MSA Authentication Tokens with External Payload Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In microservice architecture (MSA) systems, token authentication schemes face issues with increased network load due to large payloads, security vulnerabilities, and the need for extensive maintenance when corrections occur.
Innovation Solution
An MSA-based authentication device that generates and manages authentication tokens without including encrypted payloads, using a key-value storage system to store identifiers and encrypted payloads separately, and verifies tokens through a gateway device to manage authentication centrally.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If token authentication scheme is used in MSA, then authentication can be performed for robot or user, but the transmitted traffic and network load increase due to large payload
Solution Approach 1:
The patent extracts the encrypted payload from the authentication token, storing it separately in a database rather than including it in the token itself. The token only contains an identifier that references the stored payload, thereby reducing the size of transmitted data while maintaining authentication functionality.
Solution Approach 2:
The authentication system is segmented into separate components: the token contains only minimal identification data, while the detailed payload information is stored separately in a database. This segmentation allows the token to remain small for efficient transmission while the full authentication data remains accessible when needed.
2Ease of operation
If payload is directly delivered to client in token authentication scheme, then authentication information is provided, but security is compromised
Solution Approach 1:
The sensitive payload data is extracted from the token and stored securely in a database. The token itself contains only a non-sensitive identifier, preventing security vulnerabilities associated with exposing payload data to clients while still enabling authentication information delivery through controlled access to the stored payload.
3Reliability
If microservices directly identify payload data, then authentication can be performed, but maintenance of all microservices is required when corrections occur
Solution Approach 1:
The patent merges the authentication logic into a centralized service that handles token validation and payload retrieval. Instead of each microservice independently identifying and validating payloads, a single centralized service manages this functionality, reducing maintenance complexity while maintaining authentication reliability.
Solution Approach 2:
A centralized authentication service acts as an intermediary between microservices and the authentication token system. This intermediary handles payload validation and retrieval, eliminating the need for each microservice to implement its own payload identification logic and simplifying overall system maintenance.
Data Source
AI summary
An authentication device based on microservice architecture (MSA) is disclosed. An example device includes a communication interface, storage, and a processor configured to process authentication requests. Upon receiving an authentication request from a client device, the processor determines the target of the request, and communicates with a service corresponding to the target to obtain an encrypted payload. The processor assigns an identifier to the service, stores the encrypted payload along with the identifier, and generates an authentication token based on the identifier. The token is then sent to the client device.