Proxies are not exactly new. Rather they have a long tradition in network layer based security. We propose to use a proxy with dynamically changing entries which are configured by a local resource management system. In contrast to the typically employed static proxy configuration all approved connections here are reconfigured dynamically by the resource management system on a per-job basis. Moreover in general -- all connections to ip addresses, which are beyond the local subnet here are rerouted via the proxy by means of e.g. a tsocks client running on the allocated resources. The resource management then approves or disapproves access to external ip-adresses on a per-job basis. Since the proxy can reject non-authorized requests on a network level and also only allows the combinations user at allocated resources to authorized licence servers on a per-job basis the mechanism provides a high level of security.

Also Known As

To our knowledge a dynamically -- via resource management -- configured proxy is a new pattern.

Motivation

We assume that a job is running on some resources on a grid site. User A is allowed to use the external or internal Licence Server at a specific IP, whereas User B is not. A proxy solution which is dynamically reconfigured by a resource management system is able to grant security with respect to the access to this licence server.

Applicability

Whenever a user needs to access external data and security can only be verified on a network level, this pattern provides a secure solution, which is able to translate from a possible certificate based -- authentication/authorisation level to a network level. Keeping in mind that any security is only as secure as the system it depends upon and usually the latter includes the operating system -- the level of trust which is required between external licence client and internal licence server (or rather between external licence proxy and internal licence server) actually does not exceed the level of trust required in other concepts, e.g. via an encapsulated VPN solution. We note that the actual connection between proxy and server in fact can be established via a VPN.

Stucture

: LM-DP #2: Structure of Design Pattern (Click to enlarge)

Participants

The participants are

Resource Manager. The resource manager (re)configures the proxy.
Local Resources without access to an external network. All access to external networks are re-routed via the proxy
Circuit Level Gateway. Rejects or allows requests to external network. Terminates connections. Logs requests.
External server in the above picture exemplary denoted as licence server.

Collaboration

The Resource Manager obtains a list of IPs it is supposed to grant access to. Whether or not access is granted is decided at an earlier stage (PDP). The Resource manager allocates the resources and re-configures the proxy to allow access to all external allowed IPs from those allocated resources. Access from these resources to external IPs is re-routed via the proxy by means of a tsocks client. The proxy rejects or accepts these connection requests and forwards them to the external server. If the connections is approved by the external server it is -- in both directions -- redirected via the proxy.

: LM-DP #2: Sequence Diagram of Service Collaboration

Consequences

All access to external IP-adresses are filtered and approved of by the circuit level gateway. However since the corresponding configuration of the proxy can be rather arbitrary there are no direct consequences of the pattern.

Related Patterns

Proxy, circuit level gateway, SOCKS