Real-Time Identity Resolution Through Local Microservice Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Centralized authentication in big data processing systems becomes a bottleneck as the number of transactions increases, leading to latency and decreased system performance.
Innovation Solution
Decentralize authentication by distributing permissions identifiers to microservices within a distributed computing environment, allowing them to locally authenticate requests based on permissions identifiers generated by an identity provider, reducing reliance on a centralized authenticator.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If centralized authentication is used to validate requests, then security and access control are ensured, but system performance deteriorates and latency increases as the number of transactions grows
Solution Approach 1:
The patent segments the centralized authentication system into distributed authentication capabilities across multiple microservices. Each microservice receives a portion of the user's permissions identifiers and can independently authenticate requests without querying a central authority, thereby distributing the authentication load and eliminating the bottleneck while maintaining security.
Solution Approach 2:
The system performs preliminary authentication by generating and distributing permissions identifiers to microservices before requests arrive. This pre-computation of authentication credentials allows microservices to validate requests locally without real-time communication with a centralized authenticator, reducing latency while ensuring security.
2Reliability
If a centralized authenticator validates every request, then access control is maintained, but system scalability is limited due to the bottleneck effect
Solution Approach 1:
The authentication functionality is segmented from the centralized authenticator and distributed to multiple microservices. Each microservice maintains local authentication capabilities through permissions identifiers, enabling the system to scale horizontally by adding more microservices without increasing the load on a single centralized authenticator.
Solution Approach 2:
Permissions identifiers act as intermediaries between the centralized identity provider and distributed microservices. These identifiers carry the necessary authentication information, allowing microservices to perform local authentication without direct communication with the centralized authenticator, thus enabling scalability while maintaining access control.
3Measurement precision
If microservices query centralized authenticator for each request, then authentication accuracy is ensured, but processing time increases
Solution Approach 1:
The system performs authentication preparation in advance by generating permissions identifiers that contain all necessary authentication information. Microservices can then validate requests locally using these pre-computed identifiers, eliminating the need for real-time queries to the centralized authenticator and thus reducing latency while maintaining authentication accuracy.
Solution Approach 2:
Instead of querying the centralized authenticator for each request, microservices use copied authentication information embedded in permissions identifiers. These identifiers are generated by the identity provider and distributed to microservices, containing the necessary permission data that enables accurate local authentication without repeated central queries.
Data Source
AI summary
The present application discloses a method, system, and computer system for authentication permissions with respect to an action. The method includes receiving, by an identity provider, an indication of a set of capabilities for a plurality of microservices comprised in a distributed computing environment, determining, by the identity provider, a set of permissions for actions permitted for a requesting entity, generating, by the identity provider, a permissions identifier comprising an indication of the set of permissions permitted for the requesting entity, and providing, by the identity provider, the permissions identifier to one or more microservices of the plurality of microservices.