Pub/Sub Network Configuration Monitoring for Wiretapping Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In communication systems using Pub/Sub communication with DDS, wiretapping cannot be detected due to the difficulty in grasping the network configuration, making it challenging to identify unauthorized intrusions.

Innovation Solution

A communication system employing a broker-less type publishing/subscribing model with a determination unit that detects anomalies based on network configuration information and predefined white and black lists, utilizing a combined layer of IP, participant, and Pub/Sub relationship layers to identify unauthorized participation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If a broker-less type Pub/Sub communication system is used to achieve lightweight and flexible device interconnection, then adaptability and ease of operation are improved, but the ability to detect wiretapping and unauthorized intrusions deteriorates due to difficulty in grasping network configuration

Engineering Contradiction:

Improveflexibility of device interconnectionVSAvoiddetection capability against wiretapping

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent introduces a configuration management unit as an intermediary component that collects and manages network configuration information from multiple nodes. This mediator enables centralized monitoring and anomaly detection without changing the distributed broker-less architecture, thus resolving the contradiction between system flexibility and security monitoring capability

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system implements feedback mechanisms where configuration information is continuously collected from nodes, analyzed for anomalies using white lists and black lists, and used to detect unauthorized participations. This feedback loop enables the system to maintain its flexible broker-less structure while achieving reliable anomaly detection through continuous monitoring and comparison against predefined security policies

Inventive Principle:

Principle #23Feedback

2Measurement precision

If configuration information is collected from all nodes to enable anomaly detection, then detection precision is improved, but device complexity increases due to additional monitoring and management components

Engineering Contradiction:

Improveanomaly detection precisionVSAvoidcomplexity of configuration management

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The configuration management functionality is segmented into modular units that can be independently deployed and managed. Each node maintains its own configuration information locally, and the system divides the monitoring task into collecting configuration data, analyzing it against white/black lists, and generating anomaly reports. This segmentation reduces the complexity burden on individual components while achieving comprehensive anomaly detection

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Each node in the broker-less system autonomously manages its own configuration information and participates in the anomaly detection process by providing its configuration data. The system uses self-service mechanisms where nodes automatically report their configuration states, and the anomaly detection is performed by comparing these self-reported configurations against predefined white lists and black lists, reducing the need for complex centralized management

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS12542783B2Communication system, anomaly detection apparatus, anomaly detection method, and program

Publication Date: 2026.02.03 NT T INC

AI summary

A communication system that performs communication among a plurality of nodes by a broker-less type publishing/subscribing model, includes: a computer including a memory and a processor configured to, in a case where a network configuration of the communication system changes, detect an anomaly of the communication system based on configuration information indicating the network configuration and at least one of a predefined white list or black list.