API Authorization System for Dynamic Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing micro-service applications lack effective access control mechanisms, making it difficult to implement complex access controls without adding unnecessary functional complexity, and these controls are often static and impossible to modify dynamically while the application is running.
Innovation Solution
An API-authorization system that supports three types of interfaces to influence authorization decisions: embedding a policy agent within applications, using existing access control and authorization APIs, and leveraging authentication protocols to piggyback authorization information, allowing the system to interact with thousands of applications without requiring changes from them.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access control rules are coded within an application's code base, then access control functionality is achieved, but the application becomes difficult to modify and maintain
Solution Approach 1:
The patent extracts access control functionality from the application code base and places it in external policy files. This allows access control rules to be modified independently of the application code, reducing application complexity while maintaining access control reliability. The policy files are loaded at runtime, enabling changes without recompiling or restarting the application.
Solution Approach 2:
The patent introduces an intermediary layer (policy loading mechanism) between the application and access control rules. This intermediary allows dynamic loading and modification of access control policies without changing the application code, thus maintaining functionality while reducing complexity.
2Reliability
If access control rules are hardcoded in the application, then access control is implemented, but dynamic modification while running is impossible
Solution Approach 1:
The patent implements dynamic access control by loading policies from external files at runtime. This allows access control rules to be modified dynamically without restarting the application, achieving both reliable implementation and adaptability. The system can load different policy files based on runtime conditions and user contexts.
Solution Approach 2:
The patent prepares access control policies in advance by storing them in external policy files that can be modified before runtime. These pre-prepared policies are then loaded into memory during application execution, enabling dynamic modification without affecting the core application logic.
3Reliability
If complex access controls are incorporated in micro-service applications, then comprehensive authorization is achieved, but the applications are burdened with unnecessary functional complexity
Solution Approach 1:
The patent extracts complex access control logic from micro-service applications and places it in external policy files. This allows micro-services to maintain their simplicity while still enforcing comprehensive authorization rules. The applications only need to load and enforce policies, not implement the complex authorization logic themselves.
Solution Approach 2:
The patent creates a universal policy loading mechanism that can be applied to multiple micro-service applications. This single mechanism handles authorization for different services with different complexity requirements, allowing comprehensive control without adding functional complexity to individual applications.
4Reliability
If access control policies are managed centrally, then consistent authorization across services is achieved, but the system requires significant changes to existing applications
Solution Approach 1:
The patent implements a universal policy loading interface that works with existing applications without requiring significant changes. The same mechanism can load policies from different sources (files, databases, external services) and apply them to different applications, achieving centralized management with minimal implementation effort.
Solution Approach 2:
The patent introduces an intermediary policy loading layer that sits between the centralized policy management system and existing applications. This intermediary translates centralized policy decisions into application-specific access control enforcement, maintaining consistency while requiring minimal changes to existing applications.
Data Source
AI summary
Some embodiments provide a method for enforcing policies for authorizing API (Application Programming Interface) calls to an application operating on a host machine. The method receives a request to authenticate a client attempting to gain access to the application, and authenticates the client based on a first set of parameters associated with the request. Using a second set of parameters associated with the request, the method evaluates a set of one or more policies associated with a set of one or more API calls to the application. Based on the evaluated policies, the method defines a third set of one or more authentication field parameters that control the API calls that the client is authorized to make to the application. The method sends an authentication reply message with the defined third set of authentication field parameters in order to control the API calls that the client is authorized to make.