API Request Admission Control with External Policy Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Micro-service applications lack effective access control mechanisms due to their small, well-defined nature, making it difficult to implement and maintain complex access controls, which are often absent or rudimentary.
Innovation Solution
A system with a mutating and validating admission controller that invokes webhooks to determine and enforce API request modifications and validity using an API authorizing policy agent, decoupling policy decision-making from enforcement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If complex access controls are incorporated into micro-service applications, then security and access control capability are improved, but device complexity and ease of operation deteriorate
Solution Approach 1:
The patent extracts access control logic from the micro-service application codebase and places it in external admission controllers. The mutating admission controller modifies API requests before they reach the application, while the validating admission controller checks requests separately. This extraction removes the burden of complex access control implementation from the micro-service applications themselves, maintaining their simplicity while providing robust access control through external components that intercept and process requests independently.
Solution Approach 2:
The patent introduces admission controllers as intermediary components between the API server and the micro-service applications. These controllers act as mediators that handle the complex access control logic, request modification, and validation tasks. The API server communicates with the admission controllers, which in turn interact with the applications, thereby isolating the applications from the complexity of access control mechanisms while ensuring that all requests undergo proper validation and modification before reaching the application layer.
2Reliability
If access controls are coded within application code base, then access control enforcement is improved, but ease of repair and adaptability worsen
Solution Approach 1:
The patent segments the access control system into distinct, independent components: the API server, mutating admission controllers, validating admission controllers, and the micro-service applications. Each component has a specific responsibility - the admission controllers handle access control logic and request modification, while the applications focus on their core functionality. This segmentation allows access control policies to be modified, updated, or repaired in the admission controllers without requiring changes to the application codebase, thereby improving ease of repair and adaptability while maintaining effective access control enforcement.
Solution Approach 2:
The patent implements dynamic access control through admission controllers that can modify and validate requests in real-time based on configurable policies. The access control logic is not static and hard-coded but is instead dynamically applied through the admission controllers, which can be configured and updated independently. This dynamic approach allows for flexible modification of access control rules without recompiling or redeploying the entire application, making the system easier to repair and adapt to changing requirements while maintaining strong enforcement capabilities.
Data Source
AI summary
Some embodiments of the invention provide a method of modifying and validating API requests received at an API server. At a mutating admission controller of the API server, the method intercepts an API request received at the API server. The method invokes a mutating webhook to query a policy agent that includes a set of policies for modifying API requests. When the policy agent determines that the API request requires modifications based on an identified policy, the method performs the modifications and forwards the modified API request for validation by the API server. After validating the API request, the method intercepts the API request at a validating admission controller and invokes a validating webhook to query the policy agent to determine whether the API request is valid. When the policy agent determines that the API request is valid, the method forwards the API request to be admitted to a database.