Edge-Node Authentication for Serverless Microservices

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Serverless architectures face challenges in managing authentication for numerous microservices, leading to increased costs due to malicious activities and inefficient resource utilization, as each node requires specific authentication mechanisms and can be targets for DOS attacks.

Innovation Solution

The implementation of an authentication node that parses code to identify validation parameters, traces routes to determine connectivity between nodes, and creates an authentication node to analyze requests and control access to microservices, thereby reducing unnecessary resource instantiation and malicious activity costs.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If authentication is handled at each serverless node individually, then each node can have specific authentication mechanisms, but the system becomes vulnerable to DOS attacks and incurs unnecessary costs from malicious activities

Engineering Contradiction:

Improveauthentication mechanism flexibilityVSAvoidDOS attack vulnerability

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces an authentication gateway as an intermediary component that sits between external requests and serverless nodes. This gateway consolidates authentication logic and validation parameters, acting as a protective barrier that filters malicious requests before they can reach individual nodes. The gateway maintains adaptability by allowing different validation parameters for different nodes while providing centralized control to prevent DOS attacks.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The authentication system is segmented into distinct components: the authentication gateway, validation parameters stored in data structures, and individual serverless nodes. Each node can have its own specific validation requirements stored in parsed data structures, while the gateway handles the actual authentication. This segmentation allows flexible per-node authentication while maintaining system-wide security control.

Inventive Principle:

Principle #1Segmentation

2Reliability

If authentication settings are updated at the firewall, then robust protection is achieved, but the ramp-up time and developer effort increase significantly

Engineering Contradiction:

Improveauthentication protectionVSAvoidauthentication update time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The authentication system is designed to be dynamic rather than static. Validation parameters for each node are stored in parseable data structures (such as JSON or YAML files) that can be automatically reloaded and applied without requiring firewall reconfiguration or system restarts. When authentication requirements change, the gateway can parse new parameter files and update its behavior immediately, providing both robust protection and rapid adaptability.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The authentication gateway automatically manages its own configuration by parsing validation parameters from data structures. Instead of requiring manual firewall updates or developer intervention, the system can self-update authentication settings by loading new parameter definitions from files or configuration sources, significantly reducing the time and effort required to update authentication policies.

Inventive Principle:

Principle #25Self-service

3Adaptability or versatility

If serverless functions are spun up frequently to meet authentication needs, then specific authentication requirements are met, but network costs increase due to malicious activity

Engineering Contradiction:

Improveauthentication requirement fulfillmentVSAvoidnetwork cost

Core Design Contradiction:

Adaptability or versatilityVSLoss of energy

Solution Approach 1:

The authentication gateway performs preliminary authentication and validation checks before serverless functions are spun up. By validating requests upfront against stored validation parameters and determining which nodes should be activated, the system avoids spinning up functions for malicious or invalid requests. This preliminary action ensures that resources are only allocated to legitimate operations, reducing unnecessary costs while maintaining the ability to fulfill specific authentication requirements.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements feedback mechanisms where the authentication gateway monitors request patterns, validation outcomes, and node activation status. This feedback allows the system to learn from past authentication events and optimize resource allocation. By analyzing feedback from validation determinations, the gateway can identify and block malicious patterns, adjusting its behavior to prevent future unnecessary function spin-ups and cost accumulation.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS11218486B2Edge-node authentication for functions as a service

Publication Date: 2022.01.04 AT&T INTELLECTUAL PROPERTY I L P

AI summary

A method includes identifying a first validation parameter of a first network node and a second validation parameter of a second network node. The method includes creating an authentication node based on the first and second validation parameters. The method also includes receiving a request to access a microservice that utilizes the first network node and the second network node. The authentication node analyzes the request to make a validation determination indicative of whether the request satisfies the first and second validation parameters and controls access to the microservice based on the validation determination.