Performance considerations with access control in a distributed system architecture

Question

We're currently working on upgrading a small information system for an enterprise. Currently, the system has a corporate network zone (CORP) where services for internal users are placed, and a data center network segment (DC) where a data access service and all databases reside. All applications are essentially deployed in web servers and communication between them is done over HTTPS.

We need to install a new network zone, the DMZ, where a few externally-available services will be placed. During our meetings, we've come across an issue which might be of importance.

Data requests arriving from the internet arrive at DMZ Data Access service. DMZ Data Access forwards the request to CORP External Request Handler (which is essentially a proxy that authenticates the request is coming from DMZ Service 1) which then forwards the request to the DC Data Access service.

The problem comes when you add access control checks. Due to the way the previous system is set-up, users, roles, and permissions can be retrieved only through the DC Data Access service. This means that if we build interceptors which check user permissions in DMZ Data Access, the flow of data will include:

User -> DMZ Data Access (permission check) -> CORP External Request Handler -> DC Data Access (permission ok) -> CORP External Request Handler -> DMZ Data Access (permission granted, request data) -> CORP External Request Handler -> DC Data Access -> CORP External Request Handler -> DMZ Data Access -> User

We might be able to move the access control checks to the DC Data Access layer in order to simplify the flow a bit, but we're still not sure what impact on the performance this would have, nor any idea how susceptible this is to a DDoS attack.

However, we're not sure if this is the correct approach. Is there any standard way to deal with this issue, should we merge our access control and data access checks into a single request, or are we simply doing premature optimization?

One thing to note is that we can't rely on active directory or some other authorization provider, as we need to integrate into the existing infrastructure.

Answer 1

If you leak the data through the DMZ prior to authorization, you might not have a real DMZ, you might just have a router named DMZ. It depends on details.

Generally, it is a separate issue if the authorization is needed and when, than how to route it. You don't move the security checks around for performance reasons. That isn't premature optimization, it is a worse problem; security theater. Decide what access controls you need based on access and security needs only. Then you build the network around those needs. Networking itself is cheap compared to processing, so the performance shouldn't be significantly impacted either way in most cases.

Answer 2

One of the typical ways you deal with this is with the concept of tokens/tickets. Essentially you get the details of what access the user has from the authority and you sign/encrypt it into a token that is then passed around with the request. Each component of the solution can then inspect the token and determine whether access granted allows for the action being taken without having to go back to the authority.

The main challenge in this approach (aside from getting it right) is determining how long these tokens are good for. If a client has authorizations or access removed but still has a valid token or ticket, they can still access things they are no longer authorized for.

You really don't want to do this yourself either. You should look into existing packages that provide the necessary cryptographic capabilities and wrap your existing infrastructure with them.