Abstract: A computer-implemented method is provided for enforcing data access control policies in a hierarchical structure of a plurality of entities. The method includes receiving a data access request from a client in association with a target entity in the hierarchical structure and generating, by a security gateway, an internal access token comprising a business context that determines an identification of the target entity associated with the client and a data partition in the database corresponding to the target entity. The method also includes verifying, by a data access layer of a microservice module, the data access request against the data access control policies for the hierarchical structure using the internal access token to determine one or more permitted data partitions for access by the client. The method further includes granting the client access to the permitted data partitions if the verifying is successful.

Abstract: A computer-implemented method is provided for enforcing data access control policies in a hierarchical structure of a plurality of entities. The method includes receiving a data access request from a client in association with a target entity in the hierarchical structure and generating, by a security gateway, an internal access token comprising a business context that determines an identification of the target entity associated with the client and a data partition in the database corresponding to the target entity. The method also includes verifying, by a data access layer of a microservice module, the data access request against the data access control policies for the hierarchical structure using the internal access token to determine one or more permitted data partitions for access by the client. The method further includes granting the client access to the permitted data partitions if the verifying is successful.

Abstract: Techniques are provided for managing and operating a microservices architecture with ad distributed cache. A data provider microservice may modify a data object stored on a database managed by the data provider microservice. In response, the modified data object may be transmitted to the distributed cache for storage. A data consumer microservice may request a data object. The distributed cache may be searched for the requested object. If the requested object is stored at the distributed cache, the requested object may be provided to the data consumer microservice. If the requested object is not stored at the distributed cache, the data consumer microservice may issue a request for the data object to the data provider microservice that manages the database that stores the data object. The data provider microservice may provide the data object to the distributed cache for storage and provide the data object to the data consumer microservice.

Abstract: Methods and apparatuses are described for decentralized authorization of user access requests in a distributed service architecture. A gateway node receives a user access request from a remote computing device. The gateway generates a signed and encrypted access token based upon the user access request using an authorization service node and a key management service node. The gateway transmits the access token, the user access request, and a security certificate received from the authorization service to a security proxy node of a microservice container. The security proxy validates the certificate and the access token. The security proxy decrypts the access token using a public key from the certificate, and determines user authorization to access a service endpoint node based upon the decrypted token. The security proxy transmits the user access request to the service endpoint, which provides the remote device with access to services based upon the user access request.