API Gateway Forwarding Label Routing for Security Domain Efficiency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In microservice architectures, API requests crossing multiple security domains face inefficiencies due to the need for extensive querying of prestored mapping tables, leading to prolonged processing times and reduced API request efficiency.
Innovation Solution
A method where the first API gateway receives an API request, determines a forwarding label with a target security domain identifier, and forwards the request to a next-hop API gateway based on a mapping relationship, reducing the number of queries in the mapping table by utilizing a smaller set of security domain identifiers instead of requested addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If the API gateway queries the prestored mapping table between request address and service address to forward API requests across security domains, then the request routing can be achieved, but the query takes a relatively long time and API request efficiency is affected
Solution Approach 1:
The patent segments the original large mapping table (request address to service address) into two smaller mapping tables: (1) request address to forwarding label, and (2) forwarding label to security domain identifier. This segmentation reduces the query scope and improves lookup efficiency, as the API gateway only needs to query the first mapping table to obtain the forwarding label, which directly indicates the target security domain.
Solution Approach 2:
The patent introduces a forwarding label as an intermediary element between the request address and the service address. The forwarding label acts as a mediator that encapsulates the target security domain identifier, allowing the API gateway to quickly determine the destination security domain without querying the entire service address mapping table. This intermediary mechanism significantly reduces query time and improves API request efficiency.
2Adaptability or versatility
If the mapping table contains a large quantity of entries to support all request addresses, then complete routing coverage is achieved, but the query time increases and processing efficiency decreases
Solution Approach 1:
The patent divides the comprehensive routing function into two separate mapping tables with different scopes: the first mapping table (request address to forwarding label) contains fewer entries optimized for quick lookup, while the second mapping table (forwarding label to security domain identifier) provides the routing decision. This segmentation maintains complete routing coverage while minimizing query time by reducing the size of the primary lookup table.
Solution Approach 2:
The patent changes the parameter used for routing decisions from the full service address to a condensed forwarding label that contains the essential security domain identifier. This parameter transformation reduces the complexity and size of the mapping table, allowing for faster queries while maintaining the ability to route to all necessary destinations through the two-stage lookup process.
Data Source
AI summary
A method for transmitting an application programming interface API request includes receiving, by a first API gateway, a first API request; obtaining, by the first API gateway, a first forwarding label corresponding to the first API request, where the first forwarding label includes a first target security domain identifier, and a security domain identifier of the first API gateway is different from the first target security domain identifier. The method also includes determining an address of a second API gateway according to a mapping relationship between the first target security domain identifier and the address of the second API gateway. The method additionally includes sending the first API request to the second API gateway based on the address which is a next-hop API gateway of the first API gateway that sends the first API request to an API gateway corresponding to the first target security domain identifier.