Replacement of security credentials for secure proxying

A subscription proxy receives, from an end user system, a request for a resource provided by a content delivery network, the request comprising a local credential associated with the end user system. The subscription proxy identifies a remote credential associated with the content delivery network and corresponding to the local credential. The subscription proxy replaces the local credential in the request with the corresponding remote credential and sends the request for the resource with the remote credential to the content delivery network.

TECHNICAL FIELD

This disclosure relates to the field of computer security and, in particular, to dynamic replacement of security credentials for secure proxying.

BACKGROUND

A content delivery network or content distribution network (CDN) is system of one or more servers deployed in one or more data centers across the Internet. The goal of a CDN is to serve content to end user systems with high availability and high performance. CDNs serve a large portion of Internet content today, including web objects (text, graphics, URLs and scripts), downloadable objects (media files, software, documents), applications (e-commerce, portals), live streaming media, on-demand streaming media, and social networks.

In order to access content from a CDN, certain security or identity credentials may be used. One example of these security credentials is a digital certificate. The use of digital certificates using public and private key encryption methods is widely known in the field of computing, particularly in networked computing. Digital certificates generally follow the X.509 standard, developed by the International Standards Organization (ISO). These certificates create a binding between an entity's public key and its identity. The digital certificates may be issued by the CDN or by a corresponding certificate authority (CA) to a requestor, such as a customer of the CDN. In some cases, the customer may be a corporation or other organization, including multiple end user systems.

DETAILED DESCRIPTION

Embodiments are described for dynamically replacing security credentials for secure proxying. In one embodiment, the dynamic replacement may be performed by a subscription proxy. At its core, the subscription proxy is a service that takes requests that contain one form of authentication or credentials, performs the needed checks to ensure that the incoming request is valid, and then re-encodes the request with a different set of credentials that will be accepted by an upstream server or content provider. One implementation of the subscription proxy works with Secure Socket Layer (SSL) and Hypertext Transfer Protocol (HTTP).

In one embodiment, a software library may be used for low-level SSL calls, and the subscription proxy may chain them together into a pipeline, so that the output of one method serves as input to the next. For example, the subscription proxy may decode an incoming request for a resource into its data and metadata. The metadata may contain the information used to validate that the incoming request is authorized to be re-encoded. The subscription proxy may check the metadata against a mapping of credential (e.g., digital certificate) serial numbers and their originating up-stream credentials, in order to find the correct upstream credential with which to re-encode the request. Assuming that the request has been validated and the upstream certificate is found, the subscription proxy may re-encode the request with that certificate, and send it to the upstream server. The software library used may allow for bidirectional communication, so the subscription proxy is able to re-use the same pipeline to send the data back downstream to the originating client device.

FIG. 1is a block diagram illustrating a network environment for dynamic replacement of security credentials for secure proxying, according to an embodiment of the present invention. In one embodiment, network environment100includes hosted subscription service102, content delivery network (CDN)104, server108and one or more end user systems116. Hosted subscription service102, content delivery network104and server108may be connected through a network106, which may be, for example, a local area network (LAN), a wide area network (WAN), a global area network (GAN) such as the Internet, or a combination of such networks. Server108and end user systems116may be connected through a network114, which may be a separate LAN, WAN, GAN or other network, or may be part of the same network as network106. The illustrated embodiment shows three end user systems116; however, in other embodiments, there may be any number of end user systems and network environment100may include additional and/or different devices.

Content delivery network104may include a system of one or more servers deployed in one or more data centers across network106(e.g., the Internet). Content delivery network104may serve content to end user systems116with high availability and high performance. Content delivery network104may provide a wide array of content, such as web objects (text, graphics, URLs and scripts), downloadable objects (media files, software, documents), applications (e-commerce, portals), live streaming media, on-demand streaming media, or a combination of these and/or other forms of content. In one embodiment, content delivery network104is owned, operated and/or managed by the developer or creator of the provided content (e.g., a software developer). In another embodiment, a third party manages content delivery network104on behalf of the developer.

Hosted subscription service102may be an entity that generates and/or issues security credentials, such as digital certificates. A digital certificate certifies the ownership of a public key by the named subject of the certificate. This allows others to rely upon signatures or assertions made by a private key that corresponds to the certified public key. In one embodiment, hosted subscription service102is a certificate authority (CA). In one model of trust relationships, a CA is a trusted third party that is trusted by both the subject (owner) of the certificate and the party relying upon the certificate. CAs may be characteristic of many public key infrastructure (PKI) schemes. In one embodiment, hosted subscription service102distributes digital certificates or other security credentials (i.e., remote credentials) to customers of content delivery network104via network106. The remote credentials may be used to verify the identity and privileges of a user or customer (e.g., the corporation or organization running server108) of an upstream or remote entity (e.g., hosted subscription service102). In addition, the remote credentials may be used to control access to resources, such as content delivery network104, by server108. The remote credentials may be referred to as “remote” because they are distributed by an entity external to the corporation or organization running server108. In one embodiment, the remote security credentials include a SSL X.509 certificate. Content delivery network104may distribute or grant access to the content and/or resources (e.g., software downloads or upgrades) to holders of the digital certificates. In one embodiment, hosted subscription service102is owned by the same organization that manages content delivery network104(e.g., the software developer). In another embodiment, hosted subscription service102is some other public or private entity that issues remote security credentials on behalf of content delivery network104.

In one embodiment, hosted subscription service102distributes the remote credentials to customers of content delivery network104. Hosted subscription service102may distribute the remote credentials to server108via network106. Server108may be owned by a customer or client of content delivery network104. Server108may be connected to end user systems116via local network114. Each of end user systems116may be, for example, a conventional personal computer (PC), workstation, laptop computer, mobile phone, personal digital assistant (PDA) or the like. End user systems116may be configured to request content or resources that are available from content delivery network104.

In one embodiment, server108may function as a proxy server. Server108, may include for example, the computer system700described below with respect toFIG. 7. In general, a proxy server acts as an intermediary for requests from clients (e.g., end user systems116) seeking resources from other servers (e.g., content delivery network104). An end user system116may connect to server108, requesting some service, such as a file, connection, web page, or other resource available from content delivery network104. Server108evaluates the request as a way to simplify and control complexity from the perspective of end user systems116. Server108may receive the remote security credentials from hosted subscription service102and consequently be able to request and receive resources from content delivery network104. Due to security concerns, for example within the corporate customer network114, server108may not distribute the remote security credentials from hosted subscription service102to all or any of end user systems116.

In one embodiment, server108may include on-premise subscription service110. On-premise subscription service110may register with hosted subscription service102and receive the remote security credentials associated with content delivery network104. In addition, on-premise subscription service110may provide similar functionality as hosted subscription service102, but on a smaller scale (e.g., limited to machines connected to network114). For example, on-premise subscription service110may generate and/or distribute local security credentials to end user systems116. These local security credentials are controlled by the entity that owns server108and/or network114(e.g., the corporate customer) and may be used to control access to resources outside network114, such as content delivery network104, by end user systems116. The local credentials may also control access to resources within network114, such as subscription proxy112of server108, by end user systems116. The local credentials may be referred to as “local” because they are distributed by an entity internal to the corporation or organization running server108(e.g., on-premise subscription service110). In one embodiment, the local security credentials include an SSL X.509 certificate.

In one embodiment, server108may additionally include subscription proxy112. Subscription proxy112may allow for dynamic replacement of security credentials to enable secure proxying. Subscription proxy112may provide translation between the local security credentials included with a request sent by one of end user systems116, and the remote security credentials used to obtain the requested resources from content delivery network104. Subscription proxy112may receive the request, authenticate the request based on the local credentials, identify the corresponding remote credentials from on-premise subscription service110, and forward the request to content delivery network104with the remote credentials. This may prevent end user systems116from having to be registered with hosted subscription service102and/or content delivery network104and from having to obtain the appropriate remote security credentials directly.

FIG. 2is a block diagram illustrating an on-premise subscription service and a subscription proxy, according to an embodiment of the present invention. In one embodiment, on-premise subscription service110may include remote credential registration module202, local credential distribution module204and credential mapping module206. In one embodiment, subscription proxy112may include local credential authentication module208and dynamic credential replacement module210. Each of on-premise subscription service110and subscription proxy112may be coupled to a storage device220. In one embodiment, storage device220may include credential data store222and credential mapping database224. Storage device220may be part of server108or may be part of another device in network environment100and may be, for example, memory, such as read-only memory (ROM), flash memory, random access memory (RAM), etc., or a mass storage device, such as a magnetic or optical storage device.

Remote credential registration module202may be responsible for registering with hosted subscription service102and receiving the remote security credentials corresponding to content delivery network104. In one embodiment, remote credential registration module202may request remote security credentials from hosted subscription service102in response to an instruction from a user, system administrator, one of end user systems116or some other entity or individual. The request may indicate that on-premise subscription service110is requesting access to content delivery network104. Remote credential registration module202may receive the remote credentials and store them in credential data store222on storage device220.

Local credential distribution module204may generate and distribute local security credentials to connected network devices, such as end user systems116. The local credentials may be stored in credential data store222before being sent to end user systems116. These local security credentials may be used to authenticate the identity of end user systems116and to verify their permissions to download or receive content or resources provided by content delivery network104. End user systems116may include the local credentials with a request for content that is later verified by subscription proxy112.

Credential mapping module206may associate received remote credentials with distributed local credentials. In one embodiment, credential mapping module206maintains credential mapping database224in storage device220which stores a relationship between the remote credentials and the local credentials. Subscription proxy112may use this database224to determine the relationship when dynamically replacing security credentials in a request for a resource. In other embodiments, credential mapping database224may be some other data structure or data store besides a database.

Local credential authentication module208may authenticate local security credentials received with a request from one of end user systems116. In one embodiment, end user systems116may direct their requests for content to subscription proxy112. In addition to an indication of the requested content, the requests may include the local credential provided to the end user system116by on-premise subscription service110. The local credential may include, for example, a digital certificate, as described above. Local credential authentication module208may verify that the local credential is properly associated with the end user system116from which it was received and that the end user system116is authorized to request and receive the indicated content or resource. In one embodiment, local credential authentication module208compares the received local credential to a copy of that local credential in credential data store222.

Dynamic credential replacement module210may dynamically replace security credentials to enable secure proxying. Dynamic credential replacement module210may provide translation between the local security credentials included with a request sent by one of end user systems116, and the remote security credentials used to obtain the requested resources from content delivery network104. Dynamic credential replacement module210identify the remote credentials corresponding to the received local credentials using, for example credential mapping database224. Upon determining the remote credentials, dynamic credential replacement module210may forward the request to content delivery network104with the remote credentials. Similarly, when the requested content or resource is received from content delivery network104, dynamic credential replacement module210may reverse the process to translate back to the local credentials before providing the resource to the requesting end user system116.

FIG. 3is a flow diagram illustrating a security credential registration method, according to an embodiment. The method300may be performed by processing logic that comprises hardware (e.g., circuitry, dedicated logic, programmable logic, microcode, etc.), software (e.g., instructions run on a processing device to perform hardware simulation), or a combination thereof. The processing logic is configured to register a server with hosted subscription service in order to receive remote credentials for use in obtaining resources from a content delivery network. In one embodiment, method300may be performed by on-premise subscription service110, as shown inFIGS. 1 and 2.

Referring toFIG. 3, at block310, method300receives remote security credentials from hosted subscription service102. In one embodiment, remote credential registration module202may request remote security credentials from hosted subscription service102in response to an instruction from a user, system administrator, one of end user systems116or some other entity or individual. The request may indicate that on-premise subscription service110is requesting access to content delivery network104. In other embodiments, some other entity may request that the remote security credentials be sent to remote credential registration module202, or the remote security credentials may be received without a request. At block320, method300stores the received remote credentials in a data store. In one embodiment, remote credential registration module202stores the remote credentials in credential data store222of storage device220. In other embodiments, the remote credentials may be stored in some other location within server108or externally.

At block330, method300associates local security credentials with the remote security credentials stored in the data store222at block320. As described above, local credential distribution module204may generate and distribute local security credentials to connected network devices, such as end user systems116. The local credentials may also be stored in credential data store222. These local security credentials may be used to authenticate the identity of end user systems116and to verify their permissions to download or receive content or resources provided by content delivery network104. In one embodiment, credential mapping module206may associate received remote credentials with distributed local credentials. In one embodiment, credential mapping module206maintains credential mapping database224in storage device220which stores a relationship between the remote credentials and the local credentials. Credential mapping module206may create a mapping between which local credentials correspond to the received remote credentials for content delivery network104and to which end user systems116those local credentials are to be distributed. In one embodiment, the local credentials are associated with the remote credentials during the creation of the local credentials. In other embodiments, the local credentials are associated with the remote credentials as part of a separate operation or at a different point in time.

At block340, method300distributes the local credentials to local systems, such as end user systems116. In one embodiment, local credential distribution module204distributes the local credentials to end user systems116. End user systems116may include the local credentials with a request for content that is later verified by subscription proxy112.

FIG. 4is a flow diagram illustrating a dynamic security credential replacement method, according to an embodiment. The method400may be performed by processing logic that comprises hardware (e.g., circuitry, dedicated logic, programmable logic, microcode, etc.), software (e.g., instructions run on a processing device to perform hardware simulation), or a combination thereof. The processing logic is configured to dynamically replace security credentials for secure proxying of a request for content or resources. In one embodiment, method400may be performed by subscription proxy112, as shown inFIGS. 1 and 2.

Referring toFIG. 4, at block410, method400receives a request for a resource from one of end user systems116. In one embodiment, end user systems116may direct their requests for content to subscription proxy112. In addition to an indication of the requested content, the requests may include the local credential provided to the end user system116by on-premise subscription service110. The local credential may include, for example, a digital certificate, as described above.

At block420, method400determines if the request is authenticated based on the local credentials. Local credential authentication module208may verify that the local credential is properly associated with the end user system116from which it was received and that the end user system is authorized to request and receive the indicated content or resource. In one embodiment, local credential authentication module compares the received local credential to a copy of that local credential in credential data store222and/or to permissions indicated in credential mapping database224.

In one embodiment, if at block420, method400determines that the request is authenticated based on the local credentials (i.e., the requesting end user system had the proper credentials and is authorized to receive the requested content), at block430, method400identifies the corresponding remote credentials. Dynamic credential replacement module210may identify the remote credentials corresponding to the received local credentials using credential mapping database224. In one embodiment, dynamic credential replacement module210may locate an entry in credential mapping database224for the local credentials provided by end user system116. Dynamic credential replacement module210may identify the corresponding remote security credential, for example, by performing a look-up operation in credential mapping database224. In one embodiment, an address or location of the proper remote security credential may also be stored in the same entry of credential mapping database224. The address may point to a location in credential data store222or to some other location where the remote credential is stored.

At block440, method400may insert the identified remote security credentials into the request for a resource from content delivery network104. Dynamic credential replacement module210may dynamically replace the local security credentials in the request with the remote credentials for content delivery network104. At block450, method400sends the request with the remote security credentials to content delivery network104.

If at block420, method400determines that the request is not authenticated based on the local credentials (i.e., the requesting end user system did not have the proper credentials or is not authorized to receive the requested content), at block460, method400identifies denies the request.

FIG. 5is a flow diagram illustrating a dynamic security credential replacement method, according to an embodiment. The method500may be performed by processing logic that comprises hardware (e.g., circuitry, dedicated logic, programmable logic, microcode, etc.), software (e.g., instructions run on a processing device to perform hardware simulation), or a combination thereof. The processing logic is configured to dynamically replace security credentials for secure proxying of a request for content or resources. In one embodiment, method500may be performed by subscription proxy112, as shown inFIGS. 1 and 2.

Referring toFIG. 5, at block510, method500receives the requested resource package including the remote security credentials. In one embodiment, subscription proxy112receives the requested resource from content delivery network104. The request may have been previously made by subscription proxy112on behalf of one of end user systems116.

At block520, method500identifies the corresponding local security credentials for the response. In one embodiment, dynamic credential replacement module210, determines the local credentials using credential mapping database224. For example, dynamic credential replacement module210may locate an entry in credential mapping database224for the remote credential that was received with the resource package from content delivery network104. Dynamic credential replacement module210may identify the local credential for the requesting end user systems116, which may also be found in the same entry of credential mapping database224. The entry in the database224may point to a location in credential data store222or to another location where the local security credential is stored.

At block530, method500inserts the identified local security credentials into the resource package from content delivery network104. Dynamic credential replacement module210may dynamically replace the remote security credentials in the package with the local credentials for the requesting end user system116. At block540, method500sends the resource package with the local security credentials to the requesting end user system116.

FIG. 6is a block diagram illustrating a network environment for dynamic replacement of security credentials for secure proxying, according to an embodiment. In one embodiment, network environment600is similar to network environment100described above with respect toFIG. 1, but with the addition of firewall618and proxy server620. Firewall618may be a device, or a piece of software running on a device, used to permit or deny network transmissions based upon a set of rules. Firewall618may be used to protect a network from unauthorized access while permitting legitimate communications to pass. Firewall618may have an outward side facing network106(e.g., the Internet). The opposite side of firewall618may be a private or corporate network which is protected by the firewall618. The private network may include, for example, server108, network114, end user systems116and/or proxy server620. Proxy server620may be a server (e.g., a computer system or an application) that acts as an intermediary for requests from clients (e.g., end user systems116) seeking resources from other servers (e.g., content delivery network104). The existing corporate network protected by firewall618may be designed to funnel requests for resources through proxy server620. A system designed to dynamically replace security credentials including server108may interoperate with proxy server620, either by replacing proxy server620or by performing the dynamic replacement before requests are sent to proxy server620. In the latter case, a request with the updated remote security credentials may be sent to proxy server620by subscription proxy112. Proxy server620may forward to the request to and receive a response from content delivery network104as it was originally designed to do.

The exemplary computer system700includes a processing device702, a main memory704(e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM) (such as synchronous DRAM (SDRAM) or Rambus DRAM (RDRAM), etc.), a static memory706(e.g., flash memory, static random access memory (SRAM), etc.), and a data storage device718, which communicate with each other via a bus730. Any of the signals provided over various buses described herein may be time multiplexed with other signals and provided over one or more common buses. Additionally, the interconnection between circuit components or blocks may be shown as buses or as single signal lines. Each of the buses may alternatively be one or more single signal lines and each of the single signal lines may alternatively be buses.

The computer system700may further include a network interface device708. The computer system700also may include a video display unit710(e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)), an alphanumeric input device712(e.g., a keyboard), a cursor control device714(e.g., a mouse), and a signal generation device716(e.g., a speaker).

The data storage device718may include a machine-accessible storage medium728, on which is stored one or more set of instructions722(e.g., software) embodying any one or more of the methodologies of functions described herein. The instructions722may also reside, completely or at least partially, within the main memory704and/or within the processing device702during execution thereof by the computer system700; the main memory704and the processing device702also constituting machine-accessible storage media. The instructions722may further be transmitted or received over a network720via the network interface device708.