Token Validity Extension for SDDC Long-Running Operations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software-defined data center (SDDC) management systems face challenges in securely performing long-running and scheduled operations due to token validity issues, where cryptographic tokens may expire before completing operations.
Innovation Solution
A method is introduced where a persistable token with a longer time-to-live (TTL) period is used to initiate operations, allowing for the acquisition of short-lived access tokens as needed, ensuring secure and uninterrupted execution of both scheduled and long-running operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic tokens with predetermined TTL periods are used for authentication and authorization, then security is maintained for short operations, but the tokens become invalid before long-running operations can complete
Solution Approach 1:
The patent segments the authentication mechanism into two distinct token types: short-lived tokens for secure authentication and long-lived tokens for extended operation duration. The short-lived token handles the authentication phase with strict security parameters, while the long-lived token takes over for the execution phase, allowing operations to complete without token expiration interruptions.
Solution Approach 2:
The patent introduces an intermediary mechanism where the short-lived token serves as a mediator to establish initial authentication and authorization. This intermediary token enables the system to issue a long-lived token that then carries the operation through its entire duration, resolving the contradiction between security requirements and operational duration needs.
2Reliability
If tokens are distributed for each operation command, then security is maintained, but the operations cannot proceed continuously as tokens expire during execution
Solution Approach 1:
The patent divides the operation execution into two phases: an authentication phase using short-lived tokens and an execution phase using long-lived tokens. This segmentation allows continuous operation execution without repeated authentication interruptions, while maintaining security through the initial short-lived token verification.
Solution Approach 2:
The patent ensures continuity of useful action by transitioning from short-lived authentication tokens to long-lived execution tokens. Once authenticated, the system issues a long-lived token that remains valid throughout the entire operation duration, eliminating interruptions and ensuring continuous execution without compromising security.
3Reliability
If short-lived tokens are used for authentication, then security is enhanced, but additional token renewal operations are required during long-running operations
Solution Approach 1:
The patent segments token management into distinct phases: initial authentication using short-lived tokens and subsequent execution using long-lived tokens. This segmentation eliminates the need for continuous token renewal during operation execution, reducing management complexity while maintaining security through the initial authentication phase.
Solution Approach 2:
The short-lived token acts as an intermediary that establishes secure authentication once at the beginning. This intermediary authentication enables the issuance of a long-lived token that handles the remainder of the operation without requiring renewal, thereby reducing token management complexity while preserving security.
4Duration of action of moving object
If tokens are valid for extended periods, then long-running operations can complete, but security risks increase from prolonged token exposure
Solution Approach 1:
The patent segments the token lifecycle into two distinct periods: a short validity period for authentication that minimizes exposure risk, and a long validity period for operation execution that ensures completion. The short-lived authentication token limits security exposure, while the long-lived execution token is issued only after secure authentication, balancing security and operational needs.
Solution Approach 2:
The short-lived authentication token serves as a secure intermediary that verifies credentials before issuing a long-lived execution token. This intermediary mechanism ensures that only authenticated entities receive extended validity tokens, maintaining security while enabling long-running operations to complete without interruption.
Data Source
AI summary
A method of issuing one or more commands for a management appliance of a software-defined data center (SDDC) to perform an operation, includes the steps of: retrieving the operation to be performed by the management appliance; transmitting a request to the management appliance for a first token, wherein the first token is associated with permissions for issuing commands to the management appliance, and wherein the request for the first token includes a second token that is associated with the initiator of the operation and that has a longer time-to-live period than the first token has; and upon receiving the first token from the management appliance, transmitting the first token and a command to the management appliance, wherein the command is for the management appliance to execute at least one task of the operation.