HA Cluster Authentication via OS State-Based Key Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In high availability clusters, the authentication of standby service application processes often takes a long time, causing delays in service continuation, and existing central authentication methods are inefficient, leading to potential security threats and interruptions.
Innovation Solution
A method and communication node with an Operating System (OS) that detects unavailability, switches a standby service application process to a new state, generates a private key using a Private Key Generator (PKG) based on the new state, and ensures secure communications by verifying the authenticity and state of service application processes, preventing malicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a standby service application process is authenticated using existing central authentication methods, then security is ensured, but authentication time increases causing delays in service continuation
Solution Approach 1:
The system performs preliminary actions by having standby service application processes pre-authenticated before actual failover occurs. The authentication credentials and security tokens are prepared in advance, allowing the standby process to immediately assume the active role without undergoing time-consuming authentication procedures during the failover event.
Solution Approach 2:
The invention introduces an intermediary authentication mechanism that mediates between the standby process and the central authentication server. This intermediary layer caches authentication credentials and manages token validation, eliminating the need for real-time communication with the central authentication server during failover, thus reducing authentication time while maintaining security.
2Productivity
If service switching is performed rapidly to maintain high availability, then service continuity is improved, but authentication verification may be insufficient leading to security threats
Solution Approach 1:
Authentication verification is performed in advance before the standby process is activated. Security credentials, digital certificates, and authorization tokens are validated and cached prior to failover, ensuring that when the switch occurs, the authentication is already verified and the process can immediately provide services without compromising security.
Solution Approach 2:
The system creates and validates copies of authentication credentials and security tokens for standby processes. These copied credentials are pre-verified against the central authentication server and stored locally, allowing rapid assumption of the active role while maintaining the integrity and security of the authentication verification through cryptographic validation of the copied credentials.
Data Source
AI summary
A method and communication node for providing secure communications and services in a High Availability (HA) cluster. The communication node comprises an Operating System (OS) that detects an unavailability of a first service application process and switches a second service application process from the first state to the second state, the second service application being selected for taking over service currently provided from the first service application process, the first state and the second state each being associated to a set of rights in the cluster. The OS generates a private key for the second service application process based on its second state. The set of rights associated to the second state allows the OS to replace the first service application process with the second service application process for providing secure communications between the second service application and other service application processes in the HA cluster.