Local Authorization Rule Evaluation in Microservices

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing authorization models for microservices architectures face scalability and performance issues due to overhead from repeated calls to external authorization services, and caching solutions are less effective for non-repetitive authorization behaviors, leading to management and distribution challenges with policy data stores.

Innovation Solution

A hybrid approach that pre-computes authorization rules (azRules) against external services and communicates them within the user's session object, allowing local evaluation without direct connectivity to the authorization service, driven by externally managed policies for efficient authorization decision-making.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If authorization decisions are made by repeatedly calling external authorization services, then centralized policy management is achieved, but performance overhead and scalability issues occur

Engineering Contradiction:

Improvecentralized policy managementVSAvoidauthorization decision performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent pre-computes authorization rules from external policies before runtime authorization decisions are needed. These pre-computed rules are then cached and used for rapid local evaluation, eliminating the need for repeated external service calls while maintaining policy centrality.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent separates authorization logic into two parts: policy management (external, centralized) and rule evaluation (local, distributed). This segmentation allows centralized policy updates without requiring the application to continuously connect to external services, improving both performance and scalability.

Inventive Principle:

Principle #1Segmentation

2Productivity

If authorization decisions are cached locally within applications, then performance is improved for repetitive authorization behaviors, but effectiveness decreases for non-repetitive authorization behaviors

Engineering Contradiction:

Improveauthorization decision speedVSAvoidauthorization accuracy for non-repetitive cases

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent transforms authorization policies into a different format (pre-computed rules with normalized conditions and actions) that can be efficiently evaluated locally. This parameter transformation enables fast local evaluation while maintaining the ability to handle diverse authorization scenarios accurately.

Inventive Principle:

Principle #35Parameter changes

3Productivity

If authorization engine is embedded within application context with external policy management, then local evaluation efficiency is achieved, but policy data store management and distribution issues arise

Engineering Contradiction:

Improvelocal authorization evaluation efficiencyVSAvoidpolicy data store management complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent extracts the policy data store management complexity from the application context and places it in an external policy management system. The application only receives pre-computed authorization rules, simplifying its role while maintaining local evaluation efficiency.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS11722527B2Local evaluation of runtime authorization rules derived from externally-derived policy

Publication Date: 2023.08.08 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

An application-centric authorization model utilizes locally-evaluated rules derived from non-local policies and provided to the application via an authorization object, preferably in the subject's session context. Preferably, the approach does not involve a runtime determination regarding the policy or policies; rather, one or more existing policies are merely used to derive authorization rules associated with a subject, and which are then evaluated and enforced at runtime in a computationally-efficient manner within the local runtime context of the application or service.