Unique Action Tag API Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Security-sensitive computing systems face challenges in controlling and limiting access to application programming interfaces (APIs) to prevent unauthorized access and ensure secure operations, particularly in environments where operator access rights can pose a security threat.
Innovation Solution
A method and system that generate a unique action tag and API access key for selective API access, maintaining a dynamic access list to authorize and revoke access, ensuring that API access actions are performed only once and monitored for completion, thereby enhancing security and control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If operator accounts are granted broad access rights to perform necessary actions, then operational efficiency is improved, but security risk increases due to potential unauthorized access
Solution Approach 1:
The patent segments access rights by creating unique action tags for each specific API access action. Instead of granting broad operator accounts with extensive permissions, the system divides access control into granular units where each action tag represents a specific permitted operation. This segmentation allows the system to maintain operational efficiency by enabling necessary actions while reducing security risk by limiting the scope of each access permission to a single defined action.
Solution Approach 2:
The patent applies local quality by making access rights action-specific rather than universally applicable. Each action tag contains an identifier for a specific API access action, creating localized permissions that are valid only for that particular operation. This ensures that operators can perform necessary actions efficiently while the security risk is contained to individual actions rather than broad account-level permissions.
2Reliability
If access control mechanisms are implemented to prevent unauthorized access, then security is improved, but system complexity increases due to additional authorization steps
Solution Approach 1:
The patent implements preliminary action by pre-defining action tags with specific API access actions embedded in them. The system prepares and validates access permissions in advance through the dynamic access list, which maps action tags to authorized operators and their permitted actions. This preliminary setup reduces the complexity of real-time authorization decisions while maintaining strong security, as the system only needs to verify whether a pre-defined action tag is valid rather than evaluating complex permission sets during execution.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of action tags that mediate between operators and API access actions. The dynamic access list serves as an intermediary data structure that stores the mapping between action tags, operators, and permitted actions. This intermediary layer simplifies the access control logic by decoupling the complexity of permission management from the actual access execution, thereby improving security while managing system complexity.
3Measurement precision
If dynamic access lists are maintained to track and revoke access, then access control precision is improved, but processing overhead increases
Solution Approach 1:
The patent extracts the access control logic into a separate, manageable component represented by the dynamic access list. This list specifically stores the mapping between action tags and authorized operators, separating the access control function from the core system operations. By extracting this functionality, the system achieves precise access control tracking and revocation capabilities while minimizing processing overhead in the main system, as the dynamic access list can be maintained and queried independently with optimized data structures.
Data Source
AI summary
Controlling an (API) access action in a security-sensitive computing system includes, for an action to be performed, selecting from an operator account database an available operator account, generating a unique action tag which encompasses an identifier for the API access action and a unique API access key for executing the API access action; maintaining a dynamic access list having a mapping of the identifier of the API access action and the unique API access key and a selected operator account; granting, via the dynamic access list and the unique action tag, to the selected operator account an authorization for the API access to the security-sensitive computing system limited to performing the mapped API access; and revoking a further API access based on the unique action tag after the operator has performed the API access.