Compute-less Authorization via Database Query Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The use of compute services for authorization checks introduces undesirable latency and additional costs when accessing cloud-based resources, as it requires processing data and verifying permissions, which can be inefficient and resource-intensive.
Innovation Solution
Implementing a compute-less authorization method where an endpoint, such as an API gateway, performs authorization checks directly by mapping client requests into database queries and using customized database structures to store permission models, allowing for direct verification of client permissions without relying on separate compute services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a compute service is used to perform authorization checks, then authorization verification can be performed, but latency increases and costs increase
Solution Approach 1:
The patent extracts the authorization check functionality from the compute service and relocates it to the database service. The database now directly stores permission models and client identifiers, and the endpoint queries the database directly for authorization verification, eliminating the need for compute service involvement in authorization checks.
Solution Approach 2:
The database service acts as an intermediary between the endpoint and the permission model. Instead of the endpoint querying the compute service which then queries the database, the endpoint directly queries the database for authorization information, using the database as the mediating component for authorization verification.
2Reliability
If a compute service is used to perform authorization checks, then authorization verification can be performed, but costs increase
Solution Approach 1:
The patent extracts the authorization check functionality from the compute service and relocates it to the database service. The database now directly stores permission models and client identifiers, and the endpoint queries the database directly for authorization verification, eliminating the need for compute service involvement in authorization checks.
Solution Approach 2:
The database service provides self-service authorization verification by storing permission models in a format that can be directly queried by the endpoint. The database structure includes client identifiers and permission data that enable the endpoint to perform authorization checks without external compute service assistance.
3Loss of time
If compute services are eliminated for authorization checks, then latency is reduced and costs are reduced, but the endpoint must directly process authorization queries
Solution Approach 1:
The permission model is pre-structured in the database with client identifiers and permission data organized in a query-ready format. This preliminary organization of data allows the endpoint to perform authorization checks with simple direct queries without requiring complex processing logic at the endpoint.
Data Source
AI summary
An endpoint determines whether a client is authorized to access data. A database stores separate authorizations of a permission model in a data table along with the data. Mapping templates of the endpoint convert a client request for data into a database query for client authorization and the requested data. In response to the query, the database returns to the endpoint the requested data as well as an indication of authorization from the data table. The mapping templates of the endpoint are then used to generate an appropriate response to the client. When the database response indicates the client is authorized, the endpoint can return the requested data to the client. When the database response indicates the client is not authorized, the endpoint can return an error. In some embodiments, the endpoint is an application programming interface (API) gateway that conforms to representational state transfer (REST) software architecture.