Multi-Client Publish-Subscribe Access With Tiered Broker Certificates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current publish-subscribe network protocols are cumbersome and insecure, particularly when dealing with multiple devices and task types, and manual client discovery is slow, expensive, and prone to errors, while existing security measures are vulnerable to unauthorized access.
Innovation Solution
A double broker system using short-lived access certificates from a local Certificate Authority for local messaging, combined with a client-centric publish-subscribe network protocol that provides unique IDs for clients, enhancing security and simplifying device commissioning, and implementing various encryption levels for secure messaging.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If manual client discovery is used in the network, then clients can be added to the network, but the process is slow, expensive, and prone to human error
Solution Approach 1:
The system enables automatic client discovery where the broker autonomously discovers and registers new clients in the network without manual intervention. The broker listens for connection requests and automatically adds clients to the network, eliminating the need for manual discovery processes and reducing both time and human error.
Solution Approach 2:
The patent replaces manual mechanical processes with automated electronic discovery mechanisms. The broker uses network protocols and automated authentication to discover clients electronically, substituting the manual mechanical process of client registration with an automated electronic system that is faster and more reliable.
2Duration of action of moving object
If long-lived access certificates are used for network access, then clients can access the network for extended periods, but unauthorized third parties can eavesdrop and break encryption over time
Solution Approach 1:
The system implements periodic certificate renewal where access certificates have short validity periods and are automatically renewed. Instead of using long-lived certificates that remain valid for extended periods, the broker issues new certificates periodically, limiting the window of opportunity for unauthorized eavesdropping while maintaining continuous network access for authorized clients.
Solution Approach 2:
The certificate system transitions from static long-lived certificates to dynamic short-lived certificates that are continuously renewed. This dynamic approach allows the system to adapt to security requirements by frequently updating cryptographic credentials, making it harder for unauthorized parties to compromise the system over time.
3Ease of operation
If task-specific publish-subscribe protocols are used, then network communication can be facilitated, but the protocols become increasingly cumbersome with more devices and task types
Solution Approach 1:
The patent implements a universal publish-subscribe protocol that can handle multiple task types and device categories through a single standardized interface. Instead of creating separate task-specific protocols for different device types, the system uses one versatile protocol with flexible topic structures and message formats that can accommodate diverse communication needs, reducing overall system complexity.
Solution Approach 2:
The protocol is segmented into modular components where complex communication patterns are broken down into standardized message types and topic hierarchies. This segmentation allows the protocol to handle diverse tasks through combinations of basic building blocks rather than requiring separate complex protocols for each task type.
4Adaptability or versatility
If gateway connection to public network is implemented, then remote users can access local clients, but unauthorized third parties can also access and alter local clients
Solution Approach 1:
The broker acts as an intermediary between remote users and local clients, mediating all communication through a secure authenticated connection. Remote users cannot directly access local clients; instead, all messages must pass through the broker which verifies authentication credentials and enforces access control policies, preventing unauthorized direct access while enabling legitimate remote communication.
Solution Approach 2:
Authentication and authorization are performed in advance before any network communication occurs. The broker verifies client credentials and establishes security contexts before allowing access to the network, preventing unauthorized third parties from accessing or altering local clients while enabling pre-authenticated remote users to communicate securely.
Data Source
AI summary
A messaging system for exchanging messages between nodes in a network via a broker that uses a publish-subscribe message protocol, which nodes have object identifications (IDs). Messages between the nodes are routed using the object IDs of the nodes. Secure communication is provided using authentication according to digital certificates being used as first and second tiers by a commissioning broker and a data broker, respectively, in which the second tier certificate used by the data broker has a shorter lived expiration time.