Microservice Access Policy Management via Service-Level Triples
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication methods between microservices in cloud-native platforms generate a large number of access policy entries, leading to reduced query performance and efficiency, especially when the number of microservices is high, and lack refined access control, increasing security risks.
Innovation Solution
A method and device that optimize communication between microservices by determining and managing access policies using triples representing visiting and visited microservices and access ports, reducing the number of access policy entries and enhancing security granularity through a list of triples and access policy management on host machine nodes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access policies are generated for each microservice instance using virtual IP addresses, then communication between microservices can be established, but the number of access policy entries increases significantly when the number of microservices is large, reducing query performance and efficiency
Solution Approach 1:
The patent merges access policies at the microservice level rather than instance level. By generating one access policy per microservice instead of one per instance, it combines multiple instance policies into a single service-level policy, significantly reducing the total number of policy entries while maintaining communication functionality.
Solution Approach 2:
The patent creates universal access policies that apply to all instances of a microservice. A single access policy serves multiple instances simultaneously, making the policy multi-functional and eliminating the need for separate policies for each instance, thereby improving query efficiency.
2Ease of operation
If access policies are generated for each microservice instance, then refined access control can be achieved, but the complexity of managing a large number of access policy entries increases
Solution Approach 1:
The patent merges fine-grained instance-level access control requirements into coarser service-level policies. By operating at the microservice level rather than instance level, it reduces the complexity of policy management while still providing adequate access control for all instances through the unified service policy.
3Adaptability or versatility
If the number of microservices is increased to handle larger business scales, then cloud-native platform elasticity can be better utilized, but the number of access policy entries generated increases, affecting overall system query performance
Solution Approach 1:
The patent merges access policy management at the microservice level to decouple policy quantity from instance quantity. This allows the system to scale horizontally by adding more microservice instances without proportionally increasing the number of access policy entries, thus maintaining query performance while utilizing platform elasticity.
Solution Approach 2:
The patent creates universal access policies that serve multiple instances, allowing the system to scale adaptively. When new instances are added to existing microservices, they automatically inherit the service-level access policy without generating new policy entries, enabling elastic scaling without performance degradation.
Data Source
AI summary
A method for communication between microservices, performed by a first host machine node, includes: obtaining a first microservice instance located on the first host machine node, determining a first microservice to which the first microservice instance belongs, and determining a list of triples corresponding to the first microservice according to the first microservice. The list of triples corresponding to the first microservice includes at least one triple, each triple of the at least one triple includes a visitor of the microservice, a visited party of the microservice, and an access port, and the visitor of the microservice of each triple included in the list of triples corresponding to the first microservice is the first microservice. The method also includes determining, by the first host machine node, an access policy of the first microservice instance according to the list of triples corresponding to the first microservice.