Variable Identity Pipe for Constrained Delegation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current server topologies for load balancing face challenges with high connection costs and complexity, particularly with non-delegable credentials and constrained delegation, leading to latency issues and security risks due to the need for multiple authentications and fixed identity pipes.
Innovation Solution
Implementing a variable identity pipe between front-end and back-end servers, allowing multiple clients to share a single communication channel, with the front-end server authenticating and changing identities to facilitate actions on resources, reducing the number of connections and enabling constrained delegation without complex configuration requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple fixed identity pipes are established for each client to access back-end server, then authentication security is improved, but connection overhead and latency increase
Solution Approach 1:
Multiple client connections are merged into a single variable identity pipe between front-end and back-end servers. The front-end server acts as an intermediary that receives connections from multiple clients and forwards them through one shared pipe to the back-end server, eliminating the need for separate fixed identity pipes for each client.
Solution Approach 2:
The front-end server serves as an intermediary component between clients and the back-end server. It authenticates clients, manages the variable identity pipe, and translates client requests into appropriate communications with the back-end server, thereby reducing direct connection requirements.
2Reliability
If constrained delegation is implemented with predefined server sets, then security risks are reduced, but system complexity and configuration requirements increase
Solution Approach 1:
The variable identity pipe provides a universal communication mechanism that works across different server configurations and trust models. Instead of requiring specific constrained delegation configurations between predefined servers, the system uses a single pipe that can dynamically serve multiple clients with different authorization requirements.
Solution Approach 2:
The system changes the identity parameter dynamically within the single pipe context. The front-end server manages identity transitions, allowing the same physical pipe to securely handle requests from different clients with different authorization levels without requiring pre-configured trust relationships.
3Ease of operation
If general delegation is used to allow access to all servers, then ease of operation is improved, but security risks increase due to full network access
Solution Approach 1:
Instead of providing blanket access to all servers, the system applies local quality control through the front-end server. Each client receives authentication and authorization specific to their needs, with the front-end server enforcing appropriate access controls before forwarding requests through the variable identity pipe to specific back-end servers.
Data Source
AI summary
Example embodiments provide for a system configured to provide constrained delegation and connection pooling for a back-end server by providing a variable identity pipe between it and a front-end server. A client will authenticate to the front-end process using credentials that are typically non-delegable by default, e.g., a token, certificate, or the like. The front-end is configured to extract client identity information and use this information to request changing an identity associated with the variable identity pipe. In addition, requests for actions on resources received from the client can be transformed into remote procedural calls and used by the back-end server to process the requests. A response is then sent back over the variable identity pipe to the client via the front-end server. The variable identity pipe is left open to allow other requests from other clients to be sent over the variable identity pipe in a similar manner.