Application Routing Platform Token Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Multi-tenant database systems face challenges in controlling access to multiple database and application servers, requiring efficient authentication mechanisms to ensure secure and centralized access for users and developers.
Innovation Solution
A system comprising a tenant authentication processor and an application routing processor that generates and verifies signed tokens for access, utilizing OAuth 2 standards and JSON Web Tokens (JWT) to authenticate users and route API calls securely across a distributed application system, thereby streamlining user access without direct authentication by application systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a multi-tenant database system includes multiple database servers and application servers to serve multiple tenants and third-party developers, then the system's functionality and service coverage are improved, but the complexity of controlling access and authenticating users across all servers increases
Solution Approach 1:
The patent introduces an application routing platform as an intermediary between users and multiple application servers. This platform receives API calls, determines the appropriate application server based on routing information, and forwards requests accordingly. This mediator approach allows the system to scale to multiple servers without increasing access control complexity, as authentication is handled separately from routing.
Solution Approach 2:
The system segments access control into distinct components: authentication (handled by tenant systems), routing (handled by the application routing platform), and execution (handled by application servers). This segmentation allows each component to focus on its specific function, reducing overall system complexity while maintaining versatility.
2Reliability
If users must be authenticated for access to database data and platform applications, then system security is improved, but the complexity of managing authentication across multiple tenants and application providers increases
Solution Approach 1:
Tenant systems authenticate users themselves and issue tenant tokens without requiring intervention from the application routing platform or application servers. This self-service authentication approach maintains security while reducing authentication management complexity, as each tenant independently controls their own authentication process.
Solution Approach 2:
The system uses universal token types (tenant tokens and application platform tokens) that work across all tenants and application servers. This universal approach allows the same authentication mechanism to serve multiple purposes and multiple tenants, reducing the need for tenant-specific authentication implementations.
3Measurement precision
If application systems directly authenticate users, then authentication accuracy is improved, but the complexity of the authentication system and the burden on application systems increases
Solution Approach 1:
The patent extracts the authentication function from application systems and places it in tenant systems. Application systems no longer need to perform authentication themselves; instead, they receive pre-authenticated requests with valid tokens. This extraction maintains authentication accuracy while significantly reducing the complexity burden on application systems.
Solution Approach 2:
Authentication is performed in advance by tenant systems before requests reach application systems. Users are authenticated once by their tenant, and the resulting token is valid for subsequent requests. This preliminary authentication action eliminates the need for repeated authentication checks at each application system, reducing complexity while maintaining accuracy.
Data Source
AI summary
A system includes an interface and a processor. The interface is configured to receive, at an application routing platform, an API call for an application platform comprising a signed tenant token. The processor is configured to determine that the signed tenant token is valid; determine an application platform token for the application platform; associate a root certificate with the application platform token; determine routing information to the application platform based at least in part on the API call; and provide the application platform the API call and the application platform token using the routing information to enable access to the application platform, wherein the application platform determines whether the application platform token is valid using the root certificate and executes the API call in response to a determination that the application platform token is valid.