Proxy Service for Secure Remote Service Invocation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In distributed computing systems, invoking services with dependencies across multiple nodes can be inefficient and insecure, particularly when using Secure Shell Protocol (SSH) connections, which may require user interaction and are vulnerable to exploitation.

Innovation Solution

Implementing proxy services that act as intermediaries between local and remote services, allowing controllers on different nodes to connect via an API and automatically invoke or manage remote services without the need for direct SSH connections.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If SSH connections are used to invoke services across nodes, then service invocation is enabled, but user interaction is required and security vulnerabilities exist

Engineering Contradiction:

Improveservice invocationVSAvoiduser interaction

Core Design Contradiction:

Ease of operationVSExtent of automation

Solution Approach 1:

The patent introduces a proxy service as an intermediary component that mediates between services on different nodes. The proxy service automatically establishes connections and invokes remote services without requiring direct user interaction or SSH access, thereby resolving the contradiction between enabling service invocation and eliminating user interaction requirements

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If SSH connections are used for service invocation, then remote service access is enabled, but security exploitation risks increase

Engineering Contradiction:

Improveremote service accessVSAvoidsecurity exploitation

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The proxy service acts as a secure intermediary that encapsulates the service invocation logic. It establishes controlled connections through a centralized management system, eliminating the need for direct SSH access and reducing security exploitation risks while maintaining remote service access capability

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent extracts the service invocation functionality from direct node-to-node SSH connections and relocates it to a centralized proxy service layer. This separation removes the harmful direct connection aspect while preserving the useful remote access capability

Inventive Principle:

Principle #2Taking out (Extraction)

3Device complexity

If direct node connections are used, then service invocation is straightforward, but system complexity and security surface increase

Engineering Contradiction:

Improveconnection mechanismVSAvoidsecurity surface

Core Design Contradiction:

Device complexityVSObject-affected harmful factors

Solution Approach 1:

The proxy service introduces a centralized intermediary layer that simplifies the connection mechanism between services on different nodes. Instead of direct complex SSH connections, services communicate through the proxy, reducing the security surface by eliminating direct node access requirements

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12335352B2Using proxy services for dependencies in distributed computing systems

Publication Date: 2025.06.17 RED HAT LLC

AI summary

A method includes intercepting, by a proxy service running on a first node of a distributed computing system, a first request for a first service running on the first node; determining, by the proxy service, that the first service is dependent on a second service running on a second node of the distributed computing system; responsive to determining that the first service is dependent on the second service, invoking, by the proxy service, the second service running on the second node; receiving, by the proxy service, a first response from the second service; and transmitting, by the proxy service, to the first service, the first response received from the second service.