Decentralized Authorization Microservice Containers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributed computing architectures face challenges in achieving low latency and high scalability while ensuring robust security through multi-layered user authentication and authorization, as centralized authorization services create bottlenecks and limit system performance.
Innovation Solution
A decentralized authorization system using microservice containers that evaluate user access requests with locally-provided policy management and key-based validation of tokenized access requests, eliminating the need for a centralized authorization service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If centralized authorization service is used to ensure robust security, then security is improved, but system latency increases and scalability is limited
Solution Approach 1:
The centralized authorization service is segmented into distributed authorization logic embedded within individual microservice containers. Each microservice container becomes an independent authorization decision point, eliminating the single-point bottleneck and reducing latency while maintaining security through localized policy enforcement.
Solution Approach 2:
The authorization architecture transitions from a vertical centralized model to a horizontal distributed model across multiple microservice containers. This dimensional shift allows parallel authorization processing across multiple nodes, reducing system latency while maintaining robust security through replicated policy enforcement.
2Reliability
If centralized authorization service is used to validate user access requests, then security is improved, but service scalability is limited
Solution Approach 1:
The monolithic centralized authorization service is segmented into distributed authorization capabilities across multiple microservice containers. Each container independently validates user access requests using locally cached policy information, enabling the system to scale horizontally by simply adding more container instances without increasing central service capacity.
Solution Approach 2:
Each microservice container becomes self-sufficient in handling authorization decisions through local policy caching and validation logic. This self-service capability eliminates the need for every authorization request to traverse the centralized service, enabling independent scaling of individual microservices without being constrained by central service capacity.
3Reliability
If multi-layered user authentication and authorization is implemented, then security is improved, but processing speed decreases
Solution Approach 1:
User policy information and authorization rules are preliminarily cached within each microservice container during container initialization or through periodic updates. This preliminary action eliminates the need for real-time centralized policy retrieval during user access requests, maintaining multi-layered security validation while significantly improving processing speed through localized decision-making.
Data Source
AI summary
Methods and apparatuses are described for decentralized authorization of user access requests in a distributed service architecture. A gateway node receives a user access request from a remote computing device. The gateway generates a signed and encrypted access token based upon the user access request using an authorization service node and a key management service node. The gateway transmits the access token, the user access request, and a security certificate received from the authorization service to a security proxy node of a microservice container. The security proxy validates the certificate and the access token. The security proxy decrypts the access token using a public key from the certificate, and determines user authorization to access a service endpoint node based upon the decrypted token. The security proxy transmits the user access request to the service endpoint, which provides the remote device with access to services based upon the user access request.