HTTP Verb Mapping for Stateless Object Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack flexibility in accessing services implemented by stateless objects, requiring developers to specify accessible services within the object's instructions, leading to inflexible security and potential exposure of sensitive information through commonly used HTTP verbs like GET.
Innovation Solution
The system allows administrators to selectively provide access to services implemented by stateless objects via specific HTTP verbs, enabling secure access by denying access to certain services and overriding default verbs like GET with more secure options such as POST, without redeploying the stateless object.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If developers specify accessible services within the stateless object's instructions, then security is improved, but flexibility and ease of operation deteriorate
Solution Approach 1:
The system segments the control of service access by separating the stateless object code from the HTTP verb mapping configuration. The mapping between HTTP verbs and services is extracted into a separate configurable layer, allowing administrators to control which services are accessible via which HTTP verbs without modifying the stateless object instructions. This resolves the contradiction by enabling flexible security management while maintaining operational flexibility.
Solution Approach 2:
The patent introduces an intermediary mapping layer between HTTP verbs and services implemented by stateless objects. This mapping mechanism acts as a mediator that decouples the HTTP protocol layer from the service implementation layer, allowing administrators to configure access control policies without affecting the underlying stateless object code. This intermediary structure enables both secure access control and operational flexibility.
2Reliability
If developers specify accessible services within the stateless object's instructions, then security is improved, but device complexity and time consumption deteriorate
Solution Approach 1:
The patent extracts the HTTP verb to service mapping configuration from the stateless object instructions and places it in a separate configurable layer. This extraction eliminates the need to embed security logic within the stateless object code, reducing code complexity while maintaining security. Administrators can manage access control through external configuration rather than modifying object instructions, simplifying the overall system structure.
Solution Approach 2:
The system performs preliminary configuration of HTTP verb mappings before runtime execution. By pre-defining which services are accessible via which HTTP verbs in a separate mapping layer, the system avoids the need for complex runtime decision-making logic within the stateless objects themselves. This preliminary action reduces operational complexity while maintaining security requirements.
3Ease of operation
If commonly used HTTP verbs like GET are used for service access, then ease of operation is improved, but security deteriorates due to potential exposure of sensitive information
Solution Approach 1:
The patent applies local quality by allowing different HTTP verbs to be mapped to different services based on their security requirements. Sensitive services can be configured to accept only secure HTTP verbs (POST, PUT, DELETE) while less sensitive services may use GET. This localized approach to verb selection enables easy operation for appropriate services while maintaining security for sensitive ones, resolving the contradiction between ease of operation and security.
Data Source
AI summary
An aspect of the present disclosure provides access via HTTP verbs to services implemented by stateless objects. In one embodiment, the list of services implemented by a stateless object deployed on an application server is displayed to a user/administrator. Upon receiving (from the user/administrator) an input data indicating selection of some of the services (from the displayed list), only the selected service are provided access via a corresponding HTTP verb. In other words, a first service that is included in the selection is provided access via a HTTP verb, while a second service not included in the selection is not made accessible via HTTP verbs. Thus, a user/administrator is facilitated to provide access via HTTP verbs to only services of interest among those implemented by a stateless object at or after the deployment of the stateless object.