Systems and methods for context-specific granular access to flight management system using adaptive identity management

Patent metadata

Field	Value
Publication number	US-11856111-B2
Application number	US-202117246161-A
Country	US
Kind code	B2
Filing date	Apr 30, 2021
Priority date	Nov 20, 2020
Publication date	Dec 26, 2023
Grant date	Dec 26, 2023

Abstract

Disclosed are methods, systems, and computer-readable medium for context-specific granular access to flight management system (FMS) SaaS using adaptive IAM. For instance, the method may include receiving, at one of a plurality of application programing interface (API) endpoints of a flight management system (FMS) software as a service (SaaS), a request from a client; determining whether the request is authorized; in response to determining the request is authorized, analyzing the request to determine a context of the request and determine whether the request includes an intent; transmitting a message to a particular functionality of the FMS SaaS based on the context and the intent; determining whether the client is associated with a subscription type; filtering a data stream from the FMS SaaS in accordance with the subscription type and the context; generating a response based on the filtered data stream; and transmitting the response to the client.

First claim

What is claimed is:

1. A method, comprising:
receiving, at one of a plurality of application programing interface (API) endpoints of a flight management system (FMS) software as a service (SaaS), a request from a client;
determining whether the request is authorized;
in response to determining the request is authorized, analyzing the request to determine a context of the request and determine whether the request includes an intent;
in response to determining the context and determining the request includes the intent, generating a message in accordance with an API protocol to include action data and a priority level, and transmitting the message to a particular functionality of the FMS SaaS based on the context and the intent, wherein the action data is based on the context and the intent;
in response to determining the request includes the intent, determining whether the client is associated with a subscription type;
in response to determining the client is associated with the subscription type, filtering a data stream from the FMS SaaS in accordance with the subscription type and the context;
generating a response based on the filtered data stream; and
transmitting the response to the client.

2. The method of claim 1 , wherein the determining whether the request is authorized includes:
performing one or both of:
requesting from an identity and access management (IAM) system a unique certificate for the client, and/or
accessing a certificate manager to retrieve the unique certificate for the client, the certificate manager being updated by the IAM system to include unique certificates for a plurality of clients;

in response to obtaining the unique certificate from the IAM system or the certificate manager, processing the request to obtain a token;
determine whether the token is valid based on the unique certificate and a private key of FMS SaaS; and
in response to determining the token is valid, determining the request is authorized.

3. The method of claim 1 , wherein the analyzing the request to determine whether the request includes the intent includes:
processing the request to obtain a token and request data from the request;
analyzing the token to determine whether the token includes a client identification (ID) corresponding to a particular API invocation of the FMS SaaS; and
in response to determining the token includes the client ID, analyzing the request data and the client ID to determine the intent.

4. The method of claim 3 , wherein the analyzing the request to determine the context of the request includes:
obtaining contextual data associated with the client from the FMS SaaS; and
analyzing the request data and/or the contextual data to determine the context and a priority for the request.

5. The method of claim 4 , wherein the transmitting the message to the particular functionality of the FMS SaaS based on the context and the intent includes:
transmitting the message to the particular functionality of the FMS SaaS that corresponds to the particular API invocation of the FMS SaaS, wherein the priority level is based on the priority.

6. The method of claim 1 , wherein the determining whether the client is associated with the subscription type includes:
performing one or both of:
requesting from an identity and access management (IAM) system the subscription type of the client, and/or
accessing an authorization agent to retrieve the subscription type for the client, the authorization agent being updated by the IAM system to include subscription types for a plurality of clients; and

in response to obtaining the subscription type from the IAM system or the authorization agent, determining the client is associated with the subscription.

7. The method of claim 1 , wherein the filtering the data stream from the FMS SaaS in accordance with the subscription type and the context includes:
separating the data stream from the FMS SaaS based on the context into separated data streams;
obtaining a set of permissions based on the subscription type, the permissions including at least permitted data types;
determining whether there are data types that match the permitted data types in the separated data streams;
in response to determining there are data types that match the permitted data types in the separated data streams, extracting individual data packets from the separated data streams in accordance with the data types that match the permitted data types; and
setting the individual data packets as the filtered data stream.

8. A system, comprising:
at least one memory storing instructions; and
at least one processor executing the instructions to perform a process including:
receiving, at one of a plurality of application programing interface (API) endpoints of a flight management system (FMS) software as a service (SaaS), a request from a client;
determining whether the request is authorized;
in response to determining the request is authorized, analyzing the request to determine a context of the request and determine whether the request includes an intent;
in response to determining the context and determining the request includes the intent, generating a message in accordance with an API protocol to include action data and a priority level, and transmitting the message to a particular functionality of the FMS SaaS based on the context and the intent, wherein the action data is based on the context and the intent;
in response to determining the request includes the intent, determining whether the client is associated with a subscription type;
in response to determining the client is associated with the subscription type, filtering a data stream from the FMS SaaS in accordance with the subscription type and the context;
generating a response based on the filtered data stream; and
transmitting the response to the client.

9. The system of claim 8 , wherein the process further includes, to determine whether the request is authorized:
performing one or both of:
requesting from an identity and access management (IAM) system a unique certificate for the client, and/or
accessing a certificate manager to retrieve the unique certificate for the client, the certificate manager being updated by the IAM system to include unique certificates for a plurality of clients;

in response to obtaining the unique certificate from the IAM system or the certificate manager, processing the request to obtain a token;
determine whether the token is valid based on the unique certificate and a private key of FMS SaaS; and
in response to determining the token is valid, determining the request is authorized.

10. The system of claim 8 , wherein the process further includes, to analyze the request to determine whether the request includes the intent:
processing the request to obtain a token and request data from the request;
analyzing the token to determine whether the token includes a client identification (ID) corresponding to a particular API invocation of the FMS SaaS; and
in response to determining the token includes the client ID, analyzing the request data and the client ID to determine the intent.

11. The system of claim 10 , wherein the process further includes, to analyze the request to determine the context of the request:
obtaining contextual data associated with the client from the FMS SaaS; and
analyzing the request data and/or the contextual data to determine the context and a priority for the request.

12. The system of claim 11 , wherein the process further includes, to transmit the message to the particular functionality of the FMS SaaS based on the context and the intent:
transmitting the message to the part

Assignees

• Honeywell Int Inc

Inventors

• Mohan Rajeev
• Janakiraman Kirupakar

Classifications

• H04L9/3268 Primary

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title

• G06F9/546

  Message passing systems or structures, e.g. queues · CPC title

• G07C5/008

  communicating information to a remotely located station (transmission systems for measured values G08C) · CPC title

• H04L9/3213

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title