Federated Graph Third-Party Decorator Integration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems utilizing the 'owner + decorator' model for providing access to a property graph break down when a large number of third-party 'decorator' network services are integrated, due to security concerns and data sovereignty issues, limiting the integration of third-party services as decorators in the graph.
Innovation Solution
A federated graph provider service integrates with third-party 'decorator' network services, allowing an arbitrarily large number of third-party-provided services to decorate data in a property graph through a unified network service API, while maintaining security and sovereignty by registering these services and issuing authentication tokens, enabling secure data access and combination.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the 'owner + decorator' model is used to integrate third-party network services as decorators in a property graph, then data decoration capability is improved, but system security and data sovereignty are compromised
Solution Approach 1:
The patent introduces an authentication service as an intermediary between the graph service and third-party decorator services. This mediator issues and validates authentication tokens, enabling secure communication without requiring direct trust relationships. The authentication service acts as a trusted third party that mediates access control, allowing decorator services to integrate with the property graph while maintaining security boundaries and data sovereignty.
2Adaptability or versatility
If the 'owner + decorator' model is used to integrate third-party network services as decorators in a property graph, then data decoration capability is improved, but data sovereignty is compromised
Solution Approach 1:
The patent segments the system into distinct components with clear boundaries: the graph service that owns the property graph, decorator services that provide additional data, and an authentication service that manages access. Each component maintains sovereignty over its own data and operations. The authentication tokens enforce these boundaries, ensuring that decorator services can access only the specific data they are authorized to decorate, thereby preserving data sovereignty while enabling integration.
3Reliability
If authentication tokens are issued by the graph service to access decorator services, then secure access control is improved, but system complexity increases
Solution Approach 1:
The authentication service provides universal authentication functionality that can be used across multiple decorator services and graph service interactions. Rather than implementing separate authentication mechanisms for each decorator service, the system uses a single universal token-based authentication approach. This multi-functional authentication mechanism handles access control for all decorator services uniformly, reducing overall system complexity despite the added security layer.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
Technologies are described herein for extending a federated graph with third-party data or metadata. A federated facet provider service registers with a federated graph provider service as a provider of a facet for a resource in a graph. For example, the federated facet provider service can provide a callback URL or a URI template for resolving the callback URL. When the federated graph provider service receives a request for a facet from a service client, the federated graph provider service determines a callback network address for the federated facet provider service and obtains an authentication token for the federated facet provider service. A response is provided to the service client that causes the service client to redirect to the federated facet provider service to obtain the requested facet utilizing the authentication token. The federated facet provider service provides the requested facet directly to the service client.