API Authorization Policy Server with Local Agents for Microservices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing micro-service applications lack effective mechanisms for implementing complex access controls due to their small, well-defined nature, making it impractical to incorporate and maintain access controls within their code base.
Innovation Solution
A system with a logically centralized server set that defines, stores, and distributes authorization policies for API calls across associated machines, using a hierarchical storage structure and local agents to enforce these policies dynamically and deployment-specifically, decoupling the authorization processing from the application's code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access controls are coded within an application's code base, then access control functionality is implemented, but device complexity and difficulty of maintenance increase
Solution Approach 1:
The patent extracts access control logic from the application code base and places it in a separate, centralized policy server. This allows the application to remain simple while still having robust access control functionality implemented externally through policy evaluation servers that enforce authorization decisions without embedding complexity in the application itself
Solution Approach 2:
The patent introduces a policy server as an intermediary component between the application and the access control mechanism. This mediator receives authorization requests from the application, evaluates them against stored policies, and returns decisions without requiring the application to contain access control logic, thus reducing application complexity while maintaining security
2Reliability
If access controls are coded within an application's code base, then access control functionality is implemented, but ease of modification deteriorates
Solution Approach 1:
The patent implements dynamic access control policies that can be modified at runtime without changing application code. The policy server allows administrators to update access control rules dynamically based on user attributes, resource characteristics, or environmental conditions, enabling the system to adapt to changing requirements without redeploying applications
Solution Approach 2:
By extracting access control logic from the application code base, the patent enables independent modification of access control policies through the policy server. This separation allows access control rules to be updated, added, or removed without affecting or requiring changes to the application code, significantly improving adaptability
3Reliability
If complex access controls are incorporated in micro-service applications, then comprehensive authorization is achieved, but device complexity increases
Solution Approach 1:
The patent extracts complex access control evaluation logic from individual micro-services and consolidates it in a centralized policy server. Each micro-service simply makes authorization requests to the policy server, which evaluates them against comprehensive policies. This maintains thorough authorization coverage while keeping each micro-service lightweight and simple
Solution Approach 2:
The patent creates a universal policy server that serves all micro-services with a common access control framework. This single multi-functional component handles authorization for diverse micro-services using unified policy evaluation, eliminating the need for each micro-service to implement its own complex access control logic while maintaining comprehensive coverage
4Reliability
If access controls are coded within an application's code base, then access control functionality is implemented, but ease of operation deteriorates
Solution Approach 1:
The patent introduces a policy server as an intermediary that centralizes access control policy management. This mediator provides a dedicated interface for policy definition, storage, and modification, separating operational complexity from the applications. Administrators interact with the policy server to manage access controls, simplifying operations by consolidating management tasks in a single location
Data Source
AI summary
Some embodiments of the invention provide a system for defining, distributing and enforcing policies for authorizing API (Application Programming Interface) calls to applications executing on one or more sets of associated machines (e.g., virtual machines, containers, computers, etc.) in one or more datacenters. This system has servers that act as a logically centralized resource for defining and storing policies and parameters for evaluating these policies. The servers enforce these policies and distribute the policies and parameters to policy-enforcing local agents that execute near the applications that process the API calls. From an associated application, a local agent receives API-authorization requests to determine whether API calls received by the application are authorized. In response to such a request, the local agent uses one or more parameters associated with the API call to identify a policy stored in its local policy storage to evaluate whether the API call should be authorized. To evaluate this policy, the agent also retrieves one or more parameters from the local policy storage.