API Security Services Platform for Encryption and Key Management
Solution Overview
Problem
Managing security for sensitive data accessed through open APIs is complex, time-consuming, and expensive, requiring effective encryption, decryption, and key management for service provider companies.
Innovation Solution
A computer-based method and system that receives API service requests, determines the identity of the application, provides encryption and decryption services, manages key material, and transmits encrypted data back to the calling application, simplifying security management through a centralized web services platform.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If service provider companies implement comprehensive security measures (encryption, decryption, key management) for data accessed through open APIs, then data security and confidentiality are improved, but system complexity and operational burden increase
Solution Approach 1:
The patent introduces a security service platform as an intermediary between client applications and the central computer system. This platform handles all security operations (encryption, decryption, key management) centrally, allowing client applications to access data through open APIs without implementing their own security mechanisms. The intermediary absorbs the complexity while maintaining security reliability.
Solution Approach 2:
The security service platform provides universal security services to multiple client applications simultaneously. Instead of each application implementing its own security suite, the single platform serves all applications with encryption, decryption, and key management functions, reducing overall system complexity while maintaining comprehensive security coverage.
2Reliability
If each client application implements its own security mechanisms for data protection, then security control is improved, but development time and cost increase
Solution Approach 1:
The client applications benefit from self-service security where the central security platform automatically handles all security operations without requiring application-level implementation. Applications simply call the security services through standard API interfaces, eliminating the time-consuming task of building and maintaining security infrastructure in each application.
Solution Approach 2:
The security service platform acts as an intermediary that pre-implements all security controls. Applications don't need to build security mechanisms themselves; they simply interact with the platform through open APIs, significantly reducing development time while maintaining robust security control.
3Ease of operation
If service provider companies provide comprehensive security services through centralized platforms, then ease of operation is improved, but service complexity and infrastructure requirements increase
Solution Approach 1:
The centralized security service platform serves as an intermediary that encapsulates all security operations. Client applications interact with the platform through simple, standardized API calls, making security operations easy to implement. The platform's internal complexity is hidden from clients, providing ease of operation without exposing infrastructure requirements.
Solution Approach 2:
The patent extracts all security-related complexity into a separate centralized platform, separating it from the client applications. This extraction allows the platform to manage infrastructure requirements centrally while presenting a simple, easy-to-use interface to clients, improving ease of operation without transferring complexity to individual applications.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and a computer-based method for providing bundled services to a client application in a service call to a service system in a service provider computer system includes receiving a message defining an API service request comprising at least a parameter portion and a payload portion, determining at the gateway system an identity of an application transmitting the received message using identity information that has been established within the service provider computer system, providing, by a services platform, at least one of encryption services and decryption services for data contained in the payload portion using the parameters received in the parameter portion, managing key material for security of the data, and transmitting the encrypted data back to the calling application.