Distributed Authorization Caching for Cloud Service Scalability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud services face inefficiencies in user authentication and authorization due to high computational overhead, bandwidth issues, and complex key management, particularly with stateless systems relying on cryptographically signed tokens, which can lead to scalability problems and difficulties in revoking access rights.
Innovation Solution
Implementing a location-aware, multilevel in-memory store to cache authentication and authorization data, allowing for quick retrieval and caching of authorization documents across distributed service resources, with session IDs identifying locations and enabling dynamic creation of local resource sections for authorization data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographically signed tokens are used for authentication and authorization in stateless cloud services, then security is improved, but computational overhead increases significantly due to cryptographic operations required for validating tokens at each front end machine
Solution Approach 1:
The patent extracts the cryptographic validation burden from front end machines by removing the need for them to verify signed tokens. Instead, front end machines only need to validate simple session IDs against stored session data, while the authorization token validation is handled separately through a different mechanism that doesn't require cryptographic operations at each front end node.
Solution Approach 2:
The patent introduces session data stored in distributed storage as an intermediary between the authorization token and the front end validation process. The session data acts as a mediator that translates the cryptographic authorization information into a simple session ID that front end machines can validate without performing cryptographic operations.
2Reliability
If cryptographically signed tokens are used for authentication, then authorization security is improved, but key management complexity increases significantly
Solution Approach 1:
The patent extracts the key management burden from the distributed system by centralizing session data storage in a managed distributed storage system. This removes the need for front end machines to store, manage, or share cryptographic keys, eliminating the complex key distribution and rotation management that would be required in a traditional signed token system.
3Reliability
If signed tokens are validated at front end machines, then authorization verification is improved, but scalability deteriorates due to CPU overhead affecting the amount of resources a single front end machine can manage
Solution Approach 1:
The patent extracts the CPU-intensive validation workload from front end machines by replacing cryptographic token verification with simple session ID lookup operations. Front end machines only need to check whether a session ID exists in the distributed storage, which is a lightweight operation that doesn't consume significant CPU resources, thereby improving scalability.
Solution Approach 2:
The patent creates simplified copies of authorization information in the form of session data stored in distributed storage. Instead of validating the original cryptographic tokens at each front end machine, the system uses copies of the authorization state (session data) that can be quickly validated without cryptographic operations.
4Ease of operation
If authorization tokens are used for stateless authentication, then front end machine state management is simplified, but token management complexity increases for clients
Solution Approach 1:
The patent replaces long-lived cryptographic authorization tokens with short-lived session IDs that are inexpensive to generate and validate. Session IDs are simple string identifiers that don't require cryptographic processing, making them computationally cheap to create and verify, while their short lifespan (tied to session duration) reduces the management burden on clients.
Data Source
AI summary
One or more techniques and/or systems are disclosed for providing resource authorization to users of a distributed memory store (e.g., a distributed web-based cloud service). A session ID that identifies a location of an authorization document in a distributed memory store is used to access the authorization document, which comprises a global section with a principal ID related to a user. The user can be authorized to utilize a resource (e.g., in a distributed cloud service) if a resource section is present for the principal ID in the authorization document, and has appropriate resource data for the resource. If the resource section is not present, it can be created in the authorization document, and identified by a resource identifier. Authorization data can be loaded into the newly created resource section, and the authorization document, with the global and resource sections, is saved to a local cache for the distributed memory store.