Service Grid Identity Authentication for Computing Clusters

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Computing cluster systems employing microservice architecture face challenges in securing communication between services, as existing solutions fail to effectively implement identity-based authentication mechanisms, leading to potential security vulnerabilities.

Innovation Solution

A service grid system is introduced, comprising a management and control component, an identity registration component, and an authorization proxy component, which generates and issues digital certificates based on diversified identity metadata, enabling identity-based identification authorization between services, ensuring secure communication through identity verification and proxy-based data transmission.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If identity-based authentication mechanism is implemented between services, then security of communication is improved, but system complexity increases due to additional components and authentication processes

Engineering Contradiction:

Improvesecurity of communicationVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a service grid system as an intermediary layer between services, which includes a management and control component, an identity registration component, and an authorization proxy component. This intermediary handles all authentication and authorization operations, isolating the complexity from individual services while ensuring secure communication. The service grid system acts as a mediator that manages digital certificates and security policies centrally.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The identity registration component performs preliminary actions by acquiring and registering identity metadata for services before they need to communicate. The management and control component generates digital certificates and security policies in advance, issuing them to services before actual communication occurs. This preliminary setup reduces runtime complexity while maintaining security.

Inventive Principle:

Principle #10Preliminary action

2Measurement precision

If digital certificates and security policies are generated for each service, then authentication accuracy is improved, but processing time increases due to certificate generation and verification

Engineering Contradiction:

Improveauthentication accuracyVSAvoidprocessing time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The management and control component generates and issues digital certificates and security policies to services in advance, before they need to communicate. This preliminary action ensures that authentication is accurate when needed, while avoiding time-consuming certificate generation during actual communication operations.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The authorization proxy component uses copied or cached versions of digital certificates and security policies for verification operations. Instead of generating or validating certificates in real-time during each communication, the system uses pre-generated copies, significantly reducing verification time while maintaining authentication accuracy.

Inventive Principle:

Principle #26Copying

3Reliability

If authorization proxy component is distributed in computing cluster, then security coverage is improved, but resource consumption increases due to multiple proxy instances

Engineering Contradiction:

Improvesecurity coverageVSAvoidresource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The authorization functionality is segmented into distributed proxy components deployed across multiple computing nodes in the cluster. Each proxy component handles authentication and authorization for local services, providing comprehensive security coverage. The segmentation allows parallel processing of authentication requests, distributing resource consumption across multiple nodes rather than concentrating it in a single component.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Each authorization proxy component autonomously performs authentication and authorization operations for services in its local environment without requiring constant communication with the central management component. This self-service capability reduces network overhead and resource consumption while maintaining comprehensive security coverage across the distributed cluster.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS20250007913A1Computing cluster system, security authentication method, node device and storage medium

Publication Date: 2025.01.02 HANGZHOU ALICLOUD FEITIAN INFORMATION TECH CO LTD

AI summary

A computing cluster system, a security authentication method, a node device and a storage medium are provided. A service grid system for implementing an identity-based identification authorization mechanism between at least two services is added in the computing cluster system. In the system, an identity registration component reports, to a management and control component, acquired diversified identity data corresponding to a first service; according to the diversified identity data, the management and control component generates a security policy and a digital certificate, which correspond to the first service, and issues same to a corresponding authorization proxy component. The authorization proxy component performs identity verification for the corresponding service according to the security policy and the digital certificate, and performs communication for the at least two services by proxy after the identity verification is passed.