LDAP Security Domain Access System Availability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current certificate systems face limitations in processing security domain requests when the domain manager is offline or when users lack credentials, leading to bottlenecks and restricted access to topology data, which affects the management and availability of security domain information.
Innovation Solution
Implementing a Security Domain Access System (SDAS) that selects available domain managers based on credentials and availability, using an LDAP-based database for managing security domain data and replicating changes across multiple domain managers, and employing a load balancer for failover support to ensure high availability and automated management of security domain information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single domain manager is used to manage security domain data, then the system structure is simple, but the system availability decreases when the domain manager is offline
Solution Approach 1:
The patent implements multiple domain managers that replicate the functionality of a single domain manager. Each domain manager maintains a copy of the security domain data in an LDAP-based database, allowing the system to continue operating even when one domain manager is offline. This copying approach resolves the contradiction by providing redundancy without significantly increasing structural complexity.
Solution Approach 2:
The patent divides the domain manager functionality into separate, independent domain manager instances. Each domain manager can operate autonomously and manages its own LDAP database, enabling failover when one instance becomes unavailable. This segmentation allows the system to maintain availability while keeping each individual component relatively simple.
2Ease of operation
If the root CA subsystem processes all security domain requests, then the authorization control is centralized, but the system productivity decreases due to heavy load
Solution Approach 1:
The patent segments the request processing workload across multiple domain managers instead of concentrating it at the root CA subsystem. Each domain manager independently processes security domain requests for its portion of the data, distributing the load and increasing overall system productivity while maintaining centralized authorization control through the security domain framework.
Solution Approach 2:
The patent introduces multiple domain managers as intermediary components between clients and the root CA subsystem. These intermediaries handle routine request processing locally, reducing the burden on the root CA subsystem and enabling parallel processing of requests across different domain managers.
3Reliability
If only system administrators with credentials can access the domain manager, then the security is enhanced, but the ease of operation decreases for users without credentials
Solution Approach 1:
The patent creates multiple domain managers with identical access control mechanisms, so that users without root CA credentials can access any of the domain managers independently. This copying approach maintains security through credential verification while improving ease of operation by providing multiple access points, eliminating the need for users to know which specific domain manager to contact.
Solution Approach 2:
The patent makes each domain manager universally accessible to authenticated users, allowing any user with valid credentials for any domain manager to access security domain data. This multi-functionality approach enhances both security through consistent authentication requirements and ease of operation through uniform access patterns across all domain managers.
4Stability of the object's composition
If the domain manager processes all registration requests sequentially, then the data consistency is maintained, but the loss of time increases during registration
Solution Approach 1:
The patent segments the registration request processing across multiple domain managers that operate in parallel. Each domain manager independently processes registration requests for its assigned data, maintaining data consistency through LDAP database transactions while significantly reducing the overall registration time compared to sequential processing.
Solution Approach 2:
The patent enables continuous registration processing across multiple domain managers simultaneously rather than sequentially. Registration requests are distributed to available domain managers that can process them concurrently, maintaining data consistency through proper transaction management while eliminating idle waiting time between sequential operations.
Data Source
AI summary
A Security Domain Access System (SDAS) provides highly available security domain data. The SDAS receives a request pertaining to a security domain. The request includes credentials for accessing a security domain manager server. The SDAS selects one of a plurality of security domain manager servers to process the request based on the credentials and the availability of each of the plurality of security domain manager servers. The SDAS forwards the request to the selected security domain manager server.