Centralized Security Controller for Serverless Microservices

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Serverless applications face security challenges due to their complex, decentralized nature, particularly in ensuring consistent input validation, data sanitization, and authorization across multiple languages and frameworks, as well as visibility into data ingress and egress activities.

Innovation Solution

A centralized security controller is introduced to handle security operations for microservices-based and serverless applications, outsourcing security features and functionalities from individual microservices or serverless functions, allowing for standardized security management and easy updates across diverse programming languages and frameworks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If security operations are implemented in each individual microservice or serverless function, then security coverage is comprehensive, but device complexity and difficulty of management increase significantly

Engineering Contradiction:

Improvesecurity coverageVSAvoidmanagement complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent merges security operations from multiple分散 microservices and serverless functions into a single centralized security controller. This consolidation maintains comprehensive security coverage while significantly reducing management complexity by providing a unified interface and centralized control plane for all security operations across the distributed system.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The centralized security controller provides universal security operations that can serve multiple microservices and serverless functions simultaneously. A single security controller instance handles authentication, authorization, input validation, and other security functions for the entire application, eliminating the need for each component to implement its own security logic.

Inventive Principle:

Principle #6Universality (Multi-functionality)

2Adaptability or versatility

If security features are embedded in each microservice using different languages and frameworks, then language-specific security needs are met, but consistency and ease of updates deteriorate

Engineering Contradiction:

Improvelanguage compatibilityVSAvoidconsistency of security management

Core Design Contradiction:

Adaptability or versatilityVSEase of operation

Solution Approach 1:

The centralized security controller acts as an intermediary between diverse microservices written in different languages and frameworks and the underlying security operations. It provides a language-agnostic interface that maintains consistency across the entire system while allowing each microservice to continue using its preferred programming language and framework without compromising security uniformity.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

Instead of each microservice implementing security features in its own language and framework (bottom-up approach), the patent inverts the architecture by having a centralized security controller provide security operations to all microservices (top-down approach). This ensures consistency and makes updates easier while still supporting diverse programming languages through the centralized controller's multi-language capabilities.

Inventive Principle:

Principle #13The other way round (Inversion)

3Ease of operation

If security operations are distributed across multiple components, then security functionality is available locally, but visibility and control over security operations decrease

Engineering Contradiction:

Improvelocal security functionalityVSAvoidvisibility of security operations

Core Design Contradiction:

Ease of operationVSLoss of information

Solution Approach 1:

The centralized security controller implements feedback mechanisms that collect information from all security operations performed on behalf of different microservices. This feedback loop provides comprehensive visibility into security operations across the entire system, allowing operators to monitor and control security activities centrally while maintaining local functionality through the distributed nature of the controller's operations.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS11182474B2Common serverless security API

Publication Date: 2021.11.23 VMWARE INC

AI summary

System and method for executing a security operation for microservices/serverless function of a microservices-based/serverless application running on a physical infrastructure use a central security controller to execute the security operation for different microservices/serverless functions of the microservices-based/serverless application. Requests for the security operation are transmitted to the central security controller when communications are received at the different microservices/serverless functions of the microservices-based/serverless application. Results of the security operation are then received from the central security controller at the different microservices/serverless functions of the microservices-based/serverless application. Based on the results of the security operation, a task associated with the communications is executed at the different microservices/serverless functions.