9 Security Patterns
Security is a broad topic and many patterns have been created to address it, such as in [147]. However, while most of them do pertain to distributed systems, few are focused on the architecture of the system itself. This chapter presents a few useful patterns for enhancing the security of a distributed system directly through its architecture.
The Identity Provider & Federated Identity patterns in § 9.1 shows two common ways to handle authentication and authorization in a distributed system
The Gatekeeper pattern in § 9.2 instead uses distribution to its advantage to isolate security incidents in a limited environment
Other patterns that could be considered part of this category include [148]:
- Ambassador and Offload to Gateway can be used to improve network security, especially in legacy systems
- Bulkheads can be used to limit the blast radius of a security incident
- Claim Check can be used to protect sensitive data in communication by hiding them in a secure data store
Notable omissions in this category due to the methodology described in § 1 include:
Quarantine by Microsoft [149], as it is a process, not an architectural pattern
Valet Key by Wilder and Microsoft [14, p. 115, 129] as it is only useful in cloud environments