Methods for controlling access to decentralized network resources and devices thereof
Methods, non-transitory computer-readable media, and access control apparatuses are disclosed that, after creating a resource in response to a creation request, provide a resource identifier for the resource and a public key of a key pair to an authorizer service for insertion into a mapping. An authorization request is sent to the authorizer service in response to an operation request to perform an operation on the resource that comprises the resource identifier and a token signed with a private key of the key pair. The authorization request comprises the resource identifier, the operation, and the token and the token identifies a capability. The operation is then executed on the resource when a signature of the token is validated by the authorizer service using the public key retrieved from the mapping and the operation is validated based on a match of the operation and the capability.
1 . A method for controlling access to decentralized network resources, the method implemented by an access control apparatus and comprising:
after creating a resource in response to a first creation request, providing a resource identifier for the resource and a public key of a key pair to an authorizer service for insertion into a stored mapping, wherein the first creation request comprises the resource identifier and the public key;
sending an authorization request to the authorizer service in response to a first operation request to perform an operation on the resource, wherein the first operation request comprises the resource identifier and a token signed with a private key of the key pair, the authorization request comprises the resource identifier, the operation, and the token, and the token identifies a capability;
receiving an authorization of the first operation request from the authorization service in response to the authorization request when a signature of the token is validated by the authorizer service using the public key retrieved from the stored mapping using the resource identifier and the operation is validated by the authorizer service based on a match of the operation and the capability; and
executing the operation on the resource by communicating with at least one of a plurality of nodes of a decentralized network in response to the authorization of the first operation request.
2 . The method of claim 1 , wherein the first creation request originates with a first client, the first operation request originates with a second client different from the first client, and the authorization request further comprises one or more of a time at which the first operation request was received or a user identifier of a user of the second client.
3 . The method of claim 2 , further comprising receiving the authorization when one or more of the time at which the first operation request was received is within a validity period or the user identifier is validated by the authorizer service based on one or more checks in a payload of the token, wherein the payload is signed with the private key.
4 . The method of claim 1 , wherein the key pair and the token are generated by a first client from which the first creation request is received and the token is provided by the first client to a second client from which the first operation request originates.
5 . The method of claim 1 , wherein one or more of the nodes host a resource provider service, a gateway service, and the authorizer service, the access control apparatus comprises the one or more of the nodes, and the method further comprises, by the gateway service:
generating the key pair after receiving a second creation request from a first client, wherein the second creation request comprises the resource identifier; and
storing an association of the resource identifier with the private key before sending the first creation request to the resource provider service.
6 . The method of claim 5 , further comprising, by the gateway service:
generating the token after receiving a second operation request from a second client different from the first client, wherein the second operation request comprises the resource identifier; and
signing the token with the private key retrieved from the stored association before sending the signed token to the resource provider service.
7 . The method of claim 1 , wherein the one or more of the nodes host a database, the resource comprises a table of the database, and the resource identifier identifies the table.
8 . An access control apparatus, comprising memory having instructions stored thereon and one or more processors coupled to the memory and configured to execute the stored instructions to:
after creating a resource in response to a first creation request, provide a resource identifier for the resource and a public key of a key pair to an authorizer service for insertion into a stored mapping, wherein the first creation request comprises the resource identifier and the public key;
send an authorization request to the authorizer service in response to a first operation request to perform an operation on the resource, wherein the first operation request comprises the resource identifier and a token signed with a private key of the key pair, the authorization request comprises the resource identifier, the operation, and the token, and the token identifies a capability;
receive an authorization of the first operation request from the authorization service in response to the authorization request when a signature of the token is validated by the authorizer service using the public key retrieved from the stored mapping using the resource identifier and the operation is validated by the authorizer service based on a match of the operation and the capability; and
execute the operation on the resource by communicating with at least one of a plurality of nodes of a decentralized network in response to the authorization of the first operation request.
9 . The access control apparatus of claim 8 , wherein the first creation request originates with a first client, the first operation request originates with a second client different from the first client, and the authorization request further comprises one or more of a time at which the first operation request was received or a user identifier of a user of the second client.
10 . The access control apparatus of claim 9 , wherein the one or more processors are further configured to execute the stored instructions to receive the authorization when one or more of the time at which the first operation request was received is within a validity period or the user identifier is validated by the authorizer service based on one or more checks in a payload of the token, wherein the payload is signed with the private key.
11 . The access control apparatus of claim 8 , wherein the key pair and the token are generated by a first client from which the first creation request is received and the token is provided by the first client to a second client from which the first operation request originates.
12 . The access control apparatus of claim 8 , wherein one or more of the nodes host a resource provider service, a gateway service, and the authorizer service, the access control apparatus comprises the one or more of the nodes, and the one or more processors are further configured to execute the stored instructions to execute the gateway service to:
generate the key pair after receiving a second creation request from a first client, wherein the second creation request comprises the resource identifier; and
store an association of the resource identifier with the private key before sending the first creation request to the resource provider service.
13 . The access control apparatus of claim 12 , wherein the one or more processors are further configured to execute the stored instructions to execute the gateway service to:
generate the token after receiving a second operation request from a second client different from the first client, wherein the second operation request comprises the resource identifier; and
sign the token with the private key retrieved from the stored association before sending the signed token to the resource provider service.
14 . The access control apparatus of claim 8 , wherein the one or more of the nodes host a database, the resource comprises a table of the database, and the resource identifier identifies the table.
15 . A non-transitory computer-readable medium having stored thereon instructions for controlling access to decentralized network resources comprising executable code that, when executed by one or more processors, causes the one or more processors to:
after creating a resource in response to a first creation request, provide a resource identifier for the resource and a public key of a key pair to an authorizer service for insertion into a stored mapping, wherein the first creation request comprises the resource identifier and the public key;
send an authorization request to the authorizer service in response to a first operation request to perform an operation on the resource, wherein the first operation request comprises the resource identifier and a token signed with a private key of the key pair, the authorization request comprises the resource identifier, the operation, and the token, and the token identifies a capability;
receive an authorization of the first operation request from the authorization service in response to the authorization request when a signature of the token is validated by the authorizer service using the public key retrieved from the stored mapping using the resource identifier and the operation is validated by the authorizer service based on a match of the operation and the capability; and
execute the operation on the resource by communicating with at least one of a plurality of nodes of a decentralized network in response to the authorization of the first operation request.
16 . The non-transitory computer-readable medium of claim 15 , wherein the first creation request originates with a first client, the first operation request originates with a second client different from the first client, and the authorization request further comprises one or more of a time at which the first operation request was received or a user identifier of a user of the second client.
17 . The non-transitory computer-readable medium of claim 16 , wherein the executable code, when executed by the one or more processors, further causes the one or more processors to receive the authorization when one or more of the time at which the first operation request was received is within a validity period or the user identifier is validated by the authorizer service based on one or more checks in a payload of the token, wherein the payload is signed with the private key.
18 . The non-transitory computer-readable medium of claim 15 , wherein the key pair and the token are generated by a first client from which the first creation request is received and the token is provided by the first client to a second client from which the first operation request originates.
19 . The non-transitory computer-readable medium of claim 15 , wherein one or more of the nodes host a resource provider service, a gateway service, and the authorizer service and the executable code, when executed by the one or more processors, further causes the one or more processors to execute the gateway service to:
generate the key pair after receiving a second creation request from a first client, wherein the second creation request comprises the resource identifier; and
store an association of the resource identifier with the private key before sending the first creation request to the resource provider service.
20 . The non-transitory computer-readable medium of claim 19 , wherein the executable code, when executed by the one or more processors, further causes the one or more processors to execute the gateway service to:
generate the token after receiving a second operation request from a second client different from the first client, wherein the second operation request comprises the resource identifier; and
sign the token with the private key retrieved from the stored association before sending the signed token to the resource provider service.
21 . The non-transitory computer-readable medium of claim 15 , wherein the one or more of the nodes host a database, the resource comprises a table of the database, and the resource identifier identifies the table.