Application programming interface (API) domain specific language
A principal successfully authenticates for a communication session with a target device. One or more Domain Specific Language (DSL) statements/records assigned to the principal are provided to the target device. The target device translates the DSL statements/records into code, which is executed on the target device to custom set security roles of the principal on the target device during the session. In an embodiment, the one or more DSL statements/records are provided to the target device as an optimized JavaScript® Object Notation (JSON) Web Token (JWT); a payload of the optimized JWT comprising the one or more DSL statements/records as a compressed and enhanced JSON object.
1 . A system, comprising:
a server comprising at least one processor and a non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium comprising executable instructions;
an endpoint device comprising an endpoint device processor and an endpoint device non-transitory computer-readable storage medium, the endpoint device non-transitory computer-readable storage medium comprising endpoint device executable instructions;
the executable instructions when executed by the at least one processor of the server cause the at least one processor of the server to perform operations, comprising: authenticating a principal for access to the endpoint device; and
providing a token to the endpoint device, wherein the token comprises a header, a payload, and a signature, wherein the payload represents a compressed version of security roles associated with five distinct areas of security that the endpoint device is to set for a session between the principal and the endpoint device, wherein the payload comprises multiple domain specific language (DSL) statements, each DSL statement associated with a different application programming interface (API) accessible by the principal during the session; and
the endpoint device executable instructions when executed by the endpoint device processor of the endpoint device cause the endpoint device processor to perform additional operations, comprising:
obtaining the payload from the token;
processing a DSL translator to decompress the compressed version of the security roles associated with the five distinct areas of security; and
processing security role statements for the security roles that set security for the principal during the session with the endpoint device.
2 . The system of claim 1 , wherein the endpoint device is a second server, a cloud, a self-service terminal (SST), an automated teller machine (ATM), a point-of-sale (POS) terminal, a kiosk, a tablet, a laptop, a phone, a desktop computer, a wearable processing device, or an internet-of-things (IoT) device.
3 . The system of claim 1 , wherein the payload comprises a domain specific language (DSL) statement having fields delineated by a field-separation character, and wherein the five distinct areas of security comprise: an application programming interface (API) identifier field, an endpoint identifier field, a role action identifier field, a reservation identifier field, and a self-limiting identifier field.
4 . The system of claim 1 , wherein the payload comprises a wildcard character in at least one field representing all security roles being assigned to the principal for a security area defined by the at least one field containing the wildcard character.
5 . The system of claim 1 , wherein the server maintains the multiple DSL statements for the principal based on different application programming interfaces (APIs) that the principal can access during the session with the endpoint device.
6 . The system of claim 1 , wherein a reservation identifier prevents over-granting of roles for the endpoint device as a whole.
7 . The system of claim 1 , wherein a self-limiting identifier restricts the principal to accessing only self-authored records when set to a specific value.
8 . The system of claim 1 , wherein the DSL translator processes the compressed version into code having an existing syntax and structure recognized by the endpoint device.
9 . A system, comprising:
a server configured to authenticate a principal for access to an endpoint device and provide a token to the endpoint device upon successful authentication, wherein the token includes a payload representing a compressed version of security roles, wherein the compressed version of the security roles comprises domain specific language (DSL) statements having fields separated by a delimiter character, the fields representing different security areas including application programming interface (API) access levels, endpoint permissions, action authorizations, reservation settings, and self-limiting controls; and
the endpoint device comprising at least one processor and a non-transitory computer-readable storage medium with stored instructions which when executed by the at least one processor, cause the endpoint device to:
obtain the payload from the token;
decompress the payload into security roles using a DSL translator; and
set security access rights for the principal during a session based on the security roles, wherein the security roles are associated with different APIs accessible by the principal during the session.
10 . The system of claim 9 , wherein the payload includes role restriction indicators that prevent over-granting of access rights.
11 . The system of claim 9 , wherein the security roles include endpoint-level restrictions and principal-level restrictions.
12 . The system of claim 9 , wherein the DSL translator converts the compressed version into executable code compatible with existing endpoint device security protocols.
13 . The system of claim 9 , wherein at least one field in the compressed version contains a wildcard character indicating all available roles are granted for that field.
14 . A method, comprising:
authenticating, by a server, a principal requesting access to an endpoint device;
generating a token comprising a compressed payload representing security roles, wherein generating the token comprises creating domain specific language (DSL) statements with fields separated by delimiter characters, the fields representing different security areas including application programming interface (API) access levels, endpoint permissions, role actions, reservation settings, and self-limiting controls;
providing the token to the endpoint device;
decompressing, by the endpoint device, the compressed payload using a domain specific language (DSL) translator; and
setting security access rights for the principal on the endpoint device based on the decompressed security roles, wherein the decompressed security roles are associated with different APIs accessible by the principal during a session.
15 . The method of claim 14 , wherein decompressing comprises translating the compressed payload into executable security commands recognized by existing endpoint device security protocols.