Cloud Microservice API Gateway with Proxy Token Authorization

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing API gateways face security lapses and resource inefficiencies due to inconsistent user experiences and redundant credential requests when permissions change, leading to potential security breaches and resource duplication across varying authentication criteria.

Innovation Solution

Implementing an API gateway that generates short-lived authentication tokens, hybrid tokens indicating user attributes and roles, and proxy tokens for service access, while dynamically selecting authentication modes based on ingress methods, thereby ensuring continuous authorization without repeated credential entry.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the API gateway requests credentials for each service access, then authentication security is improved, but user experience and system efficiency deteriorate due to repeated credential entry

Engineering Contradiction:

Improveauthentication securityVSAvoiduser experience

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The API gateway performs preliminary authentication by verifying credentials once at the gateway level before the user accesses any services. The gateway stores the authentication result and uses it for subsequent service access decisions, eliminating the need for repeated credential entry while maintaining security.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The API gateway acts as an intermediary between the user and multiple services. It centralizes authentication functionality, verifying credentials once and mediating all subsequent access requests to different services based on the initial authentication result, thereby improving both security and user experience.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If the API gateway stores authentication results, then access efficiency is improved, but security deteriorates if permissions change after authentication

Engineering Contradiction:

Improveaccess efficiencyVSAvoidsecurity

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The system implements feedback mechanisms where the API gateway continuously monitors permission changes from identity systems. When permission changes are detected, the gateway receives feedback and updates its authentication state accordingly, ensuring that stored authentication results remain valid only while permissions remain unchanged.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The authentication token system uses dynamic expiration times and refresh mechanisms. Tokens are granted for limited durations and can be refreshed or revoked based on real-time permission status, making the authentication system adaptive to changing permissions while maintaining efficient access for authorized users.

Inventive Principle:

Principle #15Dynamics

3Adaptability or versatility

If separate gateways are used for each ingress mode, then authentication specificity is improved, but resource efficiency and user experience consistency deteriorate due to resource duplication

Engineering Contradiction:

Improveauthentication specificityVSAvoidresource duplication

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The API gateway is designed as a universal, multi-functional system that can handle multiple ingress modes (REST, WebSocket, gRPC, etc.) through a single unified architecture. It provides consistent authentication and authorization functionality across all service access methods, eliminating the need for separate gateways while maintaining adaptability to different protocols.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The gateway architecture segments authentication functionality from ingress mode handling. Different ingress modes are processed by separate protocol handlers within the same gateway instance, allowing the authentication core to remain unified while accommodating diverse access methods through modular, segmented processing components.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS12463811B2System architecture for secure highly available microservice applications with decentralized authorization and delegated authorization controls in cloud platforms

Publication Date: 2025.11.04 THE BOEING CO

AI summary

A device includes one or more processors configured to receive, from a first service, a first access request to request access to a second service on behalf of a user, wherein the first access request includes a user identifier of the user and a first service identifier of the first service. The one or more processors are also configured to, based on determining that the user has granted authorization to the first service to access the second service on behalf of the user, generate a proxy authentication token based on the first access request. The one or more processors are configured to send a second access request to the second service, wherein the second access request includes the first service identifier and the proxy authentication token.