Authentication and authorization across microservices

Patent metadata

Field	Value
Publication number	US-11658983-B2
Application number	US-202016784802-A
Country	US
Kind code	B2
Filing date	Feb 7, 2020
Priority date	Feb 7, 2020
Publication date	May 23, 2023
Grant date	May 23, 2023

Abstract

An authorization policy defines permissions that are exposed by a microservice. When a call is made to the microservice, it includes an access token. An application identifier uniquely identifying the calling application is extracted from the token. An access pattern, used by the calling application to obtain the access token and make the call to the microservice, is identified. Permissions that may be granted to the calling application are identified in the authorization policy based upon the application identifier and the access pattern that is identified. An authorization decision is made as to whether to authorize the call, based upon the granted permissions.

First claim

What is claimed is:

1. A computer implemented method, comprising:
receiving an access request made to a microservice from a requesting entity, requesting access to the microservice, along with an access token;
obtaining an identity of the requesting entity from the access token;
identifying an access pattern used by the requesting entity, the access pattern representing computing actions performed to obtain the access token and request access to the microservice;
identifying permissions in an access policy, corresponding to the microservice, based on:
the identity of the requesting entity, and
the access pattern; and

generating, based on the permissions, an authorization output indicative of an authorization determination with respect to the access request.

2. The computer implemented method of claim 1 wherein the permissions in the access policy comprise;
a first permission corresponding a first access pattern, wherein the first permission defines authorization of access requests when the first access pattern is used to obtain an access token; and
a second permission corresponding a second access pattern different than the first access pattern, wherein the second permission defines authorization of access requests when the second access pattern is used to obtain an access token.

3. The computer implemented method of claim 1 , and further comprising:
before identifying the permissions, validating the access token comprising:
identifying access permissions corresponding to the access token; and
validating that the requested access is included in the access permissions.

4. The computer implemented method of claim 1 wherein generating the authorization output comprises:
if the permissions identified from the access policy include the requested access, then generating the authorization output authorizing the access request.

5. The computer implemented method of claim 1 wherein generating the authorization output comprises:
if the permissions identified from the access policy do not include the requested access, then generating the authorization output denying the access request.

6. The computer implemented method of claim 1 and further comprising:
registering authentication metadata for the requesting entity and for the microservice with an authentication server;
receiving, at the authentication server, an access token request from the requesting entity, requesting the access token; and
issuing the access token from the authentication server to the requesting entity based on the authentication metadata.

7. The computer implemented method of claim 1 wherein
identifying the access pattern comprises:
based on identifying that the requesting entity to which the access token is issued is an application that directly sent the access token to the microservice,
identifying the access pattern as a direct access pattern, and

identifying permissions in the access policy, corresponding to the application, comprises:
identifying the permissions in the access policy based on the identity of the application and the access pattern being a direct access pattern.

8. The computer implemented method of claim 1 wherein
identifying the access pattern comprises:
based on identifying that the requesting entity to which the access token is issued is an application that sends the access token to an intermediate microservice that forwards the access token to the microservice, identifying the access pattern as a protected forwarded access pattern, and

identifying permissions in the access policy, corresponding to the application, comprises:
identifying the permissions in the access policy based on the identity of the application and the access pattern being a protected forwarded access pattern.

9. The computer implemented method of claim 1 wherein
identifying the access pattern comprises:
based on identifying that the requesting entity to which the access token is issued is a service or microservice that obtains the access token without providing authentication for a specific set of permissions, identifying the access pattern as a high privileged access pattern, and

identifying permissions in the access policy, corresponding to the application, comprises:
identifying the permissions in the access policy based on the identity of the service or microservice which comprises the requesting entity and the access pattern being a high privileged access pattern.

10. The computer implemented method of claim 1 and further comprising:
logging interaction information, including the access request, an identity of the microservice, the identity of the requesting entity, an indicator of the access pattern, the permissions, an access policy identifier, and the authorization output indicative of the authorization determination, in an interaction processing system.

11. The computer implemented method of claim 10 and further comprising:
generating a risk assessment model based on the logged interaction information, the risk assessment model being configured to identify a risk assessment level based on interaction information provided to the risk assessment model during a runtime operation;
generating a runtime risk assessment level with the risk assessment model, corresponding to the interaction information provided to the risk assessment model during the runtime operation; and
returning risk assessment model with the authorization determination.

12. The computer implemented method of claim 1 , wherein the computing actions performed to obtain the access token comprise computing actions performed prior to receiving the access request.

13. A computer system, comprising:
one or more processors; and
memory storing instructions which, when executed by the one or more processors causes the one or more processors to perform steps comprising:
receiving an access request made to a microservice from a requesting entity, requesting access to the microservice, along with an access token;
obtaining an identity of the requesting entity from the access token;
identifying an access pattern used by the requesting entity to obtain the access token and request access to the microservice;
identifying permissions in an access policy, corresponding to the microservice, based on the identity of the requesting entity and the access pattern; and
generating an authorization output indicative of an authorization determination with respect to the access request.

14. The computer system of claim 13 wherein the instructions cause the one or more processors to perform steps further comprising:
before identifying permissions, validating the access token.

15. The computer system of claim 14 wherein validating the access token comprises:
identifying access permissions corresponding to the access token; and
validating that the requested access is included in the access permissions.

16. The computer system of claim 13 wherein generating the authorization output comprises;
if the permissions identified from the access policy include the requested access, then generating the authorization output authorizing the access request; and
if the permissions identified from the access policy do not include the requested access, then generating the authorization output denying the access request.

17. The computer system of claim 13 wherein identifying the access pattern comprises:
identifying that the requesting entity to which the access token is issued is an application that directly sent the access token to the microservice; and
identifying the access pattern as a dire

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Leibmann Matthias
• Kaplin Grigory V
• Ahuja Vikas
• Jain Kapil Kumar
• Zhou Qinxiao
• Cheng Ran

Classifications

• H04L63/105 Primary

  Multiple levels of security · CPC title

• G06F21/33 Primary

  using certificates · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title