Distributed Service Access Control via Combined Permissions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing methods for managing service access across multiple services are inefficient and costly, as they require exponential verification processes through a central authorization service, leading to reduced safety verification efficiency and increased processing capabilities.
Innovation Solution
A method that determines combined permissions for a requester and each service, allowing access to multiple functional interfaces by calculating and distributing verification tasks among services, thereby reducing the number of service verifications and improving efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a central authorization service verifies user permissions for each service access request, then service safety is ensured, but verification processing time and computational cost increase exponentially
Solution Approach 1:
The patent segments the centralized authorization service into distributed service nodes, where each service maintains its own permission verification capability. Instead of one central service handling all verifications, the system divides verification tasks across multiple services, reducing the processing burden on any single node and eliminating exponential time complexity.
Solution Approach 2:
The patent introduces a permission description file as an intermediary mechanism that pre-defines service access relationships. This file acts as a mediator between the service provider and authorization system, allowing services to verify permissions locally without direct real-time communication with a central authorization service, thus reducing verification time.
2Reliability
If a central authorization service handles all permission verifications, then comprehensive security control is achieved, but processing capability requirements and system cost increase
Solution Approach 1:
The patent divides the centralized authorization processing power into distributed units across multiple services. Each service node handles its own permission verifications independently using locally stored permission information, eliminating the need for a single high-power central authorization service and reducing overall processing capability requirements.
Solution Approach 2:
Services perform self-verification of permissions using locally cached permission description files, eliminating the need for continuous external authorization requests. This self-service approach reduces the processing burden on central systems and distributes computational work across the service ecosystem.
3Adaptability or versatility
If multiple services are accessed by a user, then functional versatility is improved, but the number of verification processes increases exponentially
Solution Approach 1:
The patent merges permission verification logic into a standardized format using permission description files that can be reused across multiple services. Instead of implementing separate verification processes for each service, the system combines verification logic into a unified framework that handles multiple service accesses through a common permission checking mechanism.
Solution Approach 2:
The patent performs preliminary action by pre-generating and caching permission description files that contain all necessary authorization information before services are accessed. This advance preparation eliminates the need for complex real-time verification logic during service execution, reducing verification process complexity while supporting versatile multi-service access.
Data Source
AI summary
Embodiments of the present disclosure relate to a method, a device and a computer program product for service access. The method comprises receiving, from a requester, a request for accessing a first functional interface of a first service of a plurality of services. The method also comprises, in response to the request, determining a first combined permission of the requester to access a plurality of functional interfaces of the plurality of services. The method further comprises determining a second combined permission of the first service to access the plurality of functional interfaces of the plurality of services. In addition, the method comprises controlling, based on the first and the second combined permissions, access of the requester to the first functional interface. The method can accomplish rapid, safe service calling and improve service accessing efficiency.