1. A system that routes a message between a first service and a second service on behalf of an entity in a message routing service, the system comprising:
a router including at least one processor and memory coupled to the processor, the memory loaded with instructions that implement a message routing service and cause the processor to:
(a) receive an authentication request for the entity at the message routing service;
(b) generate at the message routing service an identifier for the authentication request, the identifier indicating authentication of the entity to the message routing service;
(c) send at least one provisioning message to at least one of the first service and the second service using the message routing service, the at least one provisioning message including the identifier for provisioning the entity with the at least one of the first service and the second service; and
(d) subsequent to the receiving, generating and sending:
receive a message at the message routing service from the first service, the message including the identifier, the message further being directed to the second service;
authenticate the message at the message routing service using the identifier;
determine, upon authenticating, at the message routing service a route and a transformation comprised of one or more of no modification of the message, a modification of the message, and a translation of the message; and
route an output message to the second service according to the route and the transformation of the message to form the output message from the first service, the output message including the identifier.
2. The system of claim 1, wherein the message routing service authenticates the message without further authentication of the entity with either the first service or the second service by the message routing service.
3. The system of claim 2, wherein the message includes XML data and the transformation comprises a translation of the message such that the output message includes the data after transformation according to one or more extensible stylesheet language transformations (XSLTs).
4. The system of claim 2, wherein the second service comprises a mapped service, the mapped service comprising an entity specific mapping to a third service, and wherein the routing the output message to the second service comprises routing the output message to the third service.
5. The system of claim 2, wherein the route includes a third service to receive the output message prior to routing to the second service.
6. The system of claim 5, wherein the identifier in the output message capable of use by the third service for authentication of the output message.
7. The system of claim 2, wherein the identifier in the message in an encrypted form.
8. A system that routes a message between a first service and a second service on behalf of an entity in a message routing service, the system comprising:
a router including at least one processor and memory coupled to the processor, the memory loaded with instructions that implement a message routing service and cause the processor to:
(a) receive an authentication request for the entity at a message routing service;
(b) generate at the message routing service an identifier for the authentication request, the identifier indicating authentication of the entity to the message routing service;
(c) send at least one provisioning message to at least one of the first service and the second service using the message routing service, the at least one provisioning message including the identifier for provisioning the entity with the at least one of the first service and the second service; and
(d) subsequent to the receiving, generating and sending:
receive a message at the message routing service from the first service, the message including the identifier, the message further being directed to the second service;
authenticate the message at the message routing service using the identifier;
determine, upon authenticating, at the message routing service a route and a transformation comprised of one or more of no modification of the message, a modification of the message, and a translation of the message; and
route an output message to the second service according to the route and the transformation of the message to form the output message from the first service, the output message including the identifier.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. A method, comprising:
intercepting a client-server security session request sent from a client to a server at a proxy device;
initiating, with the server, a proxy-server security session from the proxy device;
obtaining, from the server, server security information at the proxy device;
initiating, with the client, a client-proxy security session from the proxy device using a trusted proxy certificate of the proxy device;
obtaining, from the client, client security information at the proxy device, the client security information having at least a subject name of the client;
creating a dynamic certificate using the obtained subject name of the client and the trusted proxy certificate;
establishing the initiated proxy-server security session with the dynamic certificate; and
establishing the initiated client-proxy security session, wherein the client-proxy security session and proxy-server security session transparently appear to the client and server as the requested client-server security session.
2. The method as in claim 1, further comprising:
configuring the server to trust the proxy certificate by installing the proxy certificate on the server.
3. The method as in claim 2, further comprising:
configuring the client to trust the proxy certificate by pushing the trusted proxy certificate from the server to the client.
4. The method as in claim 1, wherein the trusted proxy certificate is a proxy Certificate Authority (CA) certificate.
5. The method as in claim 1, further comprising:
configuring the client to initiate the client-server security session to the server disregarding the existence of the proxy device.
6. The method as in claim 1, further comprising:
receiving encrypted traffic at the proxy from either the client, over the client-proxy security session, or the server, over the proxy-server security session;
decrypting the encrypted traffic at the proxy;
re-encrypting the decrypted traffic at the proxy for the corresponding proxy-server security session and client-proxy security session; and
transmitting the re-encrypted traffic from the proxy correspondingly to the server over the proxy-server security session and to the client over the client-proxy security session.
7. The method as in claim 6, wherein the proxy device is a firewall, the method further comprising:
inspecting the decrypted traffic at the firewall.
8. The method as in claim 1, wherein the client-proxy and proxy-server security sessions are selected from a group consisting of: an authentication session, an encryption session, a Transport Layer Security (TLS) session, a Secure Socket Layer (SSL) session, and an Internet Protocol Security (IPSec) session.
9. The method as in claim 1, further comprising:
creating a dynamic server certificate using the obtained server security information and the trusted proxy certificate; and
initiating, with the client, the client-proxy security session from the proxy device using the dynamic server certificate.
10. The method as in claim 1, wherein the trusted proxy certificate is shared to represent one or more servers for each of one or more client-proxy security sessions.
11. The method as in claim 1, wherein the dynamic certificate for the client is a new certificate created at the proxy device having at least one of a corresponding client subject name, signature algorithm, or certificate extension.
12. The method as in claim 1, wherein each of the dynamic certificates created by the proxy have a distinct public and private key pair.
13. The method as in claim 1, wherein all dynamic certificates created by the proxy share a single public and private key pair.
14. The method as in claim 1, further comprising:
receiving a security session tear-down request at the proxy device; and, in response,
tearing down the client-proxy security session and proxy-server security session.
15. The method as in claim 1, wherein the dynamic certificate is valid only for a duration of the client-proxy or proxy-server security sessions.
16. The method as in claim 1, wherein the client-proxy security session is established prior to initiating the proxy-server security session.
17. A node, comprising:
one or more network interfaces adapted to communicate with at least one server and at least one client, wherein the server and the client are configured to trust a proxy certificate of the node;
one or more processors coupled to the network interfaces and adapted to execute one or more processes; and
a memory adapted to store a proxy security process executable by each processor, the proxy security process when executed operable to: i) intercept a client-server security session request sent from the client to the server, ii) initiate, with the server, a proxy-server security session, iii) obtain, from the server, server security information, iv) initiate, with the client, a client-proxy security session using the trusted proxy certificate, v) obtain, from the client, client security information, the client security information having at least a subject name of the client, vi) create a dynamic certificate using the obtained subject name of the client and the trusted proxy certificate, vii) establish the initiated proxy-server security session with the dynamic certificate, and vii) establish the initiated client-proxy security session, wherein the client-proxy security session and proxy-server security session transparently appear to the client and server as the requested client-server security session.
18. The node as in claim 17, wherein the proxy security process is further operable to: i) receive encrypted traffic from either the client, over the client-proxy security session, or the server, over the proxy-server security session; ii) decrypt the encrypted traffic; iii) re-encrypt the decrypted traffic for the corresponding proxy-server security session and client-proxy security session; and iv) transmit the re-encrypted traffic correspondingly to the server over the proxy-server security session and to the client over the client-proxy security session.
19. The node as in claim 18, wherein the memory is further adapted to store a firewall process executable by each processor, the firewall process when executed operable to inspect the decrypted traffic.
20. An apparatus, comprising:
means for intercepting a client-server security session request sent from a client to a server;
means for initiating, with the server, a proxy-server security session;
means for obtaining, from the server, server security information;
means for initiating, with the client, a client-proxy security session using a trusted proxy certificate;
means for obtaining, from the client, client security information, the client security information having at least a subject name of the client;
means for creating a dynamic certificate using the obtained subject name of the client and the trusted proxy certificate;
means for establishing the initiated proxy-server security session with the dynamic certificate; and
means for establishing the initiated client-proxy security session, wherein the client-proxy security session and proxy-server security session transparently appear to the client and server as the requested client-server security session.
21. A method, comprising:
intercepting, at a proxy device, a client-server security session request from a client to a server;
establishing a client-proxy security session between the client and the proxy device using a trusted proxy certificate of the proxy device and a client certificate having a client subject name of the client;
extracting, by the proxy device, the client subject name of the client from the client certificate using a public key of the client;
generating, by the proxy device, a dynamic client certificate using the client subject name and a private key of the proxy device; and
establishing a proxy-server security session between the proxy device and the server using the dynamic client certificate, wherein the client-proxy security session and proxy-server security session transparently appear to the client and server as the requested client-server security session.
22. The method as in claim 21, further comprising:
receiving encrypted traffic at the proxy device from either the client, over the client-proxy security session, or the server, over the proxy-server security session;
decrypting the encrypted traffic at the proxy device;
re-encrypting the decrypted traffic at the proxy device for the corresponding proxy-server security session or client-proxy security session; and
transmitting the re-encrypted traffic from the proxy device correspondingly to the server over the proxy-server security session or to the client over the client-proxy security session.
23. The method as in claim 22, further comprising:
processing the decrypted traffic at the proxy device prior to re-encrypting the decrypted traffic.
24. The method as in claim 21, further comprising:
initiating the client-proxy security session between the client and the proxy device to obtain the client certificate having the client subject name of the client; and
establishing the client-proxy security session between the client and the proxy device in response to establishing the proxy-server security session between the proxy device and the server.
25. The method as in claim 24, further comprising:
initiating the proxy-server security session between the proxy device and the server prior to initiating the client-proxy security session between the client and the proxy device; and
establishing the proxy-server security session between the proxy device and the server in response to initiating the client-proxy security session between the client and the proxy device and generating the dynamic client certificate from the obtained client certificate.
26. The method as in claim 21, wherein each dynamic client certificate generated by the proxy device has a distinct public and private key pair.
27. An apparatus, comprising:
one or more network interfaces adapted to communicate with at least one server and at least one client, wherein the server and the client are configured to trust a proxy certificate of the apparatus;
a processor coupled to the network interfaces and adapted to execute one or more processes; and
a memory adapted to store a proxy security process executable by the processor, the proxy security process when executed operable to:
intercept a client-server security session request from a client to a server;
establish a client-proxy security session between the client and the apparatus using the trusted proxy certificate and a client certificate having a client subject name of the client;
extract the client subject name of the client from the client certificate using a public key of the client;
generate a dynamic client certificate using the client subject name and a private key of the apparatus; and
establish a proxy-server security session between the apparatus and the server using the dynamic client certificate, wherein the client-proxy security session and proxy-server security session transparently appear to the client and server as the requested client-server security session.
28. The apparatus as in claim 27, wherein the proxy security process is further operable to:
receive encrypted traffic from either the client, over the client-proxy security session, or the server, over the proxy-server security session;
decrypt the encrypted traffic;
re-encrypt the decrypted traffic for the corresponding proxy-server security session or client-proxy security session; and
transmit the re-encrypted traffic correspondingly to the server over the proxy-server security session or to the client over the client-proxy security session.
29. The apparatus as in claim 28, wherein the proxy security process is further operable to process the decrypted traffic prior to re-encrypting the decrypted traffic.
30. The apparatus as in claim 29, wherein the apparatus is a firewall.
31. The apparatus as in claim 27, wherein the proxy security process is further operable to establish the proxy-server security session between the proxy device and the server prior to establishment of the client-proxy security session between the client and the proxy device, and in response to establishment of the client-proxy security session between the client and the proxy device and generation of the dynamic client certificate.