ESB Secure Data Processing with Time-Based Credential Rotation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional approaches are inadequate for securely processing data streams with differing security classification levels in Enterprise Service Bus (ESB) environments, as they lack controls to ensure the ESB applications are functioning correctly and securely manage data with multiple security classification levels, leading to risks of data mishandling and unauthorized access.

Innovation Solution

A modified ESB SDTAT architecture that includes a Work Estimate Application (WEA) to generate time estimates, a CPU I/O audit process to monitor actual utilization times, a re-credentialer application to invalidate database access credentials, and a re-cryptor application to change cryptographic keys, ensuring secure processing and preventing potential compromises.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If a secure data processing application processes data streams with differing security classification levels, then data processing capability is improved, but security risk increases due to potential compromise from excessive execution time

Engineering Contradiction:

Improvedata processing capabilityVSAvoidsecurity assurance

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system performs preliminary actions by establishing execution time estimates before the secure data processing application runs. These time estimates serve as pre-defined security thresholds that are compared against actual execution times to detect potential compromises before they can result in data breaches.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements feedback mechanisms by continuously monitoring actual execution times and comparing them against estimated time thresholds. When execution time exceeds the threshold, the system generates security alerts and can terminate the application, creating a closed-loop control system that maintains security through continuous verification.

Inventive Principle:

Principle #23Feedback

2Reliability

If execution time monitoring and credential invalidation mechanisms are implemented, then security is improved, but system complexity increases

Engineering Contradiction:

Improvesecurity assuranceVSAvoidsystem architecture

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system introduces intermediary components such as time estimation services, execution monitors, and credential management services that act as mediators between the secure data processing application and the underlying infrastructure. These intermediaries handle security functions independently, allowing the main application to focus on data processing while security is managed by specialized intermediary components.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The security system is segmented into distinct functional modules: time estimation module, execution monitoring module, credential invalidation module, and alert generation module. Each module performs a specific security function, making the overall system more manageable and maintainable despite the increased complexity.

Inventive Principle:

Principle #1Segmentation

3Reliability

If database credentials and cryptographic keys are invalidated and regenerated frequently, then security is improved by limiting exposure time, but processing efficiency decreases

Engineering Contradiction:

Improvesecurity assuranceVSAvoiddata processing efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system implements dynamic credential management where credentials and cryptographic keys are invalidated and regenerated based on real-time execution time monitoring. Rather than using static, long-lived credentials, the system dynamically adjusts credential validity periods to match actual execution requirements, optimizing both security and efficiency.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system changes the parameter of credential lifetime from a fixed, long duration to a variable, short duration based on execution time estimates. This parameter change allows credentials to be valid only for the minimum necessary time to complete a data processing task, reducing exposure windows while maintaining processing efficiency.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS11366893B1Systems and methods for secure processing of data streams having differing security level classifications

Publication Date: 2022.06.21 ENT SERVICES DEV CORP LP

AI summary

Systems, methods, and non-transitory computer-readable media can receive a notification of a user request to securely process a first set of data. A time estimate is calculated, wherein the time estimate is indicative of an expected amount of time for a secure data processing application to process the first set of data. An actual utilization time required for a first instance of the secure data processing application to process the first set of data is measured. A determination is made as to whether the secure data processing application may be compromised based on a comparison of the time estimate and the actual utilization time. In various embodiments, a re-cryptor process is used to change the cryptographic keys accessed by the secure data processing application. In various embodiments, a re-credentialer is used to change the database access credentials the secure data processing application used to access the encrypted data.