API Authorization Policy Validation via Hierarchical Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing micro-service applications lack effective access control mechanisms, making it difficult to modify access controls statically or dynamically, and they often employ rudimentary or no access controls due to the complexity and maintenance challenges.
Innovation Solution
A system for defining, distributing, and enforcing policies for authorizing API calls across multiple machines in datacenters, using policy enforcing agents co-located with entity machines, along with policy and contextual data storages, and employing cryptographic signatures to ensure data integrity and authenticity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If access controls are coded within an application's code base, then access control functionality is implemented, but it becomes very difficult to modify these controls statically and impossible to modify them dynamically while the application is running
Solution Approach 1:
The access control functionality is segmented from the application code base and placed in a separate, dedicated access control system. This allows the access control mechanisms to be modified independently of the application code, enabling dynamic changes without affecting the application's core functionality. The segmentation resolves the contradiction by decoupling access control from application logic, making the system more adaptable while maintaining manageable complexity through specialization.
Solution Approach 2:
An intermediary access control system is introduced between the application and the user/request. This intermediary layer handles all access control decisions centrally, allowing dynamic modification of controls without requiring changes to the application code itself. The intermediary acts as a mediator that enforces access policies dynamically, resolving the contradiction by providing a separate plane for access control management that can be adjusted independently.
2Reliability
If complex access controls are incorporated in micro-service applications, then access control functionality is provided, but it burdens these applications with unnecessary functional complexity that is difficult to maintain and update
Solution Approach 1:
The complex access control functionality is extracted from the micro-service applications and consolidated into a separate, centralized access control system. This extraction removes the maintenance burden from individual applications while preserving the reliability of access control functionality. The centralized system can be maintained and updated as a single unit, resolving the contradiction by separating the complexity from the applications that need to use the functionality.
Solution Approach 2:
A universal access control system is implemented that serves multiple micro-service applications through a common framework. This multi-functional system handles access control for various applications using unified mechanisms, reducing the overall maintenance effort compared to implementing separate access controls in each application. The universality resolves the contradiction by providing reliable access control functionality through a single maintainable system that can be updated across all applications.
3Device complexity
If most micro-service applications employ no access controls or the most rudimentary access controls, then functional complexity is minimized, but security and authorization capabilities are insufficient
Solution Approach 1:
A centralized intermediary access control system is introduced that provides robust access control capabilities without adding complexity to individual micro-service applications. The intermediary handles authentication, authorization, and policy enforcement centrally, allowing applications to maintain simplicity while gaining strong security capabilities. This resolves the contradiction by providing reliable access control through a separate system rather than embedding complexity within applications.
Solution Approach 2:
The access control system operates as a self-service framework where policies are defined once and automatically enforced across all applications. The system provides its own mechanisms for policy evaluation, decision-making, and enforcement without requiring each application to implement its own access control logic. This self-service approach resolves the contradiction by delivering reliable access control capability while maintaining application simplicity, as the complexity is encapsulated within the self-managing access control framework.
Data Source
AI summary
Some embodiments provide a method for distributing a set of parameters associated with policies for authorizing Application Programming Interface (API) calls to an application. For a previously stored hierarchical first document that comprises a first set of elements in a first hierarchical structure, the method receives a hierarchical update second document that comprises a second set of elements in a second hierarchical structure corresponding to the first hierarchical structure, wherein at least a subset of elements in the first and the second documents correspond to the set of parameters for evaluating API calls. The method receives a first set of hash values for elements of the first document that are not specified in the second document, and generates a second set of hash values for a set of elements specified in the second document. The method generates an overall hash for the second document by using the received first set of hash values and the generated second set of hash values. The method uses the overall hash to validate a signature from an entity that is authorized to specify the set of parameters.