Modular Authorization Framework Externalizing Logic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing enterprise security systems face performance issues due to large, hard-coded authorization code requirements, which consume valuable memory and processing resources, affecting application performance as they become more sophisticated and handle increasing amounts of sensitive data.
Innovation Solution
A modular authorization framework that performs user authorization externally to the application, using supplemental authentication code to invoke provider modules outside the application, thereby reducing the need for extensive hard-coded authorization logic within the application itself.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authorization code is hard-coded into the application to provide security, then security functionality is achieved, but memory and processing resources are consumed and application performance is affected
Solution Approach 1:
The authorization code is extracted from the application and placed in an external assembly. The application contains only supplemental authorization code that invokes the external authorization provider, thereby removing the bulk of authorization logic from the application to reduce memory and processing resource consumption while maintaining security functionality.
Solution Approach 2:
An external authorization provider assembly acts as an intermediary between the application and the authorization logic. The supplemental authorization code in the application invokes this external provider, which contains the comprehensive authorization rules and logic, allowing the application to benefit from full security functionality without embedding the heavy code locally.
2Reliability
If comprehensive authorization code is included in the application to handle sophisticated security requirements, then security coverage is improved, but code size and resource usage increase
Solution Approach 1:
The comprehensive authorization code is extracted from the application and relocated to an external assembly. This allows the application to reference and use the full authorization functionality without containing the actual code, thereby maintaining complete security coverage while minimizing the application's code size.
Solution Approach 2:
The external authorization provider is designed as a universal component that can serve multiple applications. By placing comprehensive authorization logic in a shared external assembly, the same security coverage is made available to multiple applications without each application needing to contain duplicate code.
Data Source
AI summary
An authorization framework located external to an application may be invoked to determine user authorization for a requested application component. Small amounts of supplemental authentication code are added to application code to invoke provider modules within the authentication framework. The provider modules perform authorization functions outside of the application and return authorization results to the application. The functions include determining a user role, determining the permissions associated with the user role, comparing the role permissions to the security defined on the requested application component by a rule, and returning an authorization state to the authentication framework. The supplemental authentication code may invoke one or more providers through provider interfaces that translate requests to a particular provider. Using the provider based authorization framework, authorization for an application component is achieved externally without hard-coding authorization code within the application itself.