Secure Persistent Connection for Edge Cluster Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing management and orchestration systems, such as Kubernetes, assume secure and available communication between controllers and target devices, which is no longer valid due to changing technological and network environments, leading to complexity and cost issues with solutions like VPNs and SSH.
Innovation Solution
The implementation of a secure persistent connection (SPC) between a controller and target clusters, using cryptographically encrypted communication and mutual Transport Layer Security (mTLS) for secure authentication, allowing for efficient management and orchestration of distributed systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VPN or SSH is used to secure communication between controller and target clusters, then security is improved, but device complexity and administrative overhead increase
Solution Approach 1:
The patent extracts the security authentication function from complex VPN/SSH protocols and implements it through lightweight mTLS certificates. Each target cluster receives a certificate from the controller that enables secure communication without requiring full VPN infrastructure, thereby maintaining security while reducing system complexity.
Solution Approach 2:
The patent uses short-lived cryptographic tokens and certificates instead of permanent VPN configurations. The controller issues temporary authentication credentials to target clusters that can be revoked and renewed easily, replacing the need for complex, persistent VPN tunnel management.
2Reliability
If VPN or SSH is used to secure communication, then security is improved, but administrative overhead increases
Solution Approach 1:
The controller automatically manages certificate issuance and renewal for target clusters without requiring manual administrative intervention. The system self-provisions security credentials, automatically renews them before expiration, and handles revocation centrally, eliminating the need for administrators to manually configure and maintain VPN or SSH security settings across multiple clusters.
3Speed
If computational resources are deployed closer to the edge of the network, then network latency is reduced, but connectivity management complexity increases
Solution Approach 1:
The controller implements a universal connectivity management system that handles multiple target clusters at different network locations through a single standardized interface. The same certificate-based authentication and connection management protocols work whether target clusters are at the network core or edge, providing multi-functional connectivity management that simplifies deployment across diverse locations.
Data Source
AI summary
Clusters of devices providing information services are deployed at network edges, such as in neighborhoods and at cell sites. To facilitate secure management of these many services, a secure persistent connection is provided between a target cluster and a controller system. The connection may utilize gRPC sent via a mutual transport layer security (mTLS). The persistent connection allows a controller system to maintain administrative communication with many clusters. For example, the controller may act as a proxy application programming interface (API) endpoint, passing a request to a specific Kubernetes API server within a target cluster, and in turn passing responses returned via the connection. Multiple levels of security may be used to improve resistance to attack and network address space efficiency at the edge is improved by using port addressing. The system also supports implementations in which the target cluster is behind an address translation device.