# US 12,225,019 B2 · System for enforcing least privileged API access with dynamically scoped identification and access tokens

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,225,019 B2
- Document ID: US12225019B2
- Status: Granted
- Kind: B2
- Application number: 18/220,629
- Filed: 2023-07-11
- Published: 2025-01-16
- Granted: 2025-02-11
- Earliest claimed: 2023-07-11
- Assignees: Dell Products L.P.
- Applicants: Dell Products L.P.
- Inventors: Sumedh Wasudeo Sathaye; Yi Fang; Yidong Wang; Ranjit Kollu; Murali Kadala Keloth; David Scott Thompson; Ching-Yun Chao
- Web page: https://patentgrep.com/patent/US12225019B2

## CPC

- H04L 63/105: {Multiple levels of security}
- G06F 9/547: {Remote procedure calls [RPC]; Web services}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/102: {Entity profiles}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A system, method, and computer-readable medium for performing a data center monitoring and management operation. The data center monitoring and management operation includes: generating a request for a client identifier or an access token for access to a target application programming interface (API); obtaining an access policy associated with the target API; determining a least privileged API access permission based upon the access policy associated with the target API; and, using the client identifier or access token to access the target API when the least privileged API access permission allows access to the target API.

## Claims

### Claim 1

A computer-implementable method for performing a data center monitoring and management operation, comprising:
establishing a secure connection between a data center asset contained within a data center and connectivity management system of a data center monitoring and management console, the data center monitoring and management console includes an application programming interface (API) access management system, the API access management system performing an API access management operation, the API access management operation managing authorized access to a particular API;
generating a request for a client identifier or an access token for access to a target API by a user, the target API being associated with the data center asset;
providing the request for the client identifier or the access token to the API access management system;
obtaining an access policy associated with the target API, the access policy identifying access permissions associated with the user;
determining a least privileged API access permission based upon the access policy associated with the target API; and,
using the client identifier or access token to access the target API when the least privileged API access permission allows access to the target API.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
creating the access policy associated with the target API, the access policy comprising a list of maximum allowed permissions for a particular user.

### Claim 3 (depends on 2)

The method of claim 2, wherein:
the particular user has an associated federated identify, the associated federated identify linking an electronic identity of the particular user, and associated attributes, across a plurality of individual identity management systems.

### Claim 4 (depends on 1)

The method of claim 1, wherein:
the least privileged API access permission for a user is calculated based upon an intersection of a required access permission of an API and a maximum allowed local role of a requested user.

### Claim 5 (depends on 1)

The method of claim 1, wherein:
the target API access to a resource is granted when a local granted role of the user matches a local required role of the resource.

### Claim 6 (depends on 1)

The method of claim 1, wherein:
the least privileged API access permission is maintained by a security proxy token service.

### Claim 7

A system comprising:
a processor;
a data bus coupled to the processor; and,
a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
establishing a secure connection between a data center asset contained within a data center and connectivity management system of a data center monitoring and management console, the data center monitoring and management console includes an application programming interface (API) access management system, the API access management system performing an API access management operation, the API access management operation managing authorized access to a particular API;
generating a request for a client identifier or an access token for access to a target API by a user, the target API being associated with the data center asset;
providing the request for the client identifier or the access token to the API access management system;
obtaining an access policy associated with the target API, the access policy identifying access permissions associated with the user;
determining a least privileged API access permission based upon the access policy associated with the target API; and,
using the client identifier or access token to access the target API when the least privileged API access permission allows access to the target API.

### Claim 8 (depends on 7)

The system of claim 7, wherein the instructions executable by the processor are further configured for:
creating the access policy associated with the target API, the access policy comprising a list of maximum allowed permissions for a particular user.

### Claim 9 (depends on 8)

The system of claim 8, wherein:
the particular user has an associated federated identify, the associated federated identify linking an electronic identity of the particular user, and associated attributes, across a plurality of individual identity management systems.

### Claim 10 (depends on 7)

The system of claim 7, wherein:
the least privileged API access permission for a user is calculated based upon an intersection of a required access permission of an API and a maximum allowed local role of a requested user.

### Claim 11 (depends on 7)

The system of claim 7, wherein:
the target API access to a resource is granted when a local granted role of the user matches a local required role of the resource.

### Claim 12 (depends on 7)

The system of claim 7, wherein:
the least privileged API access permission is maintained by a security proxy token service.

### Claim 13

A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
establishing a secure connection between a data center asset contained within a data center and connectivity management system of a data center monitoring and management console, the data center monitoring and management console includes an application programming interface (API) access management system, the API access management system performing an API access management operation, the API access management operation managing authorized access to a particular API;
generating a request for a client identifier or an access token for access to a target API by a user, the target API being associated with the data center asset;
providing the request for the client identifier or the access token to the API access management system;
obtaining an access policy associated with the target API, the access policy identifying access permissions associated with the user;
determining a least privileged API access permission based upon the access policy associated with the target API; and,
using the client identifier or access token to access the target API when the least privileged API access permission allows access to the target API.

### Claim 14 (depends on 13)

The non-transitory, computer-readable storage medium of claim 13, wherein the computer executable instructions are further configured for:
creating the access policy associated with the target API, the access policy comprising a list of maximum allowed permissions for a particular user.

### Claim 15 (depends on 14)

The non-transitory, computer-readable storage medium of claim 14, wherein:
the particular user has an associated federated identify, the associated federated identify linking an electronic identity of the particular user, and associated attributes, across a plurality of individual identity management systems.

### Claim 16 (depends on 13)

The non-transitory, computer-readable storage medium of claim 13, wherein:
the least privileged API access permission for a user is calculated based upon an intersection of a required access permission of an API and a maximum allowed local role of a requested user.

### Claim 17 (depends on 13)

The non-transitory, computer-readable storage medium of claim 13, wherein:
the target API access to a resource is granted when a local granted role of the user matches a local required role of the resource.

### Claim 18 (depends on 13)

The non-transitory, computer-readable storage medium of claim 13, wherein:
the least privileged API access permission is maintained by a security proxy token service.

### Claim 19 (depends on 13)

The non-transitory, computer-readable storage medium of claim 13, wherein:
the computer executable instructions are deployable to a client system from a server system at a remote location.

### Claim 20 (depends on 13)

The non-transitory, computer-readable storage medium of claim 13, wherein:
the computer executable instructions are provided by a service provider to a user on an on-demand basis.