Cross-Shard User ID Lookup for Unified Cloud Identity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud service providers face challenges in integrating separate identity management systems for Infrastructure-as-a-Service (IaaS) and Software-as-a-Service/Platform-as-a-Service (SaaS/PaaS) due to differences in authentication and authorization frameworks, leading to fragmented user experiences and obstacles in service interactions.
Innovation Solution
An Integrated Identity Management System (IIMS) is introduced, merging attribute-based access control (ABAC) and role-based access control (RBAC) systems by distributing authentication data across identity data shards, using a domain-to-shard mapping to facilitate seamless access management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If separate identity management systems are used for IaaS and SaaS/PaaS, then each system can be optimized independently, but the systems become fragmented and integration becomes difficult
Solution Approach 1:
The patent merges ABAC and RBAC authentication systems into a unified identity management platform. The system integrates attribute-based access control (ABAC) and role-based access control (RBAC) into a single coherent framework, allowing both IaaS and SaaS/PaaS to share common authentication infrastructure while maintaining service-specific optimization capabilities.
Solution Approach 2:
The unified identity management system provides universal authentication capabilities across diverse cloud services. The system handles multiple authentication types (ABAC, RBAC, OAuth 2.0, SAML) and serves both IaaS and SaaS/PaaS workloads through a single platform, eliminating the need for separate identity management systems.
2Productivity
If authentication data is distributed across multiple shards, then system scalability is improved, but the complexity of data management increases
Solution Approach 1:
The patent segments authentication data into multiple identity data shards distributed across different fleets. Each fleet manages a portion of the authentication data, allowing the system to scale horizontally by adding more fleets and shards as needed, rather than requiring a single monolithic data store.
Solution Approach 2:
The patent introduces a domain-to-shard mapping mechanism that acts as an intermediary layer between authentication requests and the distributed data stores. This mapping system translates domain identifiers into specific shard locations, simplifying data access and management while maintaining the benefits of distributed storage.
3Ease of operation
If a unified identity management system is created, then user experience is improved with single sign-on, but the system must handle significantly larger user volumes
Solution Approach 1:
The system segments the large user base into manageable identity data shards, each handled by specific fleets. This segmentation allows the unified system to accommodate hundreds of millions of users across millions of groups by distributing the computational and storage burden across multiple independent units.
Solution Approach 2:
The patent introduces a hierarchical dimension to user management by organizing users into domains, groups, and individuals across multiple fleets. This multi-dimensional organization (user → group → domain → fleet) enables efficient management of large user volumes while maintaining single sign-on capability across the entire system.
Data Source
AI summary
A host computing device may receive a request to authorize an entity, the authorization request comprising an entity tag. The host may send a domain request, containing an entity tag, for a domain tag to a first fleet. The host may receive the domain tag from the first fleet and store the domain tag in a cache memory. The host may identify a data stripe tag, stored in a host database, associated with the domain tag. The host may send a fleet request for a fleet tag, with the data stripe tag, to a second fleet. The host may receive the fleet tag. The host may send an information request for a plurality of authentication information to an identified fleet associated with the fleet tag. The host may receive the plurality of authentication information. The host may determine whether to authorize the entity based on the authentication information.