Distributed Authentication for Containerized Microservices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional microservice authentication and authorization processes face challenges in rapid scaling due to authentication resource bottlenecks, making it difficult to efficiently deploy microservices on new host devices.
Innovation Solution
A distributed authentication and authorization system that utilizes a fabric controller to distribute authentication states across virtual network edges (VNEs), allowing VNEs to perform authentication and authorization, thereby alleviating server loads and enabling fast scaling by caching and propagating authentication results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a centralized authentication server is used for microservice authentication, then authentication security is maintained, but authentication server load increases and scaling speed decreases
Solution Approach 1:
The patent segments the centralized authentication server into distributed authentication capabilities across multiple Virtual Network Edge (VNE) devices. Each VNE device obtains and caches authentication states locally, transforming a single-point authentication bottleneck into a distributed authentication network that can handle multiple microservice authentication requests simultaneously without overwhelming a single server.
Solution Approach 2:
The patent implements preliminary authentication by having VNE devices obtain authentication states from the authentication server in advance and cache them locally. This preliminary action allows subsequent microservice authentication requests to be processed using cached credentials, eliminating the need for real-time server authentication and significantly reducing server load while maintaining security.
2Reliability
If authentication is performed for each new microservice deployment, then authentication security is ensured, but deployment time increases
Solution Approach 1:
The system performs preliminary authentication by obtaining authentication states before microservice deployment and caching them at VNE devices. When new microservices are deployed, the VNE devices can quickly validate authentication using cached credentials, ensuring security is maintained while dramatically reducing the time required for authentication during deployment.
Solution Approach 2:
The patent creates and distributes copies of authentication states from the central authentication server to multiple VNE devices across the network. These copied authentication credentials are cached locally at each VNE, enabling fast authentication validation without requiring continuous communication with the original authentication server, thus maintaining security while reducing authentication time.
3Reliability
If authentication states are distributed to multiple VNE devices, then system redundancy increases, but network complexity increases
Solution Approach 1:
The patent makes VNE devices universal by enabling them to perform multiple functions: they act as network edge devices for traffic routing and simultaneously serve as distributed authentication nodes for validating microservice credentials. This multi-functionality reduces the need for separate dedicated authentication infrastructure, thereby increasing redundancy without proportionally increasing overall system complexity.
Data Source
AI summary
The disclosed technology provides solutions for performing rapid authentication and authorization for distributed containerized microservices. In some aspects, a process of the technology can include steps for: associating a service type with a set of microservices or service pods, detecting deployment of a first microservice on a first host, and receiving an authentication and authorization state from a first virtual network edge (VNE) of the first host. In some aspects, the process can further include steps for distributing the authentication state to a second VNE on a second host, wherein the authentication state is configured to facilitate authentication of one or more subsequent microservices instantiated on the second host by the second VNE. Systems and machine readable media are also provided.