Non-persistent Shared Authentication Tokens in Cluster Nodes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributed file systems face high resource overhead in large-scale implementations due to the need to validate previously authenticated users across all nodes in a cluster, as existing solutions require maintaining a shared file of valid tokens, leading to taxing computational costs.
Innovation Solution
A system where a current encryption key and active past encryption keys, associated with expiration timestamps, are maintained across nodes, allowing any node to decrypt and validate tokens efficiently, eliminating the need for a persistent store of valid tokens and reducing computational costs through fast lookup and verification of decrypted name-value pairs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a shared file of valid tokens is maintained across all nodes, then token validation can be performed, but resource consumption and computational overhead increase significantly
Solution Approach 1:
The patent extracts the token validation function from the shared file system and relocates it to individual node memory. Each node maintains its own copy of the token validation logic and data structures, eliminating the need for a centralized shared file. This extraction reduces the computational overhead associated with file I/O operations and enables faster, more efficient token validation across the distributed system.
2Reliability
If a shared file of valid tokens is maintained across all nodes, then token validation can be performed, but computational overhead increases due to table lookups
Solution Approach 1:
The patent segments the token validation function across individual nodes rather than concentrating it in a shared file. Each node maintains its own validation logic and data structures locally, dividing the computational workload. This segmentation eliminates the need for expensive table lookups in a shared file system and enables parallel processing of validation requests across multiple nodes, significantly reducing overall computational overhead.
3Reliability
If a shared file of valid tokens is maintained, then token validation is possible, but system scalability is limited due to resource taxation
Solution Approach 1:
The patent implements self-service by enabling each node to independently perform token validation using its own local data structures and validation logic. Nodes do not rely on a centralized shared file system, instead serving their own validation needs autonomously. This self-service capability allows the system to scale horizontally by adding more nodes without increasing the burden on a shared resource, as each node operates independently with its own validation capacity.
Data Source
AI summary
Implementations are provided herein for a token to be generated on one node within the cluster of nodes, and then used on any of the nodes to authenticate future client requests that include the token. The basis of the token can be a set of name value pairs that include discriminative information related to the client's user name, access zones, token timestamp, etc. An additional name-value pair or set of pairs can included encryption salt for additional security. The set of name value pairs can then be encrypted, in one implementation, using Advanced Encryption Standard (“AES”) 256 bit key. Each node among the cluster of nodes can have access to the current encryption key. Thus, a single key, or in some implementations, past keys that are still valid, can be used to decrypt received tokens by any node among the cluster of nodes. Once decrypted, the name-value pairs of the decrypted token can be validated. The serialized name-value pairs in the token permit the system to quickly identify and authorize access to the cluster to the token holder. Thus, it can be appreciated that a persistent store of all previously authenticated tokens does not need to be maintained. It can also be appreciated that the process of decrypting and validating the token against can decrease computational costs associated with extensive table lookups.