Portable policy execution using embedded machines
Some embodiments provide a method for evaluating authorization policies that restrict access to API (Application Programming Interfaces) calls to an application executing on a host system. At the application, the method receives an API call to execute. The method directs a process virtual machine (VM) executing inside the application to make an authorization decision for the API call. The method executes the API call after receiving an authorization decision to allow the API call from the process VM executing inside the application.
1. A method for evaluating authorization policies that restrict access to API (Application Programming Interface) calls to an application executing on a host system, the method comprising:
at the application,
receiving an API call to execute;
directing a process virtual machine (VM) executing inside the application to make an authorization decision for the API call, wherein the process VM generates a set of binary instructions from an API authorization policy code; and
executing the API call after receiving an authorization decision to allow the API call from the process VM executing inside the application.
2. The method of claim 1 , wherein the set of binary instructions are not native to the application, wherein the process VM is a runtime interpreter for the set of binary instructions.
3. The method of claim 1 , wherein the process VM makes the authorization decision by executing the set of binary instructions.
4. The method of claim 3 , wherein the process VM receives a set of contextual data associated with the API authorization policy code for use as an input to the set of binary instructions, wherein at least a portion of the contextual data is identified using a set of parameters associated with the API call.
5. The method of claim 3 , wherein for each binary instruction in the set of binary instructions, the process VM (i) translates the binary instruction into a binary instruction that is native to the application, and (ii) executes the translated native instruction.
6. The method of claim 3 , wherein the set of binary instructions is a first set of binary instructions, wherein for each binary instruction in the first set of binary instructions, the process VM (i) translates the first set of instructions into a code, (ii) optimizes the translated code for at least one of the application and the host system, (iii) compiles the translated code into a second set of instructions that are native to the application, and (iv) executes the native set of instructions.
7. The method of claim 1 , wherein the process VM generates the set of binary instructions from the API authorization code by compiling the API authorization policy code, wherein a portion of the API authorization policy is evaluated prior to compiling the API authorization policy code.
8. The method of claim 1 , wherein the process VM generates the set of binary instructions from the API authorization code by including one or more policy extension codes in addition to the API authorization policy code, wherein a policy extension code defines an extension to the API authorization policy, wherein at least one policy extension code is in a different language than the API authorization policy code.
9. The method of claim 1 , further comprising:
receiving a second API call to execute;
directing the process VM executing inside the application to make a second authorization decision for the second API call; and
rejecting the second API call after receiving an authorization decision to reject the API call from the process VM.
10. The method of claim 1 , wherein the application comprises a native API authorization module executing inside the application alongside the process VM, wherein directing the process VM to make the authorization decision comprises using the native API authorization module to direct the process VM to make the authorization decision.
11. The method of claim 1 , wherein the application comprises a native API authorization module executing inside the application alongside the process VM, wherein directing the process VM to make the authorization decision comprises bypassing the native API authorization module.
12. A non-transitory machine readable medium storing an application which when executed by at least one processing unit evaluates authorization policies that restrict access to API (Application Programming Interface) calls to an application executing on a host system, the application comprising sets of instructions for:
receiving an API call to execute;
directing a process virtual machine (VM) executing inside the application to make an authorization decision for the API call, wherein the process VM generates a set of binary instructions from an API authorization policy code; and
executing the API call after receiving an authorization decision to allow the API call from the process VM executing inside the application.
13. The non-transitory machine readable medium of claim 12 , wherein the set of binary instructions are not native to the application, wherein the process VM is a runtime interpreter for the set of binary instructions.
14. The non-transitory machine readable medium of claim 12 , wherein the process VM makes the authorization decision by executing the set of binary instructions.
15. The non-transitory machine readable medium of claim 14 , wherein the process VM receives a set of contextual data associated with the API authorization policy code for use as an input to the set of binary instructions, wherein at least a portion of the contextual data is identified using a set of parameters associated with the API call.
16. The non-transitory machine readable medium of claim 14 , wherein for each binary instruction in the set of binary instructions, the process VM (i) translates the binary instruction into a binary instruction that is native to the application, and (ii) executes the translated native instruction.
17. The non-transitory machine readable medium of claim 14 , wherein the set of binary instructions is a first set of binary instructions, wherein for each binary instruction in the first set of binary instructions, the process VM (i) translates the first set of instructions into a code, (ii) optimizes the translated code for at least one of the application and the host system, (iii) compiles the translated code into a second set of instructions that are native to the application, and (iv) executes the native set of instructions.
18. The non-transitory machine readable medium of claim 12 , wherein the process VM generates the set of binary instructions from the API authorization code by compiling the API authorization policy code, wherein a portion of the API authorization policy is evaluated prior to compiling the API authorization policy code.
19. The non-transitory machine readable medium of claim 12 , wherein the process VM generates the set of binary instructions from the API authorization code by including one or more policy extension codes in addition to the API authorization policy code, wherein a policy extension code defines an extension to the API authorization policy, wherein at least one policy extension code is in a different language than the API authorization policy code.