Network Path Authorization for Virtualized Application Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtual environments such as containers or virtual machines, managing software access permissions is challenging because authorization identifiers generated based on physical apparatus machine codes become ineffective due to the application's ability to drift among different physical apparatuses.
Innovation Solution
A data processing method and device that utilize network path information to generate authorization identifiers, allowing secure application authorization by matching target path information with authorization identifiers stored in an authorization list, ensuring only authorized client terminals can run applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If authorization identifier is generated based on machine code of physical apparatus, then software access permission can be limited for physical devices, but authorization cannot be effectively managed in virtual environments where applications drift among different physical apparatuses
Solution Approach 1:
The patent changes the basis of authorization from physical machine code to network path information. By using network path parameters (IP addresses, port numbers, protocol types) instead of fixed physical identifiers, the system adapts to virtual environments where applications may migrate between physical hosts while maintaining consistent network paths.
Solution Approach 2:
The patent introduces network path information as an intermediary between the application and the physical apparatus. This intermediary layer allows authorization to be based on the application's network position rather than its physical location, enabling effective permission management in virtualized environments.
2Reliability
If authorization identifier is generated based on network path information, then security of application authorization in virtual environments is ensured, but the system complexity increases due to need to track and verify network paths
Solution Approach 1:
The client terminal automatically obtains and includes its own network path information in the authorization request without requiring external intervention. The service terminal extracts authorization information directly from the request, eliminating the need for complex manual configuration or verification systems.
Solution Approach 2:
The network path information serves multiple functions simultaneously: it acts as an identifier for the client terminal, defines the authorization scope, and provides verification data. This multi-functionality reduces system complexity by eliminating the need for separate mechanisms for each function.
3Ease of manufacture
If traditional machine code-based authorization is used, then implementation is simple and straightforward, but applications running in containers or virtual machines cannot maintain consistent authorization across different physical hosts
Solution Approach 1:
The patent transitions from static machine code-based authorization to dynamic network path-based authorization. The network path information automatically updates when the application's network position changes, maintaining authorization consistency without requiring manual reconfiguration or complex virtualization-aware mechanisms.
Data Source
AI summary
A data processing method applied to a service terminal includes receiving an authorization request sent by a target client terminal. The authorization request includes target path information of the target client terminal. The method further includes searching for a target identifier matching the target path information in an authorization list including at least one authorization identifier. The authorization identifier is generated at least based on network path information of an authorized client terminal. The method further includes sending the target identifier to the target client terminal to cause the target client terminal to control a target application to run according to the target identifier.