Multi-Cluster Service Request Authorization with Dependency Matrices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-cluster systems, the existing authorization process for service requests degrades the quality of service by requiring independent authorization checks at each micro-service level, leading to compute time wastage, excessive memory usage, and network bandwidth consumption, along with response delays.
Innovation Solution
A centralized ingress module compiles and shares a dependency chain matrix across all service endpoints, generating a label for each request, which is validated by the ingress module, thereby reducing redundant authorization checks across the system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If independent authorization checks are performed at each micro-service level, then service security is maintained, but compute time is wasted and response delays occur
Solution Approach 1:
The system performs preliminary authorization by compiling dependency chain matrices and generating authorization labels in advance. The ingress module validates service requests against pre-computed authorization data before routing to microservices, eliminating the need for repeated authorization checks at each service level while maintaining security.
2Reliability
If independent authorization checks are performed at each micro-service level, then service security is maintained, but excessive memory usage occurs
Solution Approach 1:
The system merges authorization logic into a centralized ingress module that uses pre-computed dependency chain matrices. Instead of each microservice maintaining its own authorization data and checks, the authorization functionality is consolidated and shared across all services through the ingress module, reducing overall memory consumption.
3Reliability
If independent authorization checks are performed at each micro-service level, then service security is maintained, but network bandwidth is consumed excessively
Solution Approach 1:
The system extracts the authorization check process from the microservice communication path and relocates it to the ingress module. Service requests are validated for authorization before being routed to microservices, removing redundant authorization communication overhead from the service-to-service interaction network and reducing bandwidth consumption.
4Productivity
If centralized authorization validation is implemented, then compute resources are optimized, but system complexity increases
Solution Approach 1:
The system introduces an intermediary dependency chain matrix that bridges the centralized ingress module and distributed microservices. This matrix pre-computes authorization relationships between services, allowing the ingress module to make fast authorization decisions without complex real-time calculations, thus optimizing compute resources while managing system complexity through structured data representation.
Data Source
AI summary
A method includes receiving a dependency chain matrix from each of a plurality of service end points in a multi-cluster system converging the received dependency chain matrices into a converged data matrix, sharing the converged data matrix as a side car module to each of the plurality of service end points, receiving a service request by an external user or service for at least one of the plurality of service end points, validating an authorization for the service request based on the converged data matrix, and generating a label that is appended to the service request and passed downstream to the plurality of service end points.