Securing internal services in a distributed environment

Abstract

Disclosed herein are methods, systems, and processes to secure internal services in a distributed computing environment. A service packet that includes a service call from a source appliance is intercepted at a server. A determination is made that the service call is for an internal service provided by the source appliance and includes client information with client process properties. The service packet is demultiplexed. A determination is made that rule attributes associated with the internal service match the client process properties. The client information is removed from the service packet and the service call is forwarded to the server.

1 .- 20 . (canceled) 
     
     
         21 . A computer-implemented method comprising:
 intercepting a service call initiated by a client process of a client, wherein
 the service call is a request for an internal service, 
 the internal service is provided by a server, 
 the service call comprises an identifier, and 
 the identifier identifies the internal service; 
   determining whether one or more rules of a plurality of rules are specified for the identifier;   in response to a determination that the one or more rules are specified for the identifier,
 processing one or more attributes of the one or more rules, and 
 forwarding the service call to the server, if the processing indicates that the forwarding the service call is allowable; and 
   in response to a determination that none of the plurality of rules are specified for the identifier,
 forwarding the service call to the server. 
   
     
     
         22 . The computer-implemented method of  claim 21 , further comprising:
 retrieving one or more client process properties of a plurality of client process properties associated with the client process from kernel memory.   
     
     
         23 . The computer-implemented method of  claim 21 , wherein
 the identifier is a port identifier or a port number.   
     
     
         24 . The method of  claim 22 , wherein
 the plurality of client process properties comprise a user context, a user group context, a client program name, a parent process name, or a terminal type.   
     
     
         25 . The computer-implemented method of  claim 22 , further comprising:
 forwarding the service call to the server if each attribute of the one or more attributes of at least one rule matches a corresponding client process property of the one or more client process properties.   
     
     
         26 . The computer-implemented method of  claim 25 , further comprising:
 generating a reject notification if at least one client process property of the one or more client process properties does not match each attribute; and   sending the reject notification to the client.   
     
     
         27 . The computer-implemented method of  claim 26 , wherein
 a first attribute of the one or more attributes of a first rule of the one or more rules corresponds to a first client process property of the one or more client process properties, and   a second attribute of the one or more attributes of a second rule of the one or more rules corresponds to a second client process property of the one or more client process properties.   
     
     
         28 . The computer-implemented method of  claim 22 , wherein
 the plurality of rules are part of a rule set,   the rule set is part of a service call filter module, and   the service call filter module is part of a kernel.   
     
     
         29 . The computer-implemented method of  claim 28 , further comprising:
 accessing the rule set to determine whether the internal service identified by the identifier is unprotected or protected.   
     
     
         30 . The computer-implemented method of  claim 29 , wherein
 the internal service is protected if the rule set comprises at least one rule of the plurality of rules for the identifier specified in the service call, and   the internal service is unprotected if the rule set does not comprise at least one rule of the plurality of rules for the internal service specified in the service call.   
     
     
         31 . The method of  claim 30 , further comprising:
 forwarding the service call to the server if
 the internal service is unprotected, or 
 each attribute of the at least one rule matches the corresponding client process property of the one or more client process properties. 
   
     
     
         32 . The computer-implemented method of  claim 21 , wherein
 the client and the server are deployed in an appliance.   
     
     
         33 . The computer-implemented method of  claim 21 , further comprising:
 in response to the determination that the one or more rules are specified for the identifier,
 rejecting the service call, if the one or more rules indicate that the service call should not be forwarded to the first server. 
   
     
     
         34 . The computer-implemented method of  claim 21 , further comprising:
 the service call is intercepted by a service call filter module executing in a kernel,   the service call filter module comprises a rule set that is stored in the kernel memory, and   the forwarding the service call to the server is performed without accessing kernel memory.   
     
     
         35 . A non-transitory computer readable storage medium storing program instructions executable to perform a method comprising:
 intercepting a service call initiated by a client process of a client, wherein
 the service call is a request for an internal service, 
 the internal service is provided by a server, 
 the service call comprises an identifier, and 
 the identifier identifies the internal service; 
   determining whether one or more rules of a plurality of rules are specified for the identifier;   in response to a determination that the one or more rules are specified for the identifier,
 processing one or more attributes of the one or more rules, and 
 forwarding the service call to the server, if the processing indicates that the forwarding the service call is allowable; and 
   in response to a determination that none of the plurality of rules are specified for the identifier,
 forwarding the service call to the server. 
   
     
     
         36 . The non-transitory computer readable storage medium of  claim 35 , wherein the method further comprises:
 retrieving one or more client process properties of a plurality of client process properties associated with the client process from kernel memory, wherein
 the plurality of client process properties comprise a user context, a user group context, a client program name, a parent process name, or a terminal type; 
   forwarding the service call to the server if each attribute of the one or more attributes of at least one rule matches a corresponding client process property of the one or more client process properties;   generating a reject notification if at least one client process property of the one or more client process properties does not match each attribute; and   sending the reject notification to the client.   
     
     
         37 . The non-transitory computer readable storage medium of  claim 35 , wherein the method further comprises:
 accessing the rule set to determine whether the internal service identified by the identifier is unprotected or protected, wherein
 the plurality of rules are part of a rule set, 
 the rule set is part of a service call filter module, 
 the service call filter module is part of a kernel, 
 the internal service is protected if the rule set comprises at least one rule of the plurality of rules for the identifier specified in the service call, and 
 the internal service is unprotected if the rule set does not comprise at least one rule of the plurality of rules for the internal service specified in the service call; and 
   forwarding the service call to the server if
 the internal service is unprotected, or 
 each attribute of the at least one rule matches the corresponding client process property of the one or more client process properties. 
   
     
     
         38 . The non-transitory computer readable storage medium of  claim 35 , wherein the method further comprises:
 in response to the determination that the one or more rules are specified for the identifier,
 rejecting the service call, if the one or more rules indicate that the service call should not be forwarded to the first server. 
   
     
     
         39 . The non-transitory computer readable storage medium of  claim 35 , wherein the method further comprises:
 the service call is intercepted by a service call filter module executing in a kernel,   the service call filter module comprises a rule set that is stored in the kernel memory, and   the forwarding the service call to the server is performed without accessing kernel memory.   
     
     
         40 . A computer-implemented method comprising:
 intercepting, by a service call filter module executing in a kernel, a service call initiated by a client process of a client executing in a first portion of a first user space of a first appliance, wherein
 the service call is a request for a service comprising an identifier that identifies the service, and 
 the service call filter module comprises a rule set; 
   determining whether the service is an internal service, wherein
 the internal service is provided by a first server executing in a second portion of the first user space of the first appliance; 
   in response to a determination that the service is the internal service,
 determining whether one or more rules of a plurality of rules are specified for the internal service identified by the identifier, wherein
 the determining is performed by the service call filter module accessing the rule set, and 
 
 in response to a determination that the one or more rules are specified for the internal service identified by the identifier,
 determining whether to forward the service call to the first server by applying the one or more rules to the service call, and 
 forwarding the service call to the first server, if the one or more rules indicate that the service call should be forwarded to the first server; and 
 
   in response to a determination that the service is not the internal service, forwarding the service call to a second appliance, wherein
 the service is another service that is provided by a second server executing in a portion of a second user space of the second appliance, and 
 the service call is forwarded to the second appliance without applying any of the plurality of rules to the service call.