Message Broker Data Migration for Secure Zone Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data migrations between data zones, particularly between data centers, suffer from security flaws due to direct communication via APIs that expose sensitive data and require complex firewall rules, making it difficult to isolate and protect sensitive data.
Innovation Solution
A system utilizing a key management service (KMS) to manage cryptographic keys, a migration policy engine to enforce rules, and a message broker system for asynchronous communication, ensuring data zones communicate indirectly, using ephemeral symmetric keys for encryption and signed packages, with only outbound ports open for administrative traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If direct communication via APIs is used for data migration between data zones, then data transfer efficiency is improved, but security is worsened due to exposure of sensitive data and complex firewall requirements
Solution Approach 1:
The patent introduces a message broker system as an intermediary component between source and destination data zones. The message broker receives encrypted data packages from the source zone, stores them temporarily in a secure queue, and delivers them to the destination zone without requiring direct communication channels. This mediator architecture maintains security isolation while enabling efficient data transfer, resolving the contradiction between transfer efficiency and security.
2Reliability
If a DMZ with firewall protection is used for data migration, then security is improved, but device complexity is worsened due to complicated firewall settings
Solution Approach 1:
The patent extracts the security enforcement function from complex firewall configurations and relocates it to a dedicated message broker system with built-in security policies. Instead of configuring complex firewall rules to control data migration traffic, the system uses the message broker to handle authentication, encryption, and authorized data transfer. This extraction simplifies the overall system architecture while maintaining strong security controls.
3Reliability
If encryption and signing are applied to migrated data, then security is improved, but processing time is worsened
Solution Approach 1:
The patent applies encryption and digital signing to data packages before they are placed in the message broker queue. By performing these security operations in advance during the data preparation phase rather than during transmission or at the destination, the system minimizes the time impact on the critical data migration path. The pre-processed encrypted packages are then efficiently transferred and delivered without additional processing delays.
Data Source
AI summary
Techniques are disclosed relating to secure data migration between different data zones via a message broker system for asynchronous communication. A migration policy engine is used to determine allowable data migrations. If a data migration is permitted, a set of data in the source data zone is encrypted using a symmetric key that is generated using a key agreement protocol that utilizes a public key of a data zone key pair of a destination data zone and a private key of a migration key pair. The source data zone writes the encrypted data and a public key of the migration key pair to the message broker system. The destination data zone then reads this data from the message broker system, and decrypts the data by deriving the symmetric key using the public key of the migration key pair and a private key of the data zone key pair.