Message Queue Request Fulfillment via Outbound Connection Inversion

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing systems for authenticating client devices to access secure services are vulnerable to attacks that hijack incoming connections, and they lack scalability and reliability in handling increasing request volumes.

Innovation Solution

A system that securely fulfills requests for signed digital certificates by using multiple message queues and servers operating within a domain boundary, where the processor initiates connections to message queues outside the domain, preventing unauthorized access and ensuring redundancy for increased reliability and scalability.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the system uses a single message queue and server for handling authentication requests, then the device complexity is low, but the reliability and scalability are insufficient when handling increasing request volumes

Engineering Contradiction:

Improvesystem reliabilityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system is divided into multiple independent servers and message queues. Each server can independently process authentication requests, and multiple message queues distribute the request load. This segmentation improves reliability through redundancy while managing complexity through modular, independent components.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system dynamically adjusts operational parameters such as the number of active servers and message queue configurations based on request volume. This allows the system to scale reliability up or down as needed, optimizing the balance between reliability and complexity based on actual workload conditions.

Inventive Principle:

Principle #35Parameter changes

2Ease of operation

If the system allows incoming connections from external sources to message queues, then the ease of operation is improved, but the security is compromised due to vulnerability to hijacked connections

Engineering Contradiction:

ImproveaccessibilityVSAvoidsecurity vulnerability

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

Instead of allowing external sources to initiate connections to message queues, the system inverts the connection model: servers initiate outbound connections to message queues. This reversal maintains accessibility for legitimate operations while blocking inbound connection hijacking attacks, as the system controls all connection initiation.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The system introduces a controlled intermediary layer where servers act as the intermediary between external requesters and message queues. All external access must go through this controlled intermediary, which validates and manages connections, preventing direct external access that could be hijacked while maintaining operational accessibility.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11632352B2Fulfillment of requests stored on a message queue

Publication Date: 2023.04.18 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

According to examples, an apparatus may include a processor and a memory on which is stored machine readable instructions that may cause the processor to determine whether a request is stored in a message queue, in which the apparatus may be inside of a domain and the message queue may be outside of the domain. Based on a determination that a request is stored in the message queue, the processor may pull the request from the message queue through a domain boundary, fulfill the request to cause a response to the request to be generated, and forward the response to the message queue through the domain boundary.