US 11,457,014 B2Granted

Access control in microservice architectures

AssigneeInternational Business Machines Corporation

InventorsVincent Burckhardt, Andre Fischer, Olgierd Pieczul, Jürgen Schmidt, Xiao F. Yu

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method, system and computer program product relating to an application server operable to manage a microservice-based application, i.e. app, on behalf of clients, the clients being available for use by system actors who may be, for example, end users, bots, developers or other apps. A permissions validator is used to compute effective permissions in response to client requests. The requests are granted or denied conditional on the effective permissions being at least a subset of the permissions required to be given by any of the app's microservices that are needed for the resource being requested. The effective permissions are computed from an intersection of a set of actor permissions, a set of client permissions and a set of resource permissions.

Claims14

Dependent claims

A computer program product to support management of an application for clients, the clients being available for use by system actors, and the application providing one or more resources for clients, each resource being associated with at least one application, and each application comprising a plurality of microservices, the computer program product comprising a computer readable storage medium having program code embodied therewith, the program code comprising the programming instructions for:

receiving a request by a client, made under instruction of a system actor, to access a resource in order to perform a function;
computing a set of effective permissions in response to the request from an intersection of a set of actor permissions, a set of client permissions and a set of resource permissions, the actor permissions being permissions assigned to a system actor, the client permissions being permissions assigned to a client for said system actor;
and the resource permissions being permissions assigned to the resource's requestable functions for said system actor;
and
granting or denying the request conditional on the effective permissions being at least a subset of the permissions required to be given by any of the application's microservices that are needed for the resource being requested.

2 more elements

A system, comprising:

a memory unit for storing a computer program to support management of an application for clients, the clients being available for use by system actors, and the application providing one or more resources for clients, each resource being associated with at least one application, and each application comprising a plurality of microservices;
and
a processor coupled to the memory unit, wherein the processor is configured to execute the program instructions of the computer program comprising:
receiving a request by a client, made under instruction of a system actor, to access a resource in order to perform a function;
computing a set of effective permissions in response to the request from an intersection of a set of actor permissions, a set of client permissions and a set of resource permissions, the actor permissions being permissions assigned to a system actor, the client permissions being permissions assigned to a client for said system actor;
and the resource permissions being permissions assigned to the resource's requestable functions for said system actor;
and
granting or denying the request conditional on the effective permissions being at least a subset of the permissions required to be given by any of the application's microservices that are needed for the resource being requested.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/795,048Filed 26 Oct 2017
Published: US 2019/0132320 A12 May 2019
Granted: 27 Sep 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification8 codes

H04L 63/101
For controlling access to devices or network resources: access control lists [ACL]
G06F 21/604
Protecting data: tools and structures for managing or administering access control systems
G06F 21/6218
Protecting access to data via a platform, e.g. using keys or access control rules: to a system of files or objects, e.g. local or distributed file…
H04L 41/28
Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks: restricting access to…