"It is impossible for ideas to compete in the marketplace if no forum for
  their presentation is provided or available."           Thomas Mann, 1896

Contributed by Bitkoo
Author:  Doron Grinstein

Introduction:

SecureWithin™ enables organizations to securely expose firewall-protected internal network resources to Internet clients.  The focus is on organizations that wish to expose various services without requiring clients to use VPN software or hardware. Especially in cases of web services, web applications, FTP or similar services.  Clients in this context may mean humans using applications such as web browsers or email applications; or machines consuming web services, or other network technologies to obtain services from other machines.  Network resources range from SOAP based web services to intranet-hosted web applications or Exchange Servers and everything in between that relies on TCP/IP.

Historically, to bring internal applications to Internet clients, organizations deployed replicated instances of their internal systems on a DMZ accessible from the Internet and then had to grapple with synchronizing the data between the internal and external instances. These duplicate instances often included database servers, application servers, directory servers, etc. This approach, while in use by many organizations is extremely costly, not only in terms of the redundant hardware, software licenses and such, but also because the IT labor involved in correctly configuring all the services, maintaining them, patching them and writing the data synchronization code correctly and securely. The hardware, software licenses and labor costs involved in exposing web application or web service to the Internet is often extremely high, ranging in the high tens of thousands to hundreds of thousands of dollars and in some cases more!

SecureWithin™ is a product that leverages your existing investment and simplifies the deployment of your internal systems to the Internet securely. Using SecureWithin™, security is never compromised and your time to Internet is minutes, not months while keeping costs low.

SecureWithin™ was designed with the following core requirements:

1.      Provide uncompromising security

2.      No network changes or firewall re-configuration (no “poking holes”)

3.      High performance and scalability

4.      Optional no new hardware and no client-side software

5.      Ridiculously easy to use

6.      Priced at a small fraction of any alternative approaches to deliver maximum value

7.      Work with any platform - Windows, Linux, Unix, Apple or any other TCP/IP based platform

The product consists of software and optional hardware appliances. In lieu of a hardware appliance, customers can install the software on their existing hardware and  alternatively, use Bitkoo’s hosted services.

Regardless of deployment option (appliance, virtual appliance (software only) or hosted service), the SecureWithin™ software is deployed on both the internal network and on the public Internet (either by the customer or hosted by Bitkoo).

The core software is comprised of two collaborating gateways - internal (on the LAN) and external (on the Internet). Before collaborating with the external gateway for the first time and periodically on a configurable time interval, the internal gateway communicates with the Bitkoo metadata service to retrieve data that contains, among other things: information about internal endpoints/services to expose, security requirements, optional data transformation and  on which external gateways to make the services available. The metadata is defined by customers on Bitkoo’s secure website.

Any metadata changes made by customers are logged in a detailed audit trail. Customers must authenticate using a user Id assigned by Bitkoo and a strong password chosen by the customer. In addition, when calls are made to the Bitkoo metadata service by gateway devices, the calls are authenticated using an X.509 certificate residing on the calling device.

Once the internal gateway receives its applicable metadata, it is aware of which internal endpoints to make available to outside clients and what security rules apply to the endpoints. It also knows on which external gateways to expose the endpoints to Internet clients. It calls the external gateway(s) using HTTPS (SSL) over port 443. The usage of this protocol and port is typically allowed by most organizations and firewall configurations permit the traffic to flow freely. If an organization does not allow SSL traffic for some reason, SecureWithin™ can handle communications to the metadata service and the external gateway over port 80 with the HTTP payload encrypted.

A set of persistent connections is established between the internal gateway and the external gateway. The external gateway exposes TCP/IP ports as defined by the customer. When defining how endpoints will look to external clients, the customer may indicate the exact port number, service name and host name. To Internet clients, the newly exposed external gateway looks exactly like the internal endpoint which it expose or alternatively, if a transformation was specified - looks completely differently.

The external gateway receives its configuration data by contacting (on a configurable periodic basis) the Bitkoo metadata service. It too authenticates itself to the metadata service using X.509 certificates.

Internally, as calls are made from Internet clients to the external gateway, they are queued in memory and pulled by the internal gateway that already  established a persistent connection earlier over SSL. The internal gateway evaluates the request against a set of security rules to ensure that the request is valid, non-malicious and legit. If it passes the security validation step, it is optionally logged. The logging can be configured to record the entire request/response, just the request or the response, key elements about of request, just the origin and timestamp, etc.

Invalid requests are logged as well, with identical requests being logged intelligently as to avoid exhaustion of the storage device. Algorithms are in place to defend against denial of service attacks or intrusion attempts. The software actively protects against such attacks by blocking subsequent requests from suspect clients. In addition, the software alerts Bitkoo personnel and designated customer personnel of attacks in real time via multiple configurable channels (Email, Web Services or SMS messages).   

When a request is determined to be valid, the internal gateway calls the LAN-based endpoint using the appropriate credentials. The original request is optionally transformed. The optional transformation is defined as part of the customer-defined metadata.

Upon a response from the endpoint, depending on the type of endpoint and how the metadata was defined, the request is sent back to the external gateway over the already established communications channel and the external gateway correlates the response to the correct caller and sends the response to the client. A transformation step can optionally occur at this stage as well and as described before the transformation is an aspect defined in the customer definable metadata.

From all described thus far, the SecureWithin™ architecture extends the internal network to the external Internet (or other networks) by marshalling all requests/responses via an existing firewall using well known and allowed ports, without having to re-configure or poke holes in the firewall.  Sophisticated algorithms are used to guarantee security and high throughput.

This provided a 30,000-foot view of the SecureWithin™ architecture. In the sections below we will provide more detailed information about various aspects of the product.

High performance

Security

Visit the Authors Web Site