API Wall Filtering System for Unauthorized Access Control

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Enterprises face challenges in controlling and monitoring API access within their networks due to limited visibility and control over API exposure, leading to potential undesirable uses of corporate resources, especially when APIs are unintentionally exposed to the internet.

Innovation Solution

An API call filtering system, referred to as an 'API wall,' is deployed at the network perimeter to monitor, analyze, and filter API calls, providing reports and enabling security teams to modify access permissions, thereby enhancing control and security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If enterprises expose APIs to the Internet for public access, then data management and web services expansion are enabled, but security control and monitoring capability deteriorate

Engineering Contradiction:

ImproveAPI accessibilityVSAvoidsecurity control

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent introduces an API gateway as an intermediary component between external users and internal APIs. This gateway provides centralized authentication, authorization, and monitoring capabilities, enabling secure public access while maintaining enterprise control. The gateway acts as a mediator that filters and manages API requests, resolving the contradiction between accessibility and security control.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent segments API access control into multiple layers: public access layer, authentication layer, authorization layer, and monitoring layer. This segmentation allows different security policies to be applied to different API endpoints and user types, enabling granular control while maintaining overall system accessibility.

Inventive Principle:

Principle #1Segmentation

2Reliability

If enterprises implement strict security policies for API access, then unauthorized access is reduced, but legitimate business operations may be hindered

Engineering Contradiction:

Improvesecurity controlVSAvoidbusiness operation flow

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent implements dynamic access control policies that adapt based on user identity, device type, location, and request patterns. Authentication mechanisms adjust their strictness dynamically - for example, recognizing registered devices with trusted certificates versus anonymous requests. This dynamic approach maintains security while reducing friction for legitimate operations.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent changes security parameters based on context - authentication requirements, rate limiting thresholds, and monitoring intensity are adjusted according to the specific API endpoint, user credentials, and request characteristics. This parameter-based flexibility allows strict security where needed and streamlined access where appropriate.

Inventive Principle:

Principle #35Parameter changes

3Reliability

If enterprises monitor all API calls for security analysis, then unauthorized usage is detected, but system complexity and processing overhead increase

Engineering Contradiction:

Improvesecurity monitoringVSAvoidmonitoring system complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent implements partial monitoring where not all API calls are analyzed with the same depth. High-risk requests (from unauthenticated users, to sensitive endpoints, with unusual patterns) receive intensive monitoring, while routine authenticated requests receive lighter monitoring. This selective approach maintains security effectiveness while reducing system complexity and processing overhead.

Inventive Principle:

Principle #16Partial or excessive action

4Ease of operation

If enterprises allow unauthenticated API access for public services, then service accessibility is improved, but resource abuse and unauthorized operations increase

Engineering Contradiction:

Improveservice accessibilityVSAvoidresource abuse

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent implements preliminary rate limiting and quota allocation for unauthenticated users before they can abuse resources. API gateways pre-configure throttling rules that limit the volume and frequency of requests from anonymous sources. This preliminary action prevents resource abuse while maintaining accessible public services.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements feedback mechanisms where the API gateway monitors unauthenticated user behavior in real-time and dynamically adjusts access permissions. When abnormal patterns are detected (such as rapid sequential requests or attempts to access restricted endpoints), the system automatically responds by blocking or throttling those specific requests, providing continuous protection against resource abuse.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS10834050B2Modifying authentication for an application programming interface

Publication Date: 2020.11.10 SHAPE SECURITY INC

AI summary

Application programming interfaces (APIs) can be unintentionally exposed and allow for potentially undesirable use of corporate resources. An API call filtering system configured to monitor API call requests received via an endpoint and API call responses received via a supporting service of an API or web service. The API call filtering system enables enterprises to improve their security posture by identifying, studying, reporting, and securing their APIs within their enterprise network.