Authentication Cache for Geo-Distributed Security and Lower CPU Load
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems face challenges with multiple authentications due to geo-distributed security services, leading to increased CPU costs and reduced scalability, especially when user traffic is load-balanced across different Security Processing Nodes (SPNs), and require frequent re-authentication due to events like SPN scale-out or cloud provider zone unavailability.
Innovation Solution
Implementing an Authentication Cache Service (ACS) that is decoupled from SPNs, using a geo-replicated database to store authentication state information and employing JavaScript Object Notation Web Tokens (JWT) for secure token exchange between nodes, ensuring stateless authentication and reducing redundant authentication requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If authentication state is stored locally on each Security Processing Node, then authentication speed is fast, but system reliability deteriorates when SPNs are load-balanced or scaled out across geo-distributed locations
Solution Approach 1:
The authentication state is extracted from the SPN local memory and stored externally in a shared cache service. This allows the state to be preserved across different SPN instances while maintaining fast access, resolving the contradiction between local storage speed and distributed reliability.
Solution Approach 2:
A shared cache service acts as an intermediary between multiple SPNs and the authentication system. This mediator maintains authentication state centrally, allowing any SPN to access consistent authentication data regardless of load balancing or scaling events, thus maintaining both speed and reliability.
2Reliability
If authentication is handled by geo-distributed Security Processing Nodes, then service availability is improved, but CPU load and authentication overhead increase due to multiple authentications
Solution Approach 1:
Authentication is performed once by any SPN in the geo-distributed network, and the authentication state is cached centrally before subsequent requests arrive. This preliminary authentication action eliminates the need for repeated authentications across multiple SPNs, reducing CPU load while maintaining service availability.
Solution Approach 2:
The authentication state is copied to a shared cache service that can be accessed by multiple SPNs. This copying mechanism allows any SPN to serve authenticated users without performing redundant authentication, thereby reducing overall CPU consumption across the distributed system.
3Productivity
If Security Processing Nodes are scaled out to improve capacity, then service capacity increases, but authentication complexity increases due to state management across multiple nodes
Solution Approach 1:
Authentication state management complexity is extracted from individual SPNs and centralized in a shared cache service. This allows SPNs to be scaled out freely for increased capacity without each node needing to manage authentication state, thereby increasing productivity while reducing the complexity burden on individual nodes.
Solution Approach 2:
Authentication state management functionality is merged into a dedicated shared cache service rather than being distributed across multiple SPNs. This consolidation simplifies the overall system architecture, allowing SPNs to focus on their primary security functions while the cache service handles state management, enabling easier scaling.
Data Source
AI summary
Mitigating multiple authentications for a geo-distributed security service is disclosed. A request to access a web service from a client device is received. The request is redirected to a geo-distributed authentication service including a distributed cache for storing a user's authentication authorization. An authorization token included in a distributed authentication cache cookie and uniform resource locator (URL) for the web service to facilitate secure access to the web service from the client device are returned.