the client meets the specified criteria, using multiplexing and demultiplexing modules within the source and target appliances to ensure only authorized clients access internal services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If firewalls are used to protect internal services, then external attacks are blocked, but internal services remain vulnerable to attacks from within the same network
Solution Approach 1:
The patent introduces a service call filter module as an intermediary component between client processes and internal services. This filter module intercepts service calls, evaluates client credentials against predefined rules, and selectively forwards authorized calls to the target appliance. The intermediary mechanism enables granular access control that addresses the limitation of traditional firewalls by providing application-layer security for internal services within the same network.
2Ease of operation
If internal services are made accessible to all clients for ease of operation, then service availability is improved, but security vulnerability increases
Solution Approach 1:
The patent implements local quality by applying different access control policies to different internal services based on their sensitivity and requirements. The service call filter module maintains a set of rules that define which client processes can access which internal services. This selective accessibility allows critical services to have restricted access while less sensitive services remain broadly accessible, thus balancing security with operational ease without requiring uniform restrictions across all services.
3Reliability
If client information is retrieved from kernel memory for security filtering, then access control is enhanced, but system complexity increases
Solution Approach 1:
The patent segments the access control functionality into a dedicated service call filter module that operates independently from the core service infrastructure. This filter module is implemented as a separate component that can be configured and managed separately from the internal services and client applications. By segmenting the security filtering function, the system achieves enhanced access control while isolating the complexity of credential verification and rule evaluation from the main service logic, making the system more manageable despite the added complexity.
Data Source
Figure 1
Figure 2A~2B
Figure 2C~2E
AI summary
Disclosed herein are methods, systems, and processes to secure internal services in a distributed environment. A service call initiated by a client process of a client is intercepted. In this example, the service call is a request for an internal service provided by a server deployed in a target appliance. The client is deployed in a source appliance. The service call includes an identifier, and the identifier identifies the internal service. If one or more rules are specified for the identifier, a service packet is generated by multiplexing client information associated with the client process as well as information in the service call. The service packet is forwarded to the target appliance.