API Authorization Policy Stacks for Consistent Dynamic Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing applications face challenges in dynamically modifying access control rules, as these are typically hardcoded, making it difficult to update them statically or while the application is running, leading to inconsistent and inefficient policy enforcement across different sets of managed resources.
Innovation Solution
An API authorization platform allows for the creation and enforcement of policy stacks that define uniform authorization policies across multiple managed resources, with conflict resolution mechanisms to ensure consistent policy application, using priority levels to resolve conflicts and separate source control for stack and system policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access control rules are coded within an application's code base, then the rules are stable and reliable, but they become difficult to modify statically and impossible to modify dynamically while the application is running
Solution Approach 1:
The patent segments access control into two independent parts: authentication logic (verified by the service provider) and authorization policy (enforced by the service consumer). This allows the policy to be modified independently of the application code base, enabling dynamic updates while maintaining stability of the authentication mechanism.
Solution Approach 2:
The patent introduces an intermediary authorization token that carries policy information from the service provider to the service consumer. This token acts as a mediator that enables dynamic policy enforcement without requiring changes to the application's code base, resolving the contradiction between stability and modifiability.
2Adaptability or versatility
If access control rules are modified dynamically, then the adaptability and flexibility improve, but the consistency and uniformity of policy enforcement across different resource sets deteriorate
Solution Approach 1:
The patent creates a universal authorization token format that can be applied across multiple resource sets and service consumers. This token standardization ensures that dynamic policy modifications maintain consistency and uniformity across the entire system, preventing fragmentation of policy enforcement.
Solution Approach 2:
The patent implements a feedback mechanism where the service consumer verifies the authorization token and enforces policies based on verified claims. This closed-loop verification process ensures that dynamic policy changes are consistently applied and maintained across different resource sets.
3Reliability
If separate authentication and authorization mechanisms are implemented, then the security and reliability improve, but the system complexity and number of components increase
Solution Approach 1:
The patent merges authentication and authorization into a unified OAuth 2.0 flow where the authorization token encapsulates both identity verification and policy enforcement. This consolidation maintains security while reducing system complexity by eliminating separate authentication and authorization components.
Data Source
AI summary
Some embodiments provide API (Application Programming Interface) authorization platform that allows API-authorization policy stacks to be created and enforced. Policy stacks (called “stacks”) define API-authorization policies across different sets of managed resources in a workspace. A stack in some embodiments defines a uniform set of one or more API-authorization policies for multiple different sets of resources. By instituting common policies across multiple managed resource sets (also called managed systems), stacks can be used to guarantee uniform baseline policies for the workspace. A stack is typically applied to several managed resources that share a common trait. The API-authorization platform of some embodiments allows an administrator to define the traits of the managed resources through labels that are associated with the stacks and the managed systems. This platform in some embodiments also allows a stack to specify an exception for a managed system based on one or more features of the system.