Central Authentication and Authorization for Microservices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Microservice architecture faces challenges in authentication and authorization, requiring significant overhead and vulnerability to security breaches due to individual microservices handling credentials, and existing centralized solutions are insecure.
Innovation Solution
Implement a centralized validation module that interfaces with external identity providers to manage authentication and authorization for microservices, generating internal requests and validating them before executing operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If each microservice executes individual authentication and authorization, then security is improved, but device complexity and overhead increase significantly
Solution Approach 1:
The patent extracts the authentication and authorization functionality from individual microservices and places it in a separate centralized validation module. This allows each microservice to focus on its core business logic while the validation module handles security checks, reducing microservice complexity while maintaining security.
Solution Approach 2:
The patent introduces a centralized validation module as an intermediary between external requests and microservices. This mediator handles all authentication and authorization operations, preventing microservices from directly managing credentials and reducing their complexity.
2Device complexity
If a single module performs initial authentication and authorization, then device complexity is reduced, but reliability decreases due to security vulnerabilities
Solution Approach 1:
The patent segments the validation process into two distinct parts: initial authentication/authorization by the centralized validation module, and subsequent validation by each microservice. This segmentation maintains security by ensuring multiple validation points while keeping the system manageable.
Solution Approach 2:
The patent implements a feedback mechanism where the centralized validation module provides authentication and authorization information to microservices, and microservices validate this information in return. This mutual validation ensures security while distributing the validation responsibility.
3Device complexity
If centralized validation module is implemented, then device complexity of microservices is reduced, but productivity decreases due to additional validation steps
Solution Approach 1:
The patent performs authentication and authorization in advance through the centralized validation module before requests reach microservices. This preliminary action ensures that security checks are completed once at the beginning, avoiding repeated validation overhead during microservice processing.
Data Source
AI summary
Methods and systems use a central validation module of a microservice-based system to interface an external identity provider (IDP) among a plurality of external IDPs to receive authentication and/or authorization information for an external request from a client. After the authentication and/or authorization information has been received for the external request, an internal request containing the authentication and/or authorization information is generated by the central validation module, which is transmitted to at least one microservice of the microservice-based system to provide services in response to the external request. The internal request is validated with the central validation module by each of the at least one microservice, which executes at least one operation to provide the services. A response that is based at least partly on results of the services provided by the at least one microservice is returned for the external request to the client.