Authentication Cache for Geo-Distributed Web Service Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems face challenges in efficiently managing user authentication across geo-distributed security services, leading to multiple authentications due to load balancing or cloud provider events, which impact user experience and increase CPU costs for security processing nodes.
Innovation Solution
Implementing an Authentication Cache Service (ACS) that is decoupled from Security Processing Nodes (SPNs) and uses a geo-replicated database to store authentication state information, utilizing JavaScript Object Notation Web Tokens (JWT) for secure token exchange between nodes, ensuring SPNs remain stateless and reducing redundant authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication state is stored on Security Processing Nodes (SPNs), then authentication reliability is improved, but device complexity and CPU costs increase
Solution Approach 1:
The authentication cache service extracts the authentication state storage function from the Security Processing Nodes and places it in a separate dedicated service. This separation allows SPNs to remain stateless and simple while the authentication cache service handles the complexity of maintaining authentication states across the distributed system.
Solution Approach 2:
The authentication cache service acts as an intermediary between SPNs and the authentication system. It mediates authentication state management by receiving authentication decisions from SPNs and storing them centrally, then providing these states back to SPNs when needed, eliminating the need for SPNs to maintain their own authentication state.
2Reliability
If authentication is performed for each request in geo-distributed system, then authentication reliability is improved, but loss of time and productivity worsen
Solution Approach 1:
The system performs preliminary authentication when users first access the service, storing the authentication state in the authentication cache service. Subsequent requests within the same session can then be served directly from the cache without repeating the full authentication process, significantly reducing authentication time for repeated requests while maintaining reliability.
Solution Approach 2:
The authentication cache service creates copies of authentication states and distributes them across the geo-distributed system. When a user's authentication state is cached, multiple SPNs can access this copied state information, eliminating the need for repeated authentication while ensuring consistency across the distributed infrastructure.
3Ease of operation
If SPNs maintain authentication state, then ease of operation is improved, but adaptability to new authentication services worsens
Solution Approach 1:
By extracting the authentication state management from SPNs and placing it in a dedicated authentication cache service, the system makes SPNs simpler and more focused on their core security functions. The authentication cache service becomes the single point of adaptation for new authentication services, maintaining ease of operation for SPNs while improving overall system adaptability.
Data Source
AI summary
Mitigating multiple authentications for a geo-distributed security service is disclosed. A request to access a web service from a client device is received. The request is redirected to a geo-distributed authentication service including a distributed cache for storing a user's authentication authorization. An authorization token included in a distributed authentication cache cookie and uniform resource locator (URL) for the web service to facilitate secure access to the web service from the client device are returned.