Key Rotation via Resource Object Mediator
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In digital signature-based authentication systems for Internet services, there is a risk of multiple keys being generated simultaneously across different key managers, leading to inconsistencies and potential race conditions, especially in load-balanced environments where key agents may retrieve keys from different key managers, resulting in different new keys being generated.
Innovation Solution
Implementing a key service platform that uses a resource object to govern key generation, allowing only one key manager to generate a new key at a time, with synchronization across multiple key store databases to ensure consistency, and utilizing a cluster network database to maintain synchronized key storage across all key store databases.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple key managers operate independently in a load-balanced environment, then system availability and load distribution are improved, but key consistency and race condition prevention deteriorate
Solution Approach 1:
The patent introduces a resource object as an intermediary between key managers and key store databases. This resource object acts as a mediator that coordinates key generation operations across multiple key managers, ensuring that only one key manager can generate a key at a time while still allowing multiple key managers to serve requests in a load-balanced environment.
Solution Approach 2:
The patent implements preliminary action by requiring key managers to acquire a resource object before performing key generation operations. This preliminary acquisition step ensures that the system establishes proper synchronization and ordering of key generation operations before the actual key creation occurs, preventing race conditions while maintaining system availability.
2Speed
If key generation is allowed simultaneously across multiple key managers, then processing speed is improved, but key uniqueness and consistency deteriorate
Solution Approach 1:
The patent implements periodic action through the use of resource object acquisition and release cycles. Key managers periodically attempt to acquire the resource object when key generation is needed, and release it after completion. This periodic acquire-release pattern allows multiple key managers to operate in parallel while ensuring sequential key generation, maintaining both speed and consistency.
Solution Approach 2:
The resource object serves as an intermediary that controls the timing and ordering of key generation operations. It allows the system to maintain high processing speed by enabling multiple key managers to be ready and responsive, while simultaneously ensuring key consistency by mediating access to the key generation process in a controlled, sequential manner.
Data Source
AI summary
A method, a device, and a non-transitory storage medium are provided to generate and transmit a request to obtain a resource object stored in a clustered network database that stores keys; determine based on a value of the resource object carried in a response, whether permission to update the keys is permitted, wherein a first value of the resource object grants permission and a second value of the resource object does not grant permission; determine whether any of the keys expired in response to receiving permission, wherein other network devices configured to update the keys are prevented from updating the keys while the network device is granted permission; generate a new key for each key of the keys that expired; and store the new key for each key; and release the resource object back to the clustered network database.