Cloud Message Queue Connector for Secure Firewall Traversal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprises face challenges in securely receiving messages from external sources without compromising their security, as traditional solutions like opening firewall ports or using VPNs pose vulnerabilities to attacks.
Innovation Solution
A cloud server receives messages destined for various tenants and stores them on tenant message queues, with a connector server initiating an HTTP connection using tenant credentials to pull messages through a firewall without opening ports, ensuring secure message delivery.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a port is opened in the firewall to allow messages from external sources, then message delivery from external sources is enabled, but the enterprise becomes vulnerable to external attacks
Solution Approach 1:
Instead of opening ports to push messages into the enterprise (external-initiated connection), the system inverts the approach by having the enterprise's server pull messages from the cloud provider through already-open HTTP ports (internal-initiated connection). This reverses the connection initiation direction to maintain security while enabling message delivery.
Solution Approach 2:
The system uses an intermediary cloud provider server that receives messages from external sources and stores them on message queues. The enterprise server then requests these messages through standard HTTP connections, acting as a mediator that enables message transfer without requiring the enterprise to open ports for incoming connections.
2Reliability
If a dedicated VPN link is established from external server to internal server, then secure message delivery is achieved, but the entire enterprise is exposed to attack from the external server
Solution Approach 1:
The system applies local quality by establishing separate, isolated HTTP connections for each message transfer rather than creating a dedicated VPN tunnel. Each connection is scoped to specific message delivery needs and can be independently managed, providing security at the local level without exposing the entire enterprise network.
Solution Approach 2:
The system segments the message delivery function from the network connection function. Message delivery is handled through standard HTTP protocols over existing network infrastructure, separating the secure message transfer mechanism from any potential network-level security risks, thereby limiting the impact of external servers without compromising overall enterprise security.
3Object-affected harmful factors
If standard HTTP protocol is used for message delivery, then firewall port openings are avoided, but non-HTTP messages cannot be delivered
Solution Approach 1:
The cloud provider server acts as an intermediary that receives messages in their original protocol format (non-HTTP) and converts them to HTTP requests for transmission through the firewall. This protocol translation capability allows the system to maintain HTTP's firewall-friendly characteristics while preserving compatibility with various message formats and protocols.
Solution Approach 2:
The system changes the protocol parameter by translating received messages into HTTP format before transmission. The cloud provider server modifies the message format parameters to conform to HTTP standards, enabling successful delivery through firewalls while maintaining the ability to accept and process various original message protocols.
Data Source
AI summary
Securely providing messages from a cloud server to an enterprise is disclosed. In one aspect, a message is received at a first server that provides a cloud service to a plurality of tenants. The message complies with a protocol other than HTTP. The message is put on a message queue for a first tenant of the plurality of tenants. An HTTP connection is established in response to a request from a second server to establish the HTTP connection between the second server and the first server. The first server receives an HTTP request from the second serve over the HTTP connection for a message for the first tenant. The message is provided to the second server over the HTTP connection in response to determining that the second server is authorized to receive messages for the first tenant.