Temporary Access Tokens for Resilient Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributed systems face challenges in maintaining user experience and system resiliency due to failures in critical components, leading to suboptimal user experiences and extensive downtime during high traffic periods, such as when millions of users attempt to access network resources simultaneously.
Innovation Solution
Implementing an asynchronous billing system that provides temporary access tokens to users, allowing uninterrupted access to network resources even during critical authorization failures, with retry strategies and health checks to ensure smooth transitions and minimize downtime.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a distributed system is used to maintain scalability and functionality, then system scalability and resilience are improved, but system complexity increases and makes troubleshooting difficult during concurrent failures
Solution Approach 1:
The authorization system is segmented into multiple independent components including authorization service, billing service, user profile service, and content delivery service. Each component operates independently with defined interfaces, allowing the system to maintain scalability while isolating failures to specific segments rather than the entire system.
Solution Approach 2:
An authorization token acts as an intermediary between users and protected resources. The token contains pre-validated authorization information, allowing users to access resources without real-time communication with the authorization service during high-traffic periods, thus reducing system complexity while maintaining scalability.
2Reliability
If traditional authorization systems are used during high traffic periods, then authorization accuracy is maintained, but user experience deteriorates due to waiting rooms and forced retries
Solution Approach 1:
Authorization decisions are made in advance during the authentication process, and the results are cached in authorization tokens. This preliminary action allows users to access resources immediately without real-time authorization checks during high traffic, maintaining authorization accuracy while dramatically improving user experience.
Solution Approach 2:
The system implements asynchronous authorization where token validation continues in the background even after users are granted access. This allows the full authorization process to complete without blocking user actions, ensuring authorization accuracy is maintained while users experience uninterrupted access during high traffic periods.
3Reliability
If synchronous authorization processes are used, then authorization correctness is ensured, but system downtime increases during critical component failures
Solution Approach 1:
Pre-generated authorization tokens serve as intermediaries that encapsulate authorization decisions. During critical component failures, these tokens allow the system to continue authorizing users correctly without real-time communication with failed components, ensuring authorization correctness while eliminating downtime caused by synchronous process failures.
Solution Approach 2:
The system performs authorization validation in advance and caches results in tokens with appropriate validity periods. This preliminary action ensures that even when authorization components fail, the system can continue to make correct authorization decisions using cached token data, maintaining correctness while minimizing downtime.
4Productivity
If millions of users access network resources simultaneously, then system throughput is maximized, but system stability deteriorates due to concurrent failures and extensive downtime
Solution Approach 1:
The system segments authorization operations into independent, stateless token validations that can be distributed across multiple servers. This segmentation allows the system to handle millions of simultaneous requests through parallel processing while maintaining stability, as failures in one segment do not propagate to other segments.
Solution Approach 2:
The system creates copies of authorization decisions in the form of tokens that can be validated independently without querying the original authorization service. This copying mechanism allows high throughput by enabling parallel validation of millions of tokens while improving stability by eliminating dependency on centralized authorization components during validation.
Data Source
AI summary
A method for use by a system computer for granting access to a network resource includes receiving, in a first session, a first request for accessing the network resource, the first request including authorization information of a user of an access computer, initiating, while in the first session and using the first authorization information, a first authorization process with one or more authorization computers, and determining a failure relating to the first authorization process initiated with the one or more authorization computers. The method further includes, upon determining the failure, sending a second request indicating a temporary access token is to be delivered to the access computer in response to an access computer executing a session refresh for initiating a second session.