Dynamic Authorization via Enriched Tokens and Microservices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authorization and access management systems are inflexible, struggle to adapt to changing environments, and lack scalability, making them inadequate for managing security in complex, microservices-based architectures.
Innovation Solution
A dynamic authorization system utilizing microservices architecture, which includes an identity-as-a-service server, a security plane, an API gateway, and service pods with proxies and security sidecars, to manage rich policies and ensure secure access to APIs and microservices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If monolithic authorization and access management systems are used, then system simplicity is maintained, but flexibility and adaptability to changing environments deteriorate
Solution Approach 1:
The patent divides the monolithic authorization system into multiple independent microservices including identity service, authorization service, policy service, and token service. Each microservice handles specific authorization functions independently, enabling the system to adapt to changing requirements by modifying individual services without affecting the entire system.
Solution Approach 2:
The system implements dynamic policy enforcement where authorization policies can be updated and modified in real-time without system downtime. The policy service allows administrators to dynamically adjust access control rules, and these changes are immediately propagated to relevant microservices, enabling the system to adapt to evolving security requirements.
2Ease of manufacture
If monolithic authorization systems are used, then initial deployment is straightforward, but scalability and response time to changes deteriorate
Solution Approach 1:
By segmenting the authorization system into independent microservices, each service can be deployed, scaled, and updated independently. This allows the organization to deploy new authorization features or update security policies in specific services without impacting the entire system, thereby improving scalability and response time.
Solution Approach 2:
The microservice architecture creates universal building blocks that can serve multiple functions across different applications and services. The identity service, for example, can authenticate users for multiple applications, while the policy service can enforce rules across various resources, improving overall system efficiency and responsiveness.
3Ease of operation
If access tokens are granted at API gateway level, then initial access control is established, but security vulnerability increases if tokens are leaked
Solution Approach 1:
The system implements dynamic token validation where each microservice independently verifies access tokens against current authorization policies. Even if a token is leaked, the authorization service can dynamically revoke or modify the token's permissions, preventing unauthorized access to protected resources.
Solution Approach 2:
The authorization service continuously monitors token usage and validates requests against updated policies. When security conditions change or suspicious activity is detected, the system provides feedback by revoking tokens or modifying authorization rules, thereby mitigating security vulnerabilities even after tokens have been distributed.
Data Source
AI summary
A system that uses an enriched token to dynamically authorize and/or manage access to endpoint(s). The enriched token defines a scope of access with respect to the endpoint(s) and may be generated based at least in part on user context information obtained from an identity provider.