Versioned Authorization Tokens for Fast Decentralized Invalidation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data systems struggle to quickly invalidate authorization tokens and manage access control efficiently, especially when tokens are leaked or no longer needed, leading to increased load on central authorities and slow validation processes.
Innovation Solution
A decentralized system generates user authorization tokens with version identifiers, allowing rapid invalidation by updating the configuration file's version identifier, enabling microservices to validate tokens independently and reduce the need for central authority consultation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a central authority is used to validate authorization tokens, then access control can be centralized and managed, but the system becomes slow and unable to quickly invalidate tokens or process requests
Solution Approach 1:
The patent segments the centralized authorization validation into distributed microservices. Each microservice independently validates authorization tokens using version identifiers, eliminating the single point of congestion. The system divides the validation load across multiple services that can process requests in parallel, thereby maintaining reliable access control while dramatically improving validation speed.
2Reliability
If authorization tokens have fixed expiry periods, then token lifecycle can be managed, but the system cannot quickly invalidate tokens when they are leaked or no longer needed
Solution Approach 1:
The patent introduces version identifiers as a dynamic parameter that can be changed independently of token expiry times. When tokens need to be invalidated, the system changes the version identifier in the configuration file, which immediately renders all tokens with older versions invalid. This allows rapid token invalidation without waiting for the fixed expiry period to elapse.
3Reliability
If a central authority processes all authorization requests, then centralized control is maintained, but the system cannot process requests in parallel and experiences high server load
Solution Approach 1:
The patent segments the centralized authorization control into distributed microservices, each capable of independently validating tokens. This segmentation allows requests to be processed in parallel across multiple services rather than sequentially through a single central authority, dramatically increasing the request processing rate while maintaining consistent authorization control through shared version identifiers.
4Reliability
If all data domains are managed by a single server, then centralized management is achieved, but the server receives excessive load and processing efficiency decreases
Solution Approach 1:
The patent segments data domain management into specialized microservices, where each microservice is responsible for specific data domains. This segmentation distributes the server load across multiple specialized services that can process requests in parallel, improving overall data processing rate while maintaining centralized control through the shared authorization token validation mechanism using version identifiers.
Data Source
AI summary
A system receives a request for a user authorization token for a user by a client device. The system generates the user authorization token using a configuration file that has a version identifier and specifies user permissions to access data in a set of data classes. The system transmits the user authorization token to the client device. The system receives a request to perform an action on data in a data class. The request includes the user authorization token including indicia of the version identifier. The system determines whether the user authorization token is invalid based on the version identifier of the user authorization token and determines whether the user has permissions to perform the action on the data in the data class based on the user authorization token. The system allows or disallows the request to perform the action on the data in the data class.