# US 2021/0240550 A1 · Defining and distributing api authorization policies and parameters

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0240550 A1
- Document ID: US20210240550A1
- Status: Published application
- Kind: A1
- Application number: 17/234,708
- Filed: 2021-04-19
- Published: 2021-08-05
- Earliest claimed: 2017-08-02
- Assignees: Styra, Inc.
- Applicants: Styra, Inc.
- Inventors: Timothy L. Hinrichs; Teemu Koponen; Andrew Curtis; Torin Sandall; Octavian Florescu
- Web page: https://patentgrep.com/patent/US20210240550A1

## CPC

- G06F 9/54: Interprogram communication
- G06F 9/45533: {Hypervisors; Virtual machine monitors}
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 9/546: {Message passing systems or structures, e.g. queues}
- G06F 9/547: {Remote procedure calls [RPC]; Web services}
- G06F 16/122: {using management policies (point-in-time backing up or restoration of persistent data G06F11/1446; file migration policies for HSM systems G06F16/185)}
- G06F 16/185: Hierarchical storage management [HSM] systems, e.g. file migration or policies thereof (details of archiving G06F16/11)
- G06F 21/30: Authentication, i.e. establishing the identity or authorisation of security principals
- G06F 21/604: {Tools and structures for managing or administering access control systems}
- G06F 21/629: {to features or functions of an application}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/105: {Multiple levels of security}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- G06F 2209/547: Messaging middleware
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Some embodiments of the invention provide a system for defining, distributing and enforcing policies for authorizing API (Application Programming Interface) calls to applications executing on one or more sets of associated machines (e.g., virtual machines, containers, computers, etc.) in one or more datacenters. This system has a set of one or more servers that acts as a logically centralized resource for defining and storing policies and parameters for evaluating these policies. The server set in some embodiments also enforces these API-authorizing policies. Conjunctively, or alternatively, the server set in some embodiments distributes the defined policies and parameters to policy-enforcing local agents that execute near the applications that process the API calls. From an associated application, a local agent receives API-authorization requests to determine whether API calls received by the application are authorized. In response to such a request, the local agent uses one or more parameters associated with the API call to identify a policy stored in its local policy storage to evaluate whether the API call should be authorized. To evaluate this policy, the agent might also retrieve one or more parameters from the local policy storage.

## Claims

### Claim at position 1

1-19. (canceled)

### Claim 20

A method for defining and distributing API (Application Programming Interface) authorization policies for first and second applications executing on first and second computers, the method comprising:
at a set of servers,
receiving a plurality of authorization policies for a plurality of API calls to the first application and the second application;
collecting parameters for evaluating the authorization policies to assess whether API calls should be authorized or rejected;
defining a first storage structure to store the policies and associated set of parameters for the first application, and a different, second storage structure to store the policies and associated set of parameters for the second application; and
distributing the first storage structure to the first computer and the second storage structure to the second computer, in order to evaluate on the first and second computers whether API calls to the first and second applications should be authorized based on policies and parameters stored in the first and second storage structures.

### Claim 21 (depends on 20)

The method of claim 20, wherein distributing the first and second storage structures comprises distributing the first storage structure to a first local API-authorizing agent executing on the first computer and the second storage structure to a second local API-authorizing agent executing on the second computer, the local agents for evaluating API calls to the applications executing on their computers based on policies and parameters stored in the first and second storage structures.

### Claim 22 (depends on 20)

The method of claim 20, wherein the first storage structure stores policies and parameters that are relevant to the API-authorization processing for the first application, while the second storage structure stores policies and parameters that are relevant to the API-authorization processing for the second application.

### Claim 23 (depends on 20)

The method of claim 20, wherein the first and second applications are associated with one tenant in a multi-tenant datacenter.

### Claim 24 (depends on 20)

The method of claim 20, wherein the first and second applications are associated with first and second tenants in a multi-tenant datacenter.

### Claim 25 (depends on 20)

The method of claim 20, wherein each of the first and second storage structures is a namespace that allows each particular policy and a set of collected parameters associated with the particular policy to be retrieved by providing a location in the namespace.

### Claim 26 (depends on 20)

The method of claim 20 further comprising:
identifying an update to at least a collected parameter for a policy stored in the first storage structure; and
distributing the update to the first computer for storage in the previously distributed first storage structure.

### Claim 27 (depends on 26)

The method of claim 26, wherein identifying update comprises retrieving the update from a source of the collected parameter set through a data pull operation or data push operation.

### Claim 28 (depends on 26)

The method of claim 26, wherein the update parameter and associated policy is also in the second storage structure, the method further comprising distributing the update to the second computer for storage in the previously distributed second storage structure.

### Claim 29 (depends on 20)

The method of claim 20, wherein each authorization policy is defined as a policy opcode in the first or second storage structure, while the parameter set for each authorization policy is defined as a policy operand of that policy's opcode in the first or second storage structure.

### Claim 30 (depends on 29)

The method of claim 29, wherein the opcodes are written in a declarative language and the control parameter sets are written using a language-independent, human-readable format.

### Claim 31 (depends on 30)

The method of claim 30, wherein the control parameter sets are written in Javascript Object Notation (JSON) format.

### Claim 32 (depends on 20)

The method of claim 20, wherein collecting parameters for evaluating the authorization policies comprises using a plurality of data-source adapters to collect parameters from a plurality of data sources in one or more datacenters.

### Claim 33

A non-transitory machine readable medium storing a program for defining and distributing API (Application Programming Interface) authorization policies for first and second applications executing on first and second computers, the program for execution by at least one processing unit of a server, the program comprising sets of instructions for:
receiving a plurality of authorization policies for a plurality of API calls to the first application and the second application;
collecting parameters for evaluating the authorization policies to assess whether API calls should be authorized or rejected;
defining a first storage structure to store the policies and associated set of parameters for the first application, and a different, second storage structure to store the policies and associated set of parameters for the second application; and
distributing the first storage structure to the first computer and the second storage structure to the second computer, in order to evaluate on the first and second computers whether API calls to the first and second applications should be authorized based on policies and parameters stored in the first and second storage structures.

### Claim 34 (depends on 33)

The non-transitory machine readable medium of claim 33, wherein the set of instructions for distributing the first and second storage structures comprises a set of instructions for distributing the first storage structure to a first local API-authorizing agent executing on the first computer and the second storage structure to a second local API-authorizing agent executing on the second computer, the local agents for evaluating API calls to the applications executing on their computers based on policies and parameters stored in the first and second storage structures.

### Claim 35 (depends on 33)

The non-transitory machine readable medium of claim 33, wherein the first storage structure stores policies and parameters that are relevant to the API-authorization processing for the first application, while the second storage structure stores policies and parameters that are relevant to the API-authorization processing for the second application.

### Claim 36 (depends on 33)

The non-transitory machine readable medium of claim 33, wherein each of the first and second storage structures is a namespace that allows each particular policy and a set of collected parameters associated with the particular policy to be retrieved by providing a location in the namespace.