Distributed Cryptographic Microservices for Low-Latency CaaS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Centralized Cryptography as a Service (CaaS) systems are expensive, limited in scalability, and suffer from network latency issues, making them impractical for high-throughput applications in the financial industry.
Innovation Solution
Implementing a decentralized and distributed Cryptography as a Service (D-CaaS) system with microservice applications running locally on application servers, utilizing secure enclaves and cryptographic functions, eliminating the need for constant network access and reducing latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a centralized CaaS system is implemented with large server nodes, then cryptographic service capability is improved, but system cost increases prohibitively
Solution Approach 1:
The patent divides the centralized CaaS system into multiple distributed microservice nodes, each capable of independent cryptographic operations. Instead of relying on a few large expensive server nodes, the system segments functionality across many smaller, more cost-effective nodes that collectively provide the required cryptographic service capability.
Solution Approach 2:
The patent creates multiple copies of the cryptographic microservice application across different nodes in the distributed network. Each node runs an instance of the same cryptographic service, eliminating the need for expensive specialized hardware at each location while maintaining service capability through replication.
2Device complexity
If a centralized CaaS system is deployed, then cryptographic functionality is consolidated, but network latency increases and limits throughput
Solution Approach 1:
The patent segments the centralized cryptographic service into distributed microservice nodes deployed across the network. This segmentation allows cryptographic operations to be performed locally at each node rather than requiring network communication with a centralized service, dramatically reducing latency and increasing throughput.
Solution Approach 2:
Each node in the distributed network runs its own cryptographic microservice application, enabling self-service cryptographic operations without requiring network communication with external services. This eliminates network latency for cryptographic functions while maintaining consolidated security management through the distributed architecture.
3Device complexity
If cryptographic operations are performed remotely via network, then centralized management is achieved, but performance is limited by network access requirements
Solution Approach 1:
The patent segments the cryptographic service into distributed microservice nodes that can operate independently while maintaining centralized management capabilities through standard orchestration mechanisms. This segmentation enables local cryptographic operations that dramatically improve throughput performance while preserving centralized management through the distributed architecture.
Solution Approach 2:
The patent transitions from a single-dimension centralized architecture to a multi-dimensional distributed architecture where cryptographic services operate both locally at each node and can be centrally coordinated. This dimensional change allows simultaneous achievement of high local throughput performance and centralized management capabilities.
Data Source
AI summary
An application server has a custodian application running thereon. The server receives a command to instantiate a cryptographic microservice application on the application server. In response, the server instantiates the cryptographic microservice application. The cryptographic microservice application builds a secure enclave on the application server and, within the secure enclave, a cryptogram that represents a virtual fingerprint of the cryptographic microservice application. The server transmits the cryptogram to an authentication computing system. The server receives a digitally signed certificate from the authentication computing system and a data encryption key encrypted with a master tenant key from the custodian application. The server transmits a request to the authentication computing system. The request includes the digitally signed certificate, the data encryption key, and a request to decrypt the data encryption key. The server then receives the decrypted data encryption key from the authentication computing system.