Communication Relay Device NAPT for Microservice IP Authentication

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In microservice infrastructure with NFV applications, communication from a radius server to a facing node does not pass through the load balancer, leading to IP address mismatch issues that can cause authentication failures, particularly in radius authentication where IP authentication is required.

Innovation Solution

A communication relay device with a forward relay unit to distribute requests from facing nodes to server groups and a backward relay unit to perform Network Address Port Translation (NAPT) on requests from the microservice to the facing node, ensuring responses are routed back through the load balancer, thus aligning IP addresses and satisfying IP authentication requirements.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If communication from microservice to facing node is directly transmitted from server cluster to facing node without passing through load balancer, then communication path is simplified and direct, but IP address mismatch occurs causing authentication failure

Engineering Contradiction:

Improvecommunication efficiencyVSAvoidauthentication success rate

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The load balancer serves as an intermediary device between the server cluster and facing nodes. When a microservice needs to communicate with a facing node, the load balancer receives the request, performs NAPT to translate the source IP address from the microservice's IP to the load balancer's IP, and then forwards the request to the facing node. This ensures the facing node receives requests from an expected IP address (load balancer's IP) rather than the microservice's internal IP, thus maintaining authentication success while still enabling communication.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If load balancer performs NAPT on request from microservice to facing node, then IP address alignment is achieved for authentication, but device complexity increases

Engineering Contradiction:

ImproveIP authentication complianceVSAvoidload balancer functionality

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The load balancer, which already exists in the microservice infrastructure for distributing requests from facing nodes to server groups, is extended to perform additional functions. Specifically, it now also handles requests from microservices to facing nodes by performing NAPT and routing these reverse-direction requests. This multi-functionality approach allows the same device to serve both forward proxy and reverse proxy roles, achieving IP authentication compliance without adding separate dedicated devices, thus limiting the increase in device complexity.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS11799685B2Communication relay device, communication relay system, communication relay method, and program

Publication Date: 2023.10.24 NIPPON TELEGRAPH & TELEPHONE CORP

AI summary

There are provided a forward relay unit (31) configured to distribute a request from a radius client (1) which is a facing node of a microservice to the microservice to one of servers (5a and 5b) accommodating the microservice; anda backward relay unit (34) configured to perform NAPT on a request from the microservice to an address band of the facing node, and return a response from the facing node to the request to the microservice in a reverse order of a path along which the request has passed. Accordingly, in a microservice infrastructure on which an NFV application requiring IP authentication is mounted, it is possible to satisfy a requirement of an application of a request transmitted from a microservice to a facing node.