Token Issuing Server for API Gateway Authentication Load Relief
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing number of clients in a communication system leads to performance degradation of the API gateway due to increased load, which acts as a relay device for client-server communications.
Innovation Solution
A service management system incorporating a token issuing server that stores and periodically updates access keys and authentication tokens, allowing clients to access the API gateway using the latest tokens without needing to store their own access keys, thereby reducing the load on the API gateway.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the API gateway handles authentication for all clients directly, then authentication functionality is provided, but the load on the API gateway increases and performance degrades
Solution Approach 1:
The patent extracts the authentication token generation function from the API gateway and places it in a separate authentication server. The API gateway retains only the token verification function, while the authentication server handles token generation and management. This separation reduces the computational load on the API gateway and improves its performance while maintaining reliable authentication functionality.
Solution Approach 2:
The patent introduces an authentication server as an intermediary component between the API gateway and clients. This intermediary handles the complex authentication operations, allowing the API gateway to focus on relay functions with reduced load. The authentication server mediates between client authentication requests and the API gateway's service routing needs.
2Ease of operation
If each client stores its own access key, then authentication can be performed, but the system complexity increases and security risks are introduced
Solution Approach 1:
The patent extracts the access key storage function from individual clients and centralizes it in the authentication server. Clients no longer need to store sensitive access keys locally; instead, they obtain temporary authentication tokens from the authentication server. This reduces system complexity and security risks associated with distributed key storage while maintaining client authentication capability.
Solution Approach 2:
The patent uses authentication tokens as temporary copies of access credentials. Instead of clients storing and using permanent access keys, the authentication server generates short-lived token copies that clients use for authentication. These tokens can be revoked and regenerated without changing the underlying access keys, simplifying the overall system architecture.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
According to one embodiment, a service management system includes a relay device to relay communications between a client and a server providing a service that comprises one or more microservices. The relay device generates an authentication token, authenticates the authentication token when included in a service request from the client, and issues a command to the server to execute a service requested by the client after the authentication token is successfully authenticated. A token issuing server is provided to communicate with the relay device and the client and includes a storage unit and a processor. The processor is configured to store an access key issued by the relay device in the storage unit, acquire the authentication token from the relay device by using the access key, and send the acquired authentication token to the client in response to a token request from the client.