Proxy Server Authentication for Multi-Tenant Database Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In massive multi-tenant database systems, user device authentication introduces security risks and inefficiencies due to the need for each application server to perform mutual transport layer security (mTLS) processes, leading to redundancy and latency issues.
Innovation Solution
Implementing a proxy server that performs user device authentication using certificate challenges and mTLS, allowing authorized devices to access the application server directly without tunneling further traffic through the proxy, thereby reducing server overhead and latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user device authentication is performed at each application server using mTLS, then security is improved, but system overhead and latency increase
Solution Approach 1:
The patent introduces a proxy server as an intermediary between user devices and application servers. The proxy server performs mTLS authentication with user devices, validating their certificates. Once authenticated, the proxy server establishes a persistent connection with the application server, allowing multiple user requests to pass through without requiring the application server to perform repeated authentication. This mediator approach maintains high security while significantly reducing the computational overhead on application servers.
2Reliability
If user device authentication is performed at each application server, then security is improved, but latency increases
Solution Approach 1:
The patent implements preliminary authentication by performing mTLS certificate validation at the proxy server before requests reach the application server. The proxy server pre-establishes trusted connections with authenticated user devices and maintains persistent connections with application servers. This preliminary action ensures that when requests are forwarded, the authentication work has already been completed, eliminating repeated authentication latency for each request while maintaining security.
3Reliability
If multiple application servers perform mTLS processes, then security is maintained, but redundancy increases
Solution Approach 1:
The patent makes the proxy server a universal authentication point that serves multiple application servers. Instead of each application server independently performing mTLS with user devices, the proxy server performs the authentication once and then routes authenticated requests to any of multiple application servers. This multi-functional approach maintains security across the entire system while eliminating redundant authentication processes, as the same proxy server handles authentication for all application servers in the cluster.
Data Source
AI summary
Methods, systems, and devices for user device authentication are described. In some systems, an application server may host a secure application utilizing user device verification. A proxy server may perform a certificate challenge with a user device to determine whether the user device is authorized to access the application, and may transmit a login request and authentication information to the application server based on the result of the challenge. The application server may determine whether the certificate challenge was successful, and may verify whether the proxy server is a valid proxy for the application. If these validations are successful, the application server may transmit an authorization message (e.g., an encrypted ticket) to the user device for a login procedure. The user device may send a login request with the authorization message directly to the application server (e.g., without further tunneling through the proxy) to initiate a login procedure.