API Access Control via Provider Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems for accessing restricted application programming interfaces (APIs) on mobile devices lack efficient and secure mechanisms for intra-application and application-system platform interactions, leading to security risks and reluctance among developers to provide access to sensitive APIs, which hinders the development of a healthy application ecosystem.
Innovation Solution
Implementing a controlled access mechanism where the provider of the restricted API determines and manages access, using authorization credentials and digital signatures to ensure authenticity and intended usage, allowing only authorized applications to access restricted APIs, and enabling system providers to participate in the permission-granting process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If user-based permission confirmation is used during application installation, then ease of operation is improved, but security is worsened because hackers can fraudulently obtain user permission
Solution Approach 1:
Instead of the user deciding whether to grant permission, the API provider (developer or system platform) decides whether to grant permission to the application. This inversion of the decision-making authority从根本上解决了用户被欺诈的问题，因为权限授予方现在是可信的API提供者而非易受攻击的用户
Solution Approach 2:
The system platform acts as an intermediary between the application and the restricted API. The platform manages the permission-based mechanism and verifies credentials, preventing direct access that could be compromised by user fraud while maintaining controlled access to restricted resources
2Reliability
If developers are given control over API access permissions, then security is improved, but device complexity increases due to additional authorization mechanisms
Solution Approach 1:
The API provider themselves manages the permission granting for their own APIs through credentials stored in the application. This self-service approach eliminates the need for complex centralized authorization systems while maintaining security, as each API owner controls access to their own resources
Solution Approach 2:
The permission management functionality is extracted from the system platform and placed directly in the application through stored credentials. This removes the burden of complex authorization management from the device while maintaining security controls at the application level
3Adaptability or versatility
If excessive access permissions are specified by developers, then adaptability is improved, but security is worsened due to increased attack surface
Solution Approach 1:
Each API has its own specific permission credentials stored locally in the application, allowing fine-grained control over which applications can access which specific APIs. This local quality approach enables precise permission management rather than blanket permissions, maintaining adaptability while reducing security risks by limiting access to only what is necessary
Data Source
AI summary
A method for accessing a restricted application programming interface (API) is disclosed, including: receiving, from a first application, a request to access the restricted API, the restricted API not supported by the first application; determining whether the first application is authorized by a provider of the restricted API to access the restricted API; and granting, in response to the determination that the first application is authorized by the provider of the restricted API to access the restricted API, the first application access to the restricted API.