Granted Patent B2

US 12,348,522 · App. 18/056,977 · Granted Jul 1, 2025

Inventors: Rami Haddad (Assendelft, NL); Rim El Malki (Palaiseau, FR); Daniel-Serban Cozma (Braila, RO); Hendrikus G. P. Bosch (Aalsmeer, NL)

Assignee: CISCO TECHNOLOGY, INC.

H04L63/101H04L63/102H04L63/105

Abstract

Claims (46)

1. A method for providing an extended security scheme for reducing prevalence of broken object level authorization for a user, comprising:

receiving, by an application programming interface (API) generator, code associated with an API received from the user, wherein the code comprises one of an API definition and an API server stub;

parsing, by the API generator, the code for one or more keywords associated with the extended security scheme;

if the code comprises the API definition, generating, by the API generator, an associated API server stub based on at least one of the one or more keywords and the API definition, wherein the associated API server stub implements the extended security scheme;

if the code comprises the API server stub, generating, by the API generator, an associated API definition based on at least one of the one or more keywords and the API server stub, wherein the associated API definition implements the extended security scheme; and

transmitting, by the API generator, the associated API server stub or the associated API definition to the user.

2. The method of claim 1 , wherein the code comprises instructions associated with object-level security features.

3. The method of claim 1 , wherein generating the associated API server stub comprises implementing an authorization module that is configured to automatically generate an access control list for objects created by calls to the associated API server stub during runtime.

4. The method of claim 1 , further comprising:

detecting a call from the user to an object at the associated API server stub during runtime;

checking an access control list for one or more user privileges associated with the object; and

rejecting the call based on determining that the one or more user privileges does not include access to the object.

5. The method of claim 1 , wherein generating the associated API definition comprises generating an API definition file comprising the extended security scheme available for use in API development.

6. The method of claim 1 , wherein the extended security scheme is an object-level security scheme.

7. The method of claim 1 , wherein the extended security scheme comprises a wrapper function for generating an object privilege.

8. A system for providing an extended security scheme for reducing prevalence of broken object level authorization for a user, comprising:

one or more processors; and

one or more non-transitory computer-readable storage media comprising instructions that, when executed by the one or more processors, cause one or more components of the system to perform operations comprising:

receiving, by an application programming interface (API) generator, code associated with an API received from the user, wherein the code comprises one of an API definition and an API server stub;

parsing, by the API generator, the code for one or more keywords associated with the extended security scheme;

if the code comprises the API definition, generating, by the API generator, an associated API server stub based on at least one of the one or more keywords and the API definition, wherein the associated API server stub implements the extended security scheme;

if the code comprises the API server stub, generating, by the API generator, an associated API definition based on at least one of the one or more keywords and the API server stub, wherein the associated API definition implements the extended security scheme; and

transmitting, by the API generator, the associated API server stub or the associated API definition to the user.

9. The system of claim 8 , wherein the code comprises instructions associated with object-level security features.

10. The system of claim 8 , wherein generating the associated API server stub comprises implementing an authorization module that is configured to automatically generate an access control list for objects created by calls to the associated API server stub during runtime.

11. The system of claim 8 , further comprising:

detecting a call from the user to an object at the associated API server stub during runtime;

checking an access control list for one or more user privileges associated with the object; and

rejecting the call based on determining that the one or more user privileges does not include access to the object.

12. The system of claim 8 , wherein generating the associated API definition comprises generating an API definition file comprising the extended security scheme available for use in API development.

13. The system of claim 8 , wherein the extended security scheme is an object-level security scheme.

14. The system of claim 8 , wherein the extended security scheme comprises a wrapper function for generating an object privilege.

15. One or more non-transitory computer-readable storage media embodying instructions for providing an extended security scheme for reducing prevalence of broken object level authorization for a user, the instructions when executed by a processor, cause performance of operations comprising:

receiving, by an application programming interface (API) generator, code associated with an API received from the user, wherein the code comprises one of an API definition and an API server stub;

parsing, by the API generator, the code for one or more keywords associated with the extended security scheme;

if the code comprises the API definition, generating, by the API generator, an associated API server stub based on at least one of the one or more keywords and the API definition, wherein the associated API server stub implements the extended security scheme;

if the code comprises the API server stub, generating, by the API generator, an associated API definition based on at least one of the one or more keywords and the API server stub, wherein the associated API definition implements the extended security scheme; and

transmitting, by the API generator, the associated API server stub or the associated API definition to the user.

16. The one or more non-transitory computer-readable storage media of claim 15 , wherein the code comprises instructions associated with object-level security features.

17. The one or more non-transitory computer readable storage media of claim 15 , wherein generating the associated API server stub comprises implementing an authorization module that is configured to automatically generate an access control list for objects created by calls to the associated API server stub during runtime.

18. The one or more non-transitory computer-readable storage media of claim 15 , the operations further comprising:

detecting a call from the user to an object at the associated API server stub during runtime;

checking an access control list for one or more user privileges associated with the object; and

rejecting the call based on determining that the one or more user privileges does not include access to the object.

19. The one or more non-transitory computer-readable storage media of claim 15 , wherein generating the associated API definition comprises generating an API definition file comprising the extended security scheme available for use in API development.

20. The one or more non-transitory computer readable storage media of claim 15 , wherein the extended security scheme is an object-level security scheme.

Assignments (1)

Continuity (2)

References Cited (14)