Backwards Compatible Orchestration of Isolated Guests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In shared computing environments, especially multi-tenant cloud systems, there is a challenge in managing deprecated APIs and legacy components, where access to outdated functionality is still required while maintaining security and agility, especially when updating software poses risks of disrupting critical applications dependent on retired components.
Innovation Solution
A secure backwards compatible orchestration system is implemented, where the current version of an isolated guest orchestrator hosts older versions as dependent compute services, allowing unsupported API requests to be routed to these legacy components, ensuring security patching and enabling access to legacy storage devices while preventing direct external access to potentially vulnerable components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the current version of the isolated guest orchestrator is updated with new features and security patches, then security and functionality are improved, but access to deprecated APIs and legacy components is lost
Solution Approach 1:
The patent implements a versioned API gateway that acts as an intermediary between external requests and the isolated guest orchestrator. The gateway maintains multiple versions of deprecated APIs and forwards compatible requests to appropriate orchestrator versions, allowing the orchestrator to be updated while preserving access to legacy functionality through the gateway layer.
2Adaptability or versatility
If older versions of the isolated guest orchestrator are maintained to support legacy APIs, then backwards compatibility is preserved, but security vulnerabilities and maintenance burden increase
Solution Approach 1:
The patent segments the API gateway functionality into multiple versioned components, each handling specific API versions. This allows the system to maintain multiple API versions in isolated modules rather than maintaining entire orchestrator versions, reducing the security surface area while preserving legacy API access through the segmented gateway architecture.
Solution Approach 2:
The versioned API gateway serves as a mediator that receives requests for deprecated APIs and forwards them to the appropriate isolated guest orchestrator version or simulates the legacy behavior. This eliminates the need to maintain vulnerable legacy orchestrator versions directly, as the gateway handles legacy protocol translation securely.
3Adaptability or versatility
If multiple versions of the isolated guest orchestrator are maintained simultaneously, then access to both legacy and current functionality is enabled, but system complexity and resource consumption increase
Solution Approach 1:
The patent implements lightweight copies of orchestrator functionality within the API gateway rather than maintaining full orchestrator instances for each version. The gateway contains simplified versioned handlers that replicate only the necessary API processing logic for each version, dramatically reducing the resource footprint compared to running multiple full orchestrator instances.
4Reliability
If deprecated APIs are removed from the current version of the orchestrator, then codebase is simplified and security is improved, but existing applications dependent on those APIs break
Solution Approach 1:
The versioned API gateway acts as a compatibility layer that intercepts requests using deprecated APIs and translates them to the current orchestrator API format. This allows the orchestrator to remove deprecated APIs from its codebase for security simplification while the gateway maintains compatibility with existing applications by handling the translation transparently.
Data Source
AI summary
Secure backwards compatible orchestration of isolated guests is disclosed. For example, a current version of an isolated guest orchestrator instantiates an older version of the isolated guest orchestrator in a host as a dependent compute service. An application programming interface request is received. The application programming interface request is determined to be unsupported by the current version of the isolated guest orchestrator. The application programming interface request is sent to the dependent compute service. The application programming interface request is responded to based on a response from the dependent compute service.