API Gateway Authorization Across Multiple Authentication Ingress Modes

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing API gateways in cloud platforms face security lapses and resource inefficiencies due to inconsistent user experiences and redundant authentication processes when handling multiple authentication ingress modes and varying service credentials.

Innovation Solution

Implementing an API gateway that generates short-lived authentication tokens and hybrid tokens based on user attributes and roles, and uses proxy authentication to manage access across services, while adapting to different ingress modes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If the API gateway uses traditional authentication methods with long-lived tokens, then user convenience is improved, but security is worsened because permissions changes cannot be enforced

Engineering Contradiction:

Improveuser convenienceVSAvoidsecurity

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent implements dynamic authentication tokens with short lifetimes that are automatically regenerated. The system transitions from static, long-lived tokens to dynamic, short-lived tokens that can be refreshed multiple times. This allows the authentication state to change dynamically in response to permission changes, resolving the contradiction between user convenience and security by making tokens both short-lived (secure) and automatically renewed (convenient).

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system employs periodic authentication token generation with predetermined expiration times. Tokens are issued for short durations and automatically renewed through periodic authentication cycles. This periodic action ensures that permissions are re-evaluated regularly, maintaining security while providing continuous access to authorized users without manual re-authentication.

Inventive Principle:

Principle #19Periodic action

2Adaptability or versatility

If different gateways are used for each ingress mode, then authentication specificity is improved, but resource duplication and inconsistent user experience occur

Engineering Contradiction:

Improveauthentication specificityVSAvoidresource duplication

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent implements a universal authentication gateway that handles multiple ingress modes (north-south, east-west, service-to-service) through a single unified system. The gateway uses a common authentication service that can issue different types of tokens (authentication tokens, proxy tokens, service tokens) based on the ingress mode, eliminating the need for separate gateways for each mode while maintaining authentication specificity.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The system introduces an authentication service as an intermediary component that mediates between different ingress modes and the microservices. This intermediary handles authentication requests from various sources, translates them into appropriate token types, and manages the authentication state centrally, thereby reducing resource duplication while preserving mode-specific authentication requirements.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Loss of time

If authentication tokens have long expiration times, then user convenience is improved, but security control is worsened because permission changes cannot be enforced

Engineering Contradiction:

Improveauthentication frequencyVSAvoidpermission enforcement

Core Design Contradiction:

Loss of timeVSReliability

Solution Approach 1:

The system implements dynamic token lifetime management where tokens are issued with short expiration times that enable frequent re-evaluation of permissions. The authentication service can adjust token parameters dynamically based on user roles and service requirements, balancing the need for frequent permission checks with user convenience through automated renewal processes.

Inventive Principle:

Principle #15Dynamics

4Reliability

If multiple separate authentication systems are implemented for different services, then service-specific security is improved, but system complexity and maintenance burden increase

Engineering Contradiction:

Improveservice-specific securityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent merges multiple separate authentication systems into a single unified authentication service that handles authentication for all microservices. The service can issue different token types (authentication tokens for users, proxy tokens for services, service tokens for service-to-service communication) while maintaining a common authorization database and permission management system, thereby reducing complexity while preserving service-specific security requirements.

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentUS12621286B2Microservice applications with decentralized authorization enforcement in cloud platforms with multiple authentication ingress modes

Publication Date: 2026.05.05 THE BOEING CO

AI summary

A device includes one or more processors configured to receive an authentication request from a requestor. The one or more processors are also configured to determine, based on content of the authentication request, an ingress mode of the authentication request. The one or more processors are further configured to select, based on the ingress mode, a particular authentication mode from a plurality of authentication modes. The one or more processors are also configured to generate an authentication token based on the particular authentication mode.