API access to security-sensitive computing systems

Abstract

Controlling API access actions in a security-sensitive computing system includes: for an action to be performed, selecting an available operator account from an operator account database, generating a unique action tag, the unique action tag including an identifier for the API access action and a unique API access key for performing the API access action; maintaining a dynamic access list, the dynamic access list having a mapping of the identifier of the API access action and the unique API access key to the selected operator account; granting authorization for API access to the security-sensitive computing system to the selected operator account via the dynamic access list and the unique action tag, the authorization being limited to performing the mapped API access; and revoking further API access based on the unique action tag after the operator has performed the API access.

Description

Background Art

[0001] The present invention generally relates to the field of secure access to computing systems, and more particularly to a method for controlling application programming interface (API) access in a security-sensitive computing system. Summary of the Invention

[0002] According to one aspect of the present invention, a method for controlling application programming interface (API) access actions in a security-sensitive computing system is provided. The operations of the method may include: for the action to be performed, selecting an available operator account from an operator account database, generating a unique action tag, the unique action tag containing an identifier for the API access action and a unique API access key for performing the API access action, and maintaining a dynamic access list having a mapping of the identifier of the API access action and the unique API access key to the selected operator account. In addition, the method may include granting authorization for API access actions to the security-sensitive computing system to the selected operator account via the dynamic access list and the unique action tag, the authorization being limited to performing the mapped API access action, and revoking further API access actions based on the unique action tag after the operator has performed the API access action.

[0003] According to another aspect of the present invention, an access control system for controlling application programming interface (API) access actions in a security-sensitive computing system is provided. The access control system may include a memory communicatively coupled to a processor, wherein the memory stores a program code portion to enable the processor to select an available operator account from an operator account database for an API access action to be performed to generate a unique action tag, the unique action tag containing an identifier of the API access action and a unique API access key for performing the API access action. The stored program code may enable the processor to additionally maintain a dynamic access list having a mapping of the identifier of the API access action and the unique API access key to the selected operator account, granting authorization for API access actions to the security-sensitive computing system to the selected operator account via the dynamic access list and the unique action tag, the authorization being limited to performing the mapped API access action, and revoking further API access actions based on the unique action tag after the operator has performed the API access action.

[0004] Furthermore, embodiments may take the form of an associated computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer or any instruction execution system. For the purposes of this specification, a computer-usable or computer-readable medium can be any apparatus including means for storing, communicating, propagating, and / or transmitting a program for use by or in connection with an instruction execution system, apparatus, or device. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] Figure 1 A block diagram illustrating an embodiment of the method of the present invention for controlling API access actions in a security-sensitive computing system;

[0006] Figure 2 A block diagram illustrating components and related information flows of an embodiment of the present invention;

[0007] Figure 3 A block diagram showing a first portion of components involved in an information flow according to an embodiment of the present invention;

[0008] Figure 4 A block diagram showing a second portion of components involved in the information flow of an embodiment of the present invention;

[0009] Figure 5 An embodiment of an access control system for controlling API access actions in a security-sensitive computing system is shown; and

[0010] Figure 6 A computing system and an access control system according to an aspect of the invention are shown. DETAILED DESCRIPTION

[0011] In the context of this specification, the following conventions, terms and / or expressions may be used:

[0012] The term "application programming interface access action"—in short, API access action—can refer to a call to any type of application programming interface. Examples may include the APIs of operating systems, databases, configuration files, middleware components, and / or applications. Access to components underlying an API can be performed by another program or directly by the user interface of the API. Access actions can include any type of effect on components underlying the API, including but not limited to read access, write access, change access, and / or delete access. Essentially, each access action should be understood as an access to a component underlying the API, where the access can change the settings of the component.

[0013] The term "security-sensitive computing system" may refer to a highly secure computing system with strict controls on access to it. Typically, such a system is implemented as a secure enclave that is part of a complete so-called mainframe computing system, such as an IBM Z system complex.

[0014] The term "operator account" can refer to a user ID (identifier) dedicated to an operator of a security-sensitive computing system. The access privileges granted to an operator user may far exceed the access privileges granted to application users of the security-sensitive computing system. Until now (i.e., in traditional systems), operator access privileges have been a security threat to the security-sensitive computing system. The proposed concept helps to bridge this gap.

[0015] The term "unique action tag" can refer to a one-time identifier, and may also refer to a time-dependent identifier (i.e., valid only for a predefined period of time) that enables a selected operator to perform a one-time API access action. Once the one-time API access action has been performed, the unique action tag may lose its validity. That is, a second API access action of the same type may be revoked.

[0016] The term "unique API access key" may refer to a numeric code used to enable access to a specific API.

[0017] The term "dynamic access list" may refer to a database or table that maps unique action labels and operators for one-time API access actions to specific APIs.

[0018] The term "selected operator account" may refer to a user ID that has been selected to be authorized for a one-time API access action in order to perform troubleshooting or another required or recommended maintenance task.

[0019] The term “authorization for an API access action” may mean that a selected operator may have time-limited access rights to a corresponding API.

[0020] The term "revoke further API access actions" may indicate that revocation can occur after the unique API access key has been used, and the underlying issue may have been resolved or maintenance tasks have been performed. The unique API access key cannot be used again in conjunction with the unique access ticket. This can further improve system security in highly secure computing systems.

[0021] The term "secure appliance" may denote a portion of our complete highly secure computing system, for example implemented as a secure enclave. Typically, such systems are implemented in the form of so-called mainframe computer systems.

[0022] The term "secure enclave" can refer to a highly secure and typically private computing environment that is part of a larger computing complex. All access and accounts are typically protected by a secure key mechanism.

[0023] The term "system log file" may refer to a list of activities that have occurred on a computer system. The list of activities may be time-stamped. Alternatively, the list may include a list of users or subcomponents involved in the activities performed.

[0024] The proposed method for controlling application programming interface (API) access actions in a security-sensitive computing system can provide multiple advantages, contributions and technical effects:

[0025] The core of the proposed concept can be based on selective one-time actions and the assignment of a selective group of system administrators who can perform the required action once, based on a dynamically generated access control list that can be determined based on the parsed action tag. Once authorization is given to a specific operator and the task at hand (i.e., access action to the API) has been completed, the secondary access to the API can be revoked.

[0026] Thus, the proposed concept can ultimately be used to serve in IT environments with highly secure systems, where the operations team will not have direct access (i.e., uncontrolled access) to the operating system interfaces (i.e., in the form of SSH (Secure Shell) access) (only through predefined APIs), only highly controlled access to the actions of dedicated operators, and where all API calls should be audited and executed in a controlled and monitorable environment.

[0027] In short, the authority given to the operations team can be further restricted so that the highly secure computing environment can be even better self-controlled by its inherent self-monitoring subsystem.

[0028] Using a unique action tag for a given API access action that may become invalid after the given API access action has been executed can provide a self-locking after the API access action has been executed. It can also ensure that the operator's intention of the API access action is successful.

[0029] If this is not the case, access to the API can also be automatically extended based on predefined rules and (configurable) procedures in order to resolve a given system issue as quickly as possible.

[0030] In the following paragraphs, additional embodiments applicable to this method and related systems are described:

[0031] According to one embodiment of the method, the selected operator account can be a group of operator accounts. Thus, the appropriate operator for performing the action of accessing the API can be selected based on actual availability (e.g., "on duty" rather than on vacation), based on skills, or any other group-defining characteristics. In a cloud computing environment, the selection of an operator or group of operators can also be based on the client using the specific cloud computing system.

[0032] According to another embodiment of the method, the API access action may be a set of API access actions. This includes different types of access actions to the same API, as well as API access actions to different APIs with the same or different (multiple) access actions. This may be advantageous for the following reasons: if a single API access action cannot fix a malfunctioning system function, authorization to perform additional API access actions may be triggered based on predefined settings (or configurations) of the access control system. Thus, there is no need to completely restart the complete selection and assignment process of API access actions for the operator from the beginning. Therefore, according to another embodiment of the method, the API access action group may reference different APIs.

[0033] According to one embodiment of the method, the security-sensitive system can be implemented as a secure device in the form of a secure enclave. Such a device or system can be designed from the ground up as a highly protected system, preventing open access to any component or its associated API. Only highly secure and controlled users or other systems are permitted or authorized to access such a secure device. However, operator access to the system API is generally still permitted. To close this loophole, the proposed security system can be instrumented.

[0034] According to another embodiment, the method further includes monitoring and analyzing a system log file or multiple system log files to determine a requirement for an API access action. This can be performed by a logging and analysis system that can trigger a dynamic access control and action resolver, where a requirement for access to the API of the security device may have been determined.

[0035] According to an embodiment of the method, the API access action may be at least one selected from the group consisting of modifying the configuration of the security-sensitive computing system (i.e., at least one resource or component thereof) and enabling another component of the security-sensitive computing system. This may also include making available a dormant component of the security-sensitive computing system, i.e., an inactive component, such as an additional processor core, more memory with greater storage capacity, or higher memory bandwidth.

[0036] According to an embodiment of the method, revoking further API access actions may further include monitoring the completion of API access actions before revoking further API access actions. Thus, an authorized API access action can be performed only once. Once a particular access action has been completed, a second API action is now possible based on the same access token. Therefore, it is impossible—or, better yet, pointless—for an operator to secretly store the access token for later use, particularly unauthorized use. Regardless, the later use, i.e., the second use, will be revoked.

[0037] According to one embodiment of the present invention, the method may further include expanding access controlled by the unique action key to a set of additional APIs if the previous access action did not result in a working solution. This may be particularly useful if the problem to be solved or the task to be performed cannot be completed with a single API access action. Therefore, the completion flag for a successful API access action should not be set. Thus, based on predefined rules and processes, expansion of the APIs and potential actions required to solve the task at hand can be automatically permitted.

[0038] According to one embodiment of the present invention, the method may further include sending a notification to the selected operator account. The notification may include details about the desired API access action—typically, more details. The details may include additional context, specific instructions, additional required resources, actions to be performed in advance (worst-case scenario, a shutdown of the computing system or a warning to active users), or backup activities.

[0039] The following paragraphs provide detailed descriptions of the accompanying drawings. All illustrations in the drawings are for schematic purposes only. First, a block diagram of an embodiment of the present invention for controlling API access actions in a security-sensitive computing system is provided. Next, an embodiment of an access control system for controlling API access actions in a security-sensitive computing system, as well as other embodiments, will be described.

[0040] Figure 1 A block diagram illustrates an embodiment of a method 100 for controlling application programming interface (API) access actions in a security-sensitive computing system. The method 100 includes selecting 102 an available operator account from an operator account database for an action to be performed, and generating 104 a unique action tag containing an identifier for the API access action and a unique API access key for performing the API access action.

[0041] The method 100 further comprises maintaining 106 a dynamic access list having a mapping of identifiers of API access actions and unique API access keys and the selected operator account. It may be noted that the unique API access key is different from the unique action label.

[0042] In addition, the method 100 further includes granting 108 authorization for API access actions on the security-sensitive computing system to the selected operator account via the dynamic access list and the unique action tag, the authorization being limited to executing only the mapped API access actions. Thus, it can be noted that the mapping can be learned from the dynamic access control list.

[0043] Finally, the method 100 includes revoking 110 further API access actions based on the unique action tag already performed by the operator. Thus, the selected operator may only perform once the assigned task, ie the dedicated API access action identified by the unique action tag.

[0044] Figure 2 A block diagram 200 illustrates the components and associated information flows of an embodiment of the present invention. The process begins with a log 208, which may be generated by the operation of a security appliance 202 running, for example, on a mainframe (MF) computer system. The log file 208 may be continuously retrieved (210) and may also be analyzed in a logging and analysis system 212. Upon determining an error or maintenance requirement, a notification is sent 214 to a dynamic access control and action resolver 216.

[0045] The dynamic access control and action resolver 216 can access 218 a list of available operators (220, a list of on-duty operators and / or skilled operators, or a list of operators generally authorized to perform the task at hand) and authorize 224 access to at least one selected operator 222. The at least one available operator 222 is registered as on-duty in the on-duty operator list 220. The dynamic access control and action resolver 216 also notifies 228 the selected operator via the API 204 to perform 232 the allowed actions to resolve a potential error or complete a required maintenance task. Access to the API is controlled by the API access management component 206, which receives 230 authorization for API access actions for the selected operator 222.

[0046] Once the API access action is completed—which may be signaled 234 by the API access management component 206 to the dynamic access control and action resolver 216—further access to the API 204 is revoked 236, 238 via the dynamic access list 226 (and associated control components) and the API access management component 206. It may be noted that the dynamic access control and action resolver 216 may actively check the security appliance 202 or one of its components (e.g., the API access management component 206 or one of the log files 208) to check for API access action completion.

[0047] It should be noted that API(s) 204, log files 208, and API access management component 206 are all part of security appliance 202. Furthermore, in addition to analyzing log files for errors or required maintenance actions, logging and analysis system 212 can also decide or determine that a particular API access action should be performed based on the determined errors or required maintenance actions.

[0048] In addition, the dynamic access control and action resolver 216 performs a list of instrumentation activities that support the concepts proposed thereby: listening for notifications from the recording and analysis system 212, extracting the actions required for each notification, determining potential assignees (i.e., operators) on duty, creating action tags, registering the action tags with the operators 222 to the dynamic access list 226, assigning the action tags and notifying the selected operators 222, resolving the actions to be performed, verifying whether the API access action was initiated and / or completed, and invalidating the API action tags in the dynamic access list 226 so that further API access is no longer possible (i.e., revoked).

[0049] Figure 3 A block diagram 300 is shown of the first part of the components involved in the information flow of an embodiment of the inventive concept. In the top portion of the diagram, the components involved are listed: front-end components 302 for administrators, dynamic access lists 304 (compare to the example from Figure 2 Dynamic access list 226) and dynamic access control and action parser 306 (compare from Figure 2 Dynamic access control and action parser 216).

[0050] Figure 3 To the right of the diagram are the flow chart connectors A, B, C, D, E, which are connected to Figure 4 For the sake of understanding, the overall information flow must be in Figure 3 and Figure 4 Separate between.

[0051] The actor, that is, the selected operator 222 (compare Figure 2 ) is shown in Figure 3 On the left side, the administrator's front end 308 permanently listens for notifications (228, Figure 2 ). A corresponding trigger signal is generated by the notifier 310. This may be associated with the dynamic access control list 304. This may also apply to the activity of obtaining 312 notification from the dynamic access control and action resolver 306 in order to generate a request 314 for an access token for the transferee of the security device.

[0052] The dynamic access control and action parser 306 includes a notification listener component 316 that triggers the extraction 318 of the access action(s) and determines the selected operator. A unique action tag (320) is then created for the operator. In addition, the dynamic access control and action server 316 monitors 322 and determines whether the API access action was executed within a predefined time. If this is not the case, the process waits 324 for a predetermined period of time before performing monitoring 322 again.

[0053] Now refer to Figure 4 As can be seen, there are some information bubbles indicating that there are process flow connections between the dynamic access control and actual server 306 and the recording and monitoring component 402; these subsequent connections are represented as A, B, C, D, E. Figure 4 The embodiment of the present invention is shown Figure 3 and Figure 4 A block diagram 400 of a second portion of components involved in the information flow of an embodiment is collectively represented.

[0054] It can also be seen that by A from the trigger action (318 and the operator on duty list 406 (equivalent to Figure 2 220) of the extracted connection, after determining 408, triggering a notification listening process 316 by B, wherein an API access action regarding potential error correction of the required maintenance task should be performed, which is based on the analysis 410 of the log 412 of the security device 404. Here, it can also be mentioned that, where appropriate, Figure 2 The reference numerals have been added in brackets to Figure 3 and Figure 4 .

[0055] It is also possible to see via C the request 314, the access token of the assignee of the security device (ie, the selected operator) and the access token from the dynamic access list 416 (eg, database, compare 226, Figure 2 ) and the logical connection between the operator 222 and access to the API 418 of the security device 404. In addition, a connection to the continuous health check 420 of the system is shown via D-. In addition, if an API access action is not performed within a predetermined time period, the API access management 414 is also notified via D- that the potential API access action should be revoked.

[0056] For completeness reasons, Figure 5An embodiment of an access control system 500 for controlling API access actions in a security-sensitive computing system is shown. The system 500 includes a memory 502 communicatively coupled to a processor 504, wherein the memory 502 stores program code portions (not shown) for enabling the processor 504 of the API access action to select an available operator account from an operator account database, specifically by a selection unit 506, generate a unique action tag containing an identifier of the API access action and a unique API access key for performing the API access action, specifically by a generation module 508, maintain a dynamic access list having a mapping of the identifier of the API access action and the unique API access key to the selected operator account, grant authorization for API access actions to the security-sensitive computing system to the selected operator account, specifically by an access granting unit 512, via the dynamic access list and the unique action tag, the authorization being limited to performing the mapped API access action, and revoke further API access actions based on the unique action tag after the operator has performed the API access action, specifically by a revocation module 514.

[0057] It can be noted that the activities of the access control system 500 can also be completely implemented as hardware components that exchange data with the memory 502 and the processor 504. Therefore, the memory 502, the processor 504, the selection unit 506, the generation module 508, the maintenance module 510, the access authorization unit 512 and their revocation modules 514 can be connected to each other for data and information exchange. Alternatively, the activity units and modules can be linked via the access control system internal bus system 516 for data and signal exchange. This can make the complete hardware implementation elegantly achievable.

[0058] Embodiments of the invention may be implemented with virtually any type of computer, regardless of whether the platform is suitable for storing and / or executing program code. Figure 6 As an example, a computing system 600 suitable for executing program code associated with the proposed method is shown.

[0059] The computing system 600 is merely one example of a suitable computer system and is not intended to impose any limitations on the scope of use or functionality of the embodiments of the present invention described herein, regardless of whether the computer system 600 is capable of being implemented and / or performing any of the functions set forth above. In the computer system 600, there are components that can operate with numerous other general-purpose or special-purpose computing system environments or configurations. Examples of well-known computing systems, environments, and / or configurations suitable for use with the computer system / server 600 include, but are not limited to, personal computer systems, server computer systems, thin clients, fat clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments including any of the above systems or devices. The computer system / server 600 can be described in the general context of computer system executable instructions, such as program modules executed by the computer system 600. Typically, a program module can include routines, programs, objects, components, logic, data structures, etc. that perform specific tasks or implement specific abstract data types. Computer system / server 600 may be practiced in a distributed cloud computing environment where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media, including memory storage devices.

[0060] As shown in the figure, computer system / server 600 is illustrated in the form of general computing device.The components of computer system / server 600 may include, but are not limited to, one or more processors or processing units 602, system memory 604 and the bus 606 that couples the various system components including system memory 604 to processor 602. Bus 606 represents one or more of any one of several types of bus structures, including memory bus or memory controller, peripheral bus, accelerated graphics port and processor or local bus using any one of various bus architectures. As examples and not limitations, these architectures include industrial standard architecture (ISA) bus, microchannel architecture (MCA) bus, enhanced ISA (EISA) bus, video electronics standard association (VESA) local bus and peripheral component interconnect (PCI) bus. Computer system / server 600 generally includes various computer system readable media. Such media can be any available media that can be accessed by computer system / server 600, and it includes both volatile and non-volatile media, removable and non-removable media.

[0061] System memory 604 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 608 and / or cache memory 610. Computer system / server 600 may also include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 612 may be provided for reading from and writing to a non-removable, non-volatile magnetic medium (not shown and commonly referred to as a "hard drive"). Although not shown, a magnetic disk drive for reading from and writing to a removable, non-volatile magnetic disk (e.g., a "floppy disk") may be provided, as well as an optical disk drive for reading from or writing to a removable, non-volatile optical disk such as a CD-ROM, DVD-ROM, or other optical media. In this case, each may be connected to bus 606 via one or more data media interfaces. As will be further depicted and described below, memory 604 may include at least one program product having a set (e.g., at least one) program module configured to perform the functions of an embodiment of the present invention.

[0062] A program / utility having a set (at least one) of program modules 616, as well as an operating system, one or more application programs, other program modules, and program data, may be stored in memory 604, by way of example and not limitation. Each of the operating system, one or more application programs, other program modules, and program data, or some combination thereof, may include an implementation of a networking environment. Program modules 616 generally perform the functions and / or methods of embodiments of the present invention as described herein.

[0063] Computer system / server 600 may also communicate with one or more external devices 618, such as a keyboard, pointing device, display 620, etc.; one or more devices that enable a user to interact with computer system / server 600; and / or any device that enables computer system / server 600 to communicate with one or more other computing devices (e.g., a network card, modem, etc.). Such communication may occur via input / output (I / O) interface 614. Furthermore, computer system / server 600 may communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), and / or a public network (e.g., the Internet), via network adapter 622. As depicted, network adapter 622 may communicate with other components of computer system / server 600 via bus 606. It should be understood that, although not shown, other hardware and / or software components may be used in conjunction with computer system / server 600. Examples include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems.

[0064] Furthermore, an access control system 500 for controlling API access actions in security-sensitive computing systems may be attached to the bus system 606 .

[0065] The description of various embodiments of the present invention has been provided for the purpose of illustration, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein was chosen to best explain the principles of the embodiments, practical applications, or improvements over existing technologies in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.

[0066] The present invention can be implemented as a system, method and / or computer program product. The computer program product may include a computer-readable storage medium (or multiple media) having computer-readable program instructions thereon, the computer-readable program instructions being used to cause a processor to perform various aspects of the present invention.

[0067] The medium can be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system for propagating the medium. Examples of computer-readable media may include semiconductor or solid-state memory, magnetic tape, a removable computer disk, random access memory (RAM), read-only memory (ROM), a hard disk, and an optical disk. Current examples of optical disks include compact disk read-only memory (CD-ROM), compact disk read / write (CD-R / W), DVD, and Blu-ray Disc.

[0068] A computer-readable storage medium can be a tangible device that can retain and store instructions used by an instruction execution device. A computer-readable storage medium can be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device such as a punch card or a raised structure in a groove on which instructions are recorded, and any suitable combination thereof. As used herein, a computer-readable storage medium should not be interpreted as a temporary signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated by a waveguide or other transmission medium (e.g., a light pulse by an optical fiber cable), or an electrical signal transmitted by a wire.

[0069] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in a computer-readable storage medium within the corresponding computing / processing device.

[0070] The computer-readable program instructions for performing the operation of the present invention can be assembly instructions, instruction set architecture (ISA) instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages (such as Smalltalk, C++, etc.) and conventional procedural programming languages (such as "C" programming language or similar programming languages). The computer-readable program instructions can be executed completely on the user's computer, partially on the user's computer as an independent software package, partially on the user's computer and partially on a remote computer, or completely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (such as, using an Internet service provider through the Internet). In certain embodiments, in order to perform various aspects of the present invention, the electronic circuit comprising, for example, a programmable logic circuit, a field programmable gate array (FPGA) or a programmable logic array (PLA) can execute the computer-readable program instructions to personalize the electronic circuit by utilizing the state information of the computer-readable program instructions.

[0071] Aspects of the present invention are described herein with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems) and computer program products according to embodiments of the present invention. It will be understood that each block of the flowcharts and / or block diagrams and the combination of blocks in the flowcharts and / or block diagrams can be implemented by computer-readable program instructions.

[0072] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine, such that the instructions executed by the processor of the computer or other programmable data processing device create a device for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, which can direct the computer, programmable data processing device, and / or other equipment to operate in a specific manner, such that the computer-readable storage medium having the instructions stored therein includes an article of manufacture, which includes instructions for implementing various aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0073] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or another device to cause a series of operational steps to be performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable apparatus, or another device implement the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0074] Flowchart and / or block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention.In this regard, each frame in flow chart or block diagram can represent a module, segment or part of an instruction, which includes one or more executable instructions for realizing the specified logical function. In some alternative embodiments, the function mentioned in the frame may not occur in the order mentioned in the figure. For example, the two frames shown in succession can actually be performed substantially simultaneously, or these frames can sometimes be performed in reverse order, depending on the function involved. It will also be noted that the combination of the frames in each frame of block diagram and / or flow chart illustration and block diagram and / or flow chart illustration can be realized by a dedicated hardware-based system that performs a specified function or action or performs a combination of special-purpose hardware and computer instructions.

[0075] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used herein, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0076] All means or steps in the following claims plus the corresponding structure, materials, actions and equivalents of functional elements are intended to include any structure, material or action for performing a function in combination with other claimed elements as specifically claimed. The description of the present invention has been given for the purpose of illustration and description, but this description is not exhaustive or limits the invention to the disclosed form. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the invention. The embodiments are selected and described in order to best explain the principles of the invention and practical applications, and to enable others of ordinary skill in the art to understand the various embodiments of the present invention with various modifications, as suitable for the intended specific use.

[0077] Some additional definitions are provided below:

[0078] The present invention: should not be taken as an absolute indication that the subject matter described by the term "the present invention" is covered by the claims as filed, or by claims that may eventually issue subsequent to the filing of a patent application; while the term "the present invention" is used to help the reader gain a general sense as to how the disclosure herein is believed to be potentially new, that understanding, as indicated by the use of the term "the present invention," is tentative and provisional and is subject to change during the course of patent prosecution as relevant information develops and the claims are potentially amended.

[0079] Example: See definition of "the present invention" - similar caveats apply to the term "embodiment."

[0080] and / or: includes the terminal value or; for example, A, B and / or C means that at least one of A or B or C is real and applicable.

[0081] Include / Contain / Include: Unless expressly stated otherwise, means "including but not necessarily limited to."

[0082] User / Subscriber: includes, but is not necessarily limited to: (i) a single individual person; (ii) an artificial intelligence entity with sufficient intelligence to act as a user or subscriber; and / or (iii) a group of related users or subscribers.

[0083] Data Communications: Any type of data communications scheme now known or developed in the future, including wireless communications, wired communications, and communications routes having both wireless and wired portions; data communications are not necessarily limited to: (i) direct data communications; (ii) indirect data communications; and / or (iii) data communications in which the format, packetization state, medium, encryption state, and / or protocol remain constant throughout the data communications.

[0084] Receive / Provide / Send / Input / Output / Report: Unless expressly specified otherwise, these words should not be taken to imply: (i) any particular degree of directness as to the relationship between their object and subject; and / or (ii) the absence of intervening components, actions and / or things between their object and subject.

[0085] No substantial human intervention: A process that occurs automatically (typically through the operation of machine logic, such as software) with little or no human input; some examples of "no substantial human intervention" include: (i) a computer is performing complex processing, and due to a power outage in the grid, a human switches the computer to an alternative power source, allowing processing to continue uninterrupted; (ii) a computer is performing resource-intensive processing, and a human confirms that the resource-intensive processing should indeed be performed (in this case, the confirmation process considered in isolation is with substantial human intervention, but the resource-intensive processing does not include any substantial human intervention, although a simple yes-no style confirmation by a human is required); and (iii) using machine logic, a computer has made a weighted decision (e.g., a decision to land all aircraft in anticipation of severe weather), but the computer must obtain a simple yes-no style confirmation from a human source before implementing the weighted decision.

[0086] Automatically: without any human intervention.

[0087] Include / Comprising / Includes: As used in this specification (particularly outside the claims section), this term is fully synonymous with the term "comprise" and its various conjugated forms (as defined in this specification). The term "comprises" (and its various conjugated forms) as used in the claims is to be given its ordinary interpretation consistent with patent claim construction.

[0088] Module / Sub-module: Any collection of hardware, firmware, and / or software that works operatively to perform a function, regardless of whether the module is: (i) in a single localized proximity; (ii) distributed over a wide area; (iii) in a single proximity within a larger piece of software code; (iv) located within a single piece of software code; (v) located in a single storage device, memory, or media; (vi) mechanically connected; (vii) electrically connected; and / or (viii) connected in a data communication manner.

[0089] Computer: Any device with significant data processing and / or machine-readable instruction reading capabilities, including but not limited to desktop computers, mainframe computers, laptop computers, devices based on field programmable gate arrays (FPGAs), smartphones, personal digital assistants (PDAs), body-mounted or embedded computers, embedded device-type computers, and devices based on application-specific integrated circuits (ASICs).

Claims

1. A method for controlling an application programming interface (API) access action, the method comprising: determining required API access actions to be performed on the security-sensitive computing system, wherein the required API access actions include a set of API access actions of different types; Selecting, from an operator account database, an available operator account listed in the operator account database, the operator account being responsible for performing an API access action from the set of API access actions in the first API, the API access action being one of the following access action types: read access, write access, change access, and delete access; generating a unique action tag, wherein the unique action tag includes an identifier for the API access action and a unique API access key for accessing the first API; registering a unique action tag including an identifier and the unique API access key and the selected available operator account into a dynamic access list; Granting authorization to the selected operator account to perform API access actions in the first API; as well as In response to the API access action using the unique action tag being completed, revoking further use of the unique API access key, The method further comprises: In the event that a previous access action did not achieve a working solution, access controlled by the unique API access key is extended to a set of additional APIs, where the previous access action was completed without setting the completion flag of the previous access action, and the working solution cannot be completed with only the previous access action. The method of claim 1 , wherein the group of API access actions relates to different APIs.

3. The method of claim 1 , wherein the security-sensitive computing system is implemented as a secure device in the form of a secure enclave.

4. The method according to claim 1, further comprising: Monitor and analyze system log files to determine API access requirements. 5 . The method of claim 4 , wherein the API access action is selected from at least the group consisting of: modification of a configuration of the security-sensitive computing system and enabling of a component of the security-sensitive computing system.

6. The method of claim 1 , wherein revoking further use of the unique API access key comprises: The completion of the API access action is monitored.

7. The method according to claim 1, further comprising: A notification is sent to the selected operator account, wherein the notification includes details about the API access action.

8. An access control system for controlling access actions of an application programming interface (API), the system comprising: Processor collection; machine-readable storage devices; as well as Computer code is stored on the machine-readable storage device, the computer code comprising instructions and data for causing the processor set to perform operations according to any one of claims 1 to 7.

9. A computer program product for controlling access actions of an application programming interface (API), the computer program product comprising: machine-readable storage devices; as well as Computer code is stored on the machine-readable storage device, the computer code comprising instructions and data for causing a processor set to perform operations according to the method according to any one of claims 1 to 7.

10. An access control system for controlling access actions of an application programming interface (API), the system comprising means for performing operations according to the method according to any one of claims 1 to 7.

Images