Virtual Computer Account Directory Service Decoupling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In networked computer systems, services are typically tied to specific servers, making it difficult to relocate them in case of server failures or for high availability, as clients access services through the server they execute on, leading to potential service unavailability.
Innovation Solution
The creation and use of virtual computer accounts in the directory service allow services to log in using virtual authentication credentials, enabling decoupling from specific servers, allowing relocation without disrupting client access, by generating and synchronizing passwords across accounts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If services are tied to specific servers for authentication and access, then network security and authentication management are simplified, but service relocation becomes difficult and service availability decreases when servers fail
Solution Approach 1:
The patent segments the traditional server-bound account into two parts: a virtual computer account that remains in the directory service and a mapping relationship that links the virtual account to physical servers. This segmentation allows the service identity to be decoupled from any specific server, enabling service relocation while maintaining authentication continuity.
Solution Approach 2:
The virtual computer account acts as an intermediary between clients and physical servers. Instead of clients directly authenticating with server accounts, they authenticate with the virtual account which then maps to the appropriate physical server. This intermediary layer enables seamless service migration without disrupting client access or requiring changes to authentication credentials.
2Adaptability or versatility
If services are bound to specific servers, then authentication credentials can be directly managed per server, but relocating services requires complex credential updates and disrupts client access
Solution Approach 1:
The system performs preliminary actions by pre-configuring the virtual computer account in the directory service before any service relocation occurs. The virtual account is created with the necessary permissions and mappings are established in advance, so when service relocation is needed, the credentials are already ready and the mapping can be updated immediately without time-consuming credential generation or distribution.
Solution Approach 2:
The virtual computer account serves as a copy or abstraction of the physical server accounts. Instead of creating new authentication credentials for each service migration, the system uses the virtual account copy that can be rapidly remapped to different physical servers. This copying approach eliminates the time required to generate, distribute, and configure new credentials during relocation.
3Reliability
If clients access services through the server they execute on, then direct server-to-client connectivity is established, but service unavailability occurs when servers fail or need maintenance
Solution Approach 1:
The virtual computer account serves as an intermediary that clients use for authentication regardless of which physical server the service is running on. Clients authenticate with the virtual account through the directory service, and the system handles the mapping to the current physical server transparently. This maintains client access simplicity while enabling service continuity during server failures or maintenance.
Solution Approach 2:
The virtual computer account provides universal access rights that work across multiple physical servers. Instead of creating separate access configurations for each server, the virtual account is configured once with the necessary permissions and can map to any server in the group. This multi-functionality ensures that clients can access services continuously even when the underlying physical server changes due to failures or maintenance activities.
Data Source
AI summary
A method, and apparatus for executing the method, that includes creating a virtual account not limited to being associated with any one of a plurality of servers. The method further includes matching at least some authentication credentials of a first server of the plurality of servers with at least some authentication credentials of the virtual account.