Consolidated Workflow Policy for Composite Application Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In service-oriented architecture, autonomously performed security checks in composite applications lead to performance drawbacks due to redundant authorization evaluations, especially for static services and applications.
Innovation Solution
A computer-implemented method for a secure policy enforcement strategy that generates a consolidated workflow policy by combining sub-application policies and using a security index structure for efficient authorization checks, reducing redundant evaluations and improving performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If autonomously performed security checks are implemented in each sub-application, then security reliability is improved, but system performance deteriorates due to redundant authorization evaluations
Solution Approach 1:
The patent merges individual authorization policies from multiple sub-applications into a single consolidated workflow policy. Instead of each sub-application independently evaluating authorization requests, the system consolidates all authorization rules into one centralized policy that is evaluated once at the workflow level, eliminating redundant security checks while maintaining comprehensive security coverage across all sub-applications.
Solution Approach 2:
The patent performs preliminary consolidation of authorization policies during workflow design or deployment phase. The consolidated workflow policy is pre-computed and stored, so that during runtime, authorization decisions can be made quickly without re-evaluating individual sub-application policies. This preliminary action transforms complex multi-layered authorization into a single ready-to-use policy structure.
2Measurement precision
If individual policies are enforced in each sub-application, then authorization accuracy is improved, but execution time increases due to repeated evaluations
Solution Approach 1:
The patent combines multiple individual authorization policies into a single consolidated workflow policy that preserves the precise authorization logic of all sub-applications. The consolidation process maintains the semantic meaning and strictness of individual policies while eliminating redundant evaluation steps, achieving both high authorization accuracy and fast execution.
Solution Approach 2:
The patent creates a consolidated copy of the authorization policy structure that represents all sub-application policies in a unified format. This consolidated policy copy contains all necessary authorization rules and can be evaluated once to determine access decisions for multiple sub-applications, avoiding the need to repeatedly evaluate the same authorization logic across different components.
3Adaptability or versatility
If access control is separated from composite application, then modularity is improved, but performance deteriorates due to redundant security evaluations
Solution Approach 1:
The patent introduces a workflow-level intermediary that mediates between the composite application and individual sub-applications. The consolidated workflow policy acts as an intermediary authorization layer that makes centralized decisions, preventing redundant security evaluations in sub-applications while maintaining the modular architecture. This intermediary approach preserves modularity benefits while eliminating performance penalties.
Solution Approach 2:
The patent merges the authorization control function from multiple distributed sub-applications into a single consolidated workflow-level control mechanism. This merging maintains the modular structure of sub-applications while consolidating the authorization evaluation logic, achieving both modularity and performance efficiency.
Data Source
AI summary
There is provided a computer-implemented method, computer-program product, system and security index structure for a security enforcement strategy for a composite application. The method comprises providing a workflow for the composite application, wherein the composite application is constructed from a set of sub-applications and wherein at least a plurality of the sub-applications has a policy. A consolidated workflow policy is generated for the workflow by combining the policies of the sub-applications and by taking into account a control flow of the workflow, wherein the control flow provides an order in which the set of sub-applications are performed. The consolidated workflow policy is enforced by providing a security index structure for the consolidated workflow policy adapted for checking authorization in the workflow.