Service Mesh Sidecar Routing With Delegated Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In large-scale, decentralized service meshes, ensuring secure and dynamic communication with globally distributed endpoints is challenging due to the need for fine-grained authorization and on-demand route determination, which existing technologies fail to address efficiently.
Innovation Solution
Implementing a sidecar container that intercepts outbound calls, performs authentication and authorization checks using service account credentials, and dynamically determines routes through an identity and token exchange service, decoupling authorization from the service mesh.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a decentralized service mesh architecture is used to enable fine-grained authorization and dynamic route determination, then security and adaptability are improved, but system complexity increases
Solution Approach 1:
The patent introduces a sidecar component as an intermediary between microservices and remote endpoints. The sidecar handles authentication, authorization, and route determination, isolating the complex security logic from the service mesh core and microservices. This mediator pattern resolves the contradiction by centralizing complexity in a dedicated component while maintaining the decentralized architecture's security benefits.
Solution Approach 2:
The system segments authorization and routing functions into separate components: identity manager for authentication, token exchanger for authorization tokens, and sidecar for route determination. This segmentation allows each component to specialize in specific security tasks, improving reliability while making the overall complex system manageable through modular design.
2Adaptability or versatility
If existing technologies are used for authorization and routing, then system complexity is reduced, but the ability to support fine-grained authorization and dynamic routes in large-scale decentralized meshes is insufficient
Solution Approach 1:
The patent implements dynamic authorization through runtime token exchange. Instead of static authorization configurations, the system exchanges identity tokens for access tokens dynamically based on service account credentials and endpoint requirements. This dynamic approach enables fine-grained authorization adaptability while managing complexity through automated token management rather than manual configuration.
Solution Approach 2:
The system changes authorization parameters dynamically by exchanging different access tokens for different endpoints and services. The token exchanger manages multiple credentials and generates appropriate access tokens based on the specific service account and target endpoint, enabling fine-grained control without hardcoding complex authorization rules in each service.
3Reliability
If code changes are made in requesting services to implement authorization, then authorization control is improved, but ease of operation deteriorates due to required code modifications
Solution Approach 1:
The sidecar acts as an intermediary that handles all authorization and routing logic externally to the microservice code. The microservice simply makes outbound calls without any authorization code changes, while the sidecar intercepts these calls and manages the complete authorization flow including credential exchange and route determination. This resolves the contradiction by maintaining simple service code while implementing robust authorization control in the sidecar.
Data Source
AI summary
A system can execute a containerized application that comprises a microservice in a decentralized service mesh architecture, and a sidecar. The system can intercept, by the containerized application, a call from the microservice that is directed to a remote endpoint, and direct the call to the sidecar. The system can communicate, by the sidecar to an identity manager, service account credentials associated with the microservice, resulting in receiving an identity token associated with the microservice. The system can determine, by the sidecar, connectivity information of the remote endpoint based on a virtual address of the remote endpoint identified in the call. The system can communicate, by the sidecar to a token exchanger, the identity token and the connectivity information, resulting in receiving an access token and a network route to the remote endpoint. The system can relay, by the sidecar, network traffic between the microservice and the remote endpoint.