Cache Service for Secrets in Containerized Cloud Systems

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Cloud-computing systems face challenges in providing low-latency and high-throughput access to secrets while maintaining isolation and granulated access controls in a multi-tenant environment, due to the geographical distance of master stores from requesting applications and the potential overload of master stores.

Innovation Solution

A cache service acts as a proxy, validating and authenticating requests for secrets, and providing access to copies of secrets stored in a cache storage closer to requesting applications. The cache service operates as either a cluster-level service or a sidecar service, ensuring strong authentication and authorization enforcement and reducing the load on master stores.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If secrets are stored in master stores located far from requesting applications, then security and centralized control are improved, but access latency increases

Engineering Contradiction:

ImprovesecurityVSAvoidaccess latency

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The cache service pre-loads and stores copies of secrets in cache storage locations that are geographically closer to requesting applications. This preliminary action allows the system to maintain centralized security control through master stores while providing fast local access through caches, resolving the contradiction between security centralization and access speed.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The cache service acts as an intermediary between master stores and requesting applications. It receives requests from applications, validates them against access control policies, and retrieves secrets from either cache storage or master stores. This intermediary layer maintains security enforcement while enabling low-latency access through localized caching.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If all secret access requests are routed to centralized master stores, then access control enforcement is improved, but system throughput decreases due to master store overload

Engineering Contradiction:

Improveaccess control enforcementVSAvoidsystem throughput

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system segments secret storage and access into multiple components: master stores for centralized security policy enforcement and cache services distributed closer to applications. This segmentation allows access control decisions to be made locally at cache services based on pre-loaded policies, while master stores handle only policy updates and cache invalidation, thereby increasing system throughput without compromising control enforcement.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Access control policies are pre-loaded into cache services from master stores. This preliminary action enables cache services to independently validate access requests without constantly querying master stores, significantly reducing the load on master stores and increasing overall system throughput while maintaining strict access control enforcement.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If cache services are deployed as sidecar services with each application, then security isolation is improved, but system complexity increases

Engineering Contradiction:

Improvesecurity isolationVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system allows cache services to be deployed with local quality - as sidecar services when strong security isolation is required, or as centralized cluster-level services when easier management is prioritized. This flexibility enables the system to adapt the deployment model to specific security and operational requirements without imposing a single complex architecture on all scenarios.

Inventive Principle:

Principle #3Local quality

4Speed

If multiple copies of secrets are stored in cache storage closer to applications, then access speed is improved, but storage requirements increase

Engineering Contradiction:

Improveaccess speedVSAvoidstorage capacity

Core Design Contradiction:

SpeedVSQuantity of substance

Solution Approach 1:

The system creates copies of secrets in cache storage locations distributed closer to requesting applications. These copies enable fast local access without requiring applications to maintain their own secret copies. The cache service manages the copying process and ensures that master stores remain the authoritative source, balancing access speed improvements with controlled storage duplication.

Inventive Principle:

Principle #26Copying

Data Source

PatentUS20250117339A1Cache service for providing access to secrets in containerized cloud-computing environment

Publication Date: 2025.04.10 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

A cache service provides applications in a containerized, multi-tenant cloud-computing system low-latency access to secrets. The cache service may operate as a cluster-level service or a sidecar service. The cache service may store copies of secrets (which are located in one or more absolute stores) in a cache storage. The cache service and the cache storage may be closer to the applications than the one or more absolute stores are to the applications. The cache service may aggregate secrets associated with multiple entities in a single cache storage. The cache service may support isolation between secrets such that secrets of a first entity are isolated from secrets of a second entity. The cache service may enforce granulated access controls such that it can apply different access controls to secrets of a first entity than to secrets of a second entity.