Partial Policy Evaluation for API Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Micro-service applications face challenges in implementing complex access controls due to their small, well-defined nature, making it impractical to incorporate and maintain traditional access control systems, which are often cumbersome and difficult to update dynamically.
Innovation Solution
A system for defining, distributing, and enforcing API authorization policies using local agents co-located with entity machines, which evaluate policies and parameters to authorize API calls, allowing for partial evaluation to precompute static portions offline, reducing runtime computation and enabling dynamic updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control systems are incorporated into micro-service applications, then authorization capabilities are provided, but application complexity and maintenance difficulty increase
Solution Approach 1:
The patent extracts the authorization logic from the micro-service application code and places it in a separate policy management system. The application code becomes simpler by removing access control implementations, while the extracted policy engine handles authorization independently, resolving the contradiction between providing authorization capability and maintaining application simplicity.
Solution Approach 2:
The patent introduces a policy engine as an intermediary component between the application and the access control logic. This mediator handles all authorization decisions through separate policy files, allowing the application to remain simple while still providing comprehensive authorization capabilities through the intermediate policy layer.
2Reliability
If access control rules are coded within application code base, then authorization is enforced, but dynamic modification becomes difficult
Solution Approach 1:
The patent transforms the static access control rules embedded in code into dynamic policy files that can be modified without recompiling the application. The policy engine reads these external policy files and enforces authorization dynamically, allowing rules to be changed at runtime to improve adaptability while maintaining enforcement reliability.
Solution Approach 2:
The patent changes the form of access control rules from hardcoded parameters in the application code to externalized policy file parameters. This parameter transformation allows the same application code to enforce different authorization rules by simply changing the policy file contents, enabling dynamic modification while maintaining consistent enforcement mechanisms.
3Reliability
If complex access controls are incorporated into micro-service applications, then security is improved, but functional complexity and maintenance burden increase
Solution Approach 1:
The patent extracts complex access control logic from the micro-service application and places it in a dedicated policy management system. This extraction maintains security by preserving the authorization enforcement capability while reducing the maintenance burden on application developers, as policy changes no longer require code modifications or recompilation.
Solution Approach 2:
The patent introduces a policy management intermediary that handles complex security rules separately from the application code. This intermediary maintains security by enforcing authorization policies while simplifying maintenance, as the policy engine can be configured and updated independently without affecting the application codebase or requiring developer intervention for policy changes.
Data Source
AI summary
Some embodiments provide a method for evaluating a policy for authorizing an API (Application Programming Interface) call to an application. Based on a first set of parameters available before receiving the API call, the method evaluates only a portion of the policy to produce a partially evaluated policy. The method stores the partially evaluated policy in a cache. The method then receives an API call to authorize, and determines whether the API call should be authorized by fully evaluating the policy, using the partially evaluated policy retrieved from the cache first storage, and a second set of parameters associated with the API call. The method responds to the API call with a policy decision based on the fully evaluated authorization policy.