OpenAPI Connector Rules for SASE Policy Enforcement Visibility
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security architectures struggle to efficiently enforce security policies and provide visibility for the vast number of cloud-based services accessed via APIs, due to the proliferation of cloud services and the need for customized parsers, which is time-consuming and challenging, especially with legacy application overhauls.
Innovation Solution
The technology automates the process of opening API specifications, extracting attributes, and merging them with templates to build API-specific connectors that provide Secure Access Service Edge (SASE) protection by deploying deep packet inspection proxies, enabling automatic policy enforcement for new API traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If customized parsers are developed for each cloud-based service to enforce security policies, then policy enforcement capability is improved, but the time and resources required increase significantly
Solution Approach 1:
The patent uses OpenAPI specifications as templates to automatically generate parsers for cloud services. Instead of manually creating customized parsers for each service, the system copies and adapts parser patterns from standardized OpenAPI definitions, dramatically reducing development time while maintaining enforcement capability
Solution Approach 2:
The patent creates a universal parser generation framework that works across multiple cloud services by leveraging common OpenAPI specification structures. A single template system can generate parsers for diverse services (AWS, Azure, GCP, etc.), eliminating the need for service-specific custom development
2Measurement precision
If service-specific parsers are customized to monitor each new cloud-based service, then monitoring precision is improved, but device complexity increases
Solution Approach 1:
The patent segments the parser development process into distinct components: OpenAPI specification parsing, template selection, parameter extraction, and connector generation. This modular approach reduces complexity by breaking down the monolithic task of creating service-specific parsers into manageable, reusable segments
Solution Approach 2:
The system enables self-service parser generation by automatically extracting monitoring requirements from OpenAPI specifications and generating appropriate parsers without manual intervention. The automated framework reduces complexity by eliminating the need for experts to manually configure each parser
3Loss of information
If deep packet inspection proxies are deployed for API traffic monitoring, then security visibility is improved, but processing overhead increases
Solution Approach 1:
The patent performs preliminary actions by extracting and analyzing API traffic patterns before deploying deep packet inspection. The system pre-configures monitoring rules based on OpenAPI specifications, allowing the DLP system to focus inspection efforts on relevant traffic patterns and reduce overall processing overhead
Data Source
AI summary
The disclosed technology teaches keeping up with the deployment of APIs, so that Secure Access Service Edge (SASE) protection is afforded, parsing an OpenAPI specification for an API family, for identifying overall attributes of the API family. The technology includes parsing an OpenAPI specification to extract usable attributes of API resources, which are useful for building a connector, including extracting attributes of core activities that trigger protective actions, and applying a connection creator that performs actions including accessing a template for creating connector rules and using the extracted attributes with the template to produce the connector rules, thereby automating generation of connectors. Using the connector rules for the SASE protection is also taught.