Message Interception for Distributed Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Administrators of distributed computer networks face challenges in controlling distributed applications without user intervention, particularly in managing security and configuration changes across large networks, as existing solutions require redeployment of software modules and are not adaptable to dynamic threats.
Innovation Solution
A method and system that intercept messages in a distributed computer network, allowing for real-time updates of message-handling policies and action-to-software-module mappings, enabling adaptive security configurations without redeploying message handling software, by using a run-time updatable message handling policy and deployment-time settable action assignment policy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If message handling software is updated to respond to new threats, then security adaptability is improved, but software redeployment is required which interrupts service
Solution Approach 1:
The system segments message handling functionality into modular interceptors that can be independently selected and activated. Each interceptor implements a specific security function, allowing individual interceptors to be updated without affecting the entire message handling software, thus enabling security adaptations without service interruption.
Solution Approach 2:
The system employs dynamic configuration where the set of active interceptors can be modified at runtime based on security policies. Administrators can add, remove, or reconfigure interceptors dynamically, allowing the system to adapt to new threats without requiring software redeployment or service interruption.
2Adaptability or versatility
If security policies are updated in real-time, then responsiveness to threats is improved, but system complexity increases
Solution Approach 1:
The system introduces an intermediary configuration layer that separates security policy definition from interceptor implementation. This intermediary layer provides a standardized interface for defining security policies, simplifying configuration management while enabling real-time updates. The policy language and configuration mechanisms act as intermediaries between administrators and the complex interceptor architecture.
3Device complexity
If interceptors are statically configured, then system simplicity is maintained, but adaptability to new threats is reduced
Solution Approach 1:
The system creates a universal interceptor framework that can handle multiple security functions through a common architecture. Interceptors are designed with standardized interfaces and can be selectively activated based on security policies, allowing a single flexible system to address diverse security threats without requiring separate specialized configurations for each threat type.
Data Source
AI summary
Methods and apparatus for controlling the operation of a distributed application using message interception techniques are disclosed. The message interception software is independent of the software components making up the distributed application. The message interception software processes messages by carrying out a series of actions set out in an interceptor chain configuration policy, that policy being selected on the basis of the contents of the intercepted message. The interceptor chain configuration policy is divided into a separate enforcement configuration policy which dictates what actions should be carried out on a message and in what order, and an interceptor reference policy which indicates references to interceptors which are suitable for carrying out the actions specified in the enforcement configuration policy. In this way, the behavior of the message interception software (and thus the distributed application) can be updated while both the interception software and the distributed application are running without requiring the person updating the behavior of the message interception software to deal with esoteric references to interceptor software routines.