Secure programming interface hierarchies
AssigneeAmazon Technologies, Inc.
InventorsEran Medan, Matthew Ira Bretan, Ian Matthew Gary Meyers, Frank Leslie Van Deman, V
Life of this patent
Estimating the term…
Abstract
A distributed system hosts a plurality of programming interfaces managed according to a hierarchy of security policies. In response to receiving a request from a client to invoke one of the programming interfaces, the system determines whether the client is authorized to call the programming interface by mapping from an attribute of the client to a location in the hierarchy. The system calls the interface in response to determining that the client is authorized to call programming interfaces associated with the location. The programming interface implements the security policy that corresponds to the location.
Claims20
A system, comprising:
- at least one processor;
- and
- at least one memory comprising instructions that, in response to being executed by the at least one processor, cause the system at least to:
- receive a request from a client to call a programming interface, wherein the programming interface is one of a plurality of programming interfaces that control access to data according to a hierarchy of security policies;
- determine that the client is authorized to call the programming interface, based at least in part on mapping from an attribute of the client to a location in the hierarchy;
- and
- call the programming interface, wherein the programming interface:
- controls access to data based on a security policy corresponding to the location in the hierarchy;
- and
- implements the security policy by at least excluding code capable of accessing data other than data in a first dataset.
A method, comprising:
- receiving a request from a client to call a programming interface, wherein the programming interface is one of a plurality of programming interfaces managed according to a hierarchy of security policies;
- determining that the client is authorized to call the programming interface, based at least in part on mapping from an attribute of the client to a location in the hierarchy;
- and
- calling the programming interface, wherein the programming interface implements a security policy, the security policy corresponding to the location in the hierarchy and excluding code from the programming interface capable of accessing data at another location of data outside of a location of data corresponding to the location in the hierarchy of security policies.
A non-transitory computer-readable storage medium comprising executable instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to at least:
- receive a request from a client to call a programming interface, wherein the programming interface is one of a plurality of programming interfaces managed according to a hierarchy of security policies;
- determine that the client is authorized to call the programming interface, based at least in part on a mapping of an attribute of the client to a location in the hierarchy;
- and
- call the programming interface, wherein the programming interface implements a security policy corresponding to the location in the hierarchy and preventing access to data other than data corresponding to the location.
Dependencies are inferred from the claim text.