Local API Authorization Controller for Dynamic Policy Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Micro-service applications lack effective access control mechanisms due to the impracticality of incorporating complex access controls, which are difficult to modify statically or dynamically, leading to a lack of robust authorization policies.
Innovation Solution
A local controller system with a logically centralized server set that defines, stores, and distributes authorization policies for API calls across associated machines, using a hierarchical storage structure and local agents to enforce these policies, allowing dynamic updates and deployment-specific configurations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If complex access controls are incorporated into micro-service applications, then authorization capability is improved, but device complexity increases and ease of operation deteriorates
Solution Approach 1:
The patent extracts the complex access control logic from the micro-service application codebase and places it in a separate policy management system. The application only needs to invoke simple API calls to check authorization, while the complex policy evaluation is performed externally by the policy management system, thus improving authorization capability without increasing application complexity.
Solution Approach 2:
The patent introduces a policy management system as an intermediary between the micro-service application and the authorization decision. This intermediary handles the complex policy evaluation, parameter collection, and authorization logic, allowing the application to remain simple while achieving robust authorization through the mediating system.
2Reliability
If access controls are coded within application code base, then authorization is enforced, but ease of repair deteriorates and adaptability decreases
Solution Approach 1:
The patent segments the authorization system into two independent parts: the application code that invokes authorization checks and the separate policy management system that contains the access control rules. This segmentation allows the policy rules to be modified, updated, and repaired without changing the application code, thus improving ease of repair while maintaining enforcement capability.
Solution Approach 2:
The patent implements dynamic policy management where access control rules can be modified, added, or removed at runtime without recompiling or redeploying the application. The policy management system allows dynamic updates to authorization policies, making the system adaptable and easy to repair while maintaining enforcement through API calls.
3Reliability
If access controls are incorporated in micro-service applications, then authorization is provided, but device complexity increases and productivity decreases
Solution Approach 1:
The patent creates a universal policy management system that can serve multiple micro-service applications with a single centralized authorization engine. This multi-functional system handles policy definition, parameter collection, evaluation, and enforcement across different applications, providing authorization provision while improving development efficiency through code reuse and centralized management.
Data Source
AI summary
Some embodiments provide a local controller on a set of host computers that reduce the volume of data that is communicated between the server set and the set of host computers. The local controller executing on a particular host computer, in some embodiments, receives a portion of the namespace including only the policies (e.g., opcode) that are relevant to API-authorization processing for the applications executing on the particular host computer provided by a local agent executing on the computer to authorize the API requests based on policies and parameters. The local controller analyzes the received policies (e.g., policy opcodes) and identifies the parameters (e.g. operands), or parameter types, needed for API-authorization processing (e.g., evaluating the policy opcode upon receiving a particular API request) by the local agent. In some embodiments, the local controller performs this analysis for each updated set of policies (e.g., policy opcodes).