Selective Message Encryption in Broker-Based Messaging Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing message-oriented middleware systems lack the ability to selectively encrypt messages at runtime, leading to potential security vulnerabilities when transmitting between software applications with varying encryption configurations.
Innovation Solution
A broker-based messaging system that includes a software application subsystem, a message broker subsystem, and an encryption services subsystem, which allows the software application subsystem to determine whether to encrypt messages based on the current encryption configuration of the message broker and recipient software applications, enabling secure or cleartext transmission accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If messages are always transmitted as cleartext in message-oriented middleware, then system simplicity and ease of operation are maintained, but security is compromised when encryption is needed
Solution Approach 1:
The patent introduces an encryption services subsystem as an intermediary between the message broker subsystem and software applications. This mediator handles encryption configuration management, allowing applications to request encryption services without directly managing complex encryption configurations. The encryption services subsystem acquires encryption configuration data and manages the encryption state, thereby improving message security while shielding applications from configuration complexity.
2Reliability
If encryption is always applied to messages, then security is improved, but processing overhead and system complexity increase
Solution Approach 1:
The patent implements dynamic encryption where the encryption state of messages is determined at runtime based on the current encryption configuration of the message broker subsystem and the encryption capabilities of the recipient application. The encryption services subsystem dynamically acquires encryption configuration data and adjusts encryption applied to messages accordingly. This allows the system to apply encryption only when necessary, improving security while avoiding unnecessary processing overhead and maintaining transmission efficiency.
3Adaptability or versatility
If the system supports multiple encryption configurations, then adaptability to different applications is improved, but device complexity and configuration management difficulty increase
Solution Approach 1:
The encryption services subsystem is designed as a universal service that can handle multiple encryption configurations and work with different message broker subsystems and applications. It provides a standardized interface for acquiring encryption configuration data and determining encryption state, making the system adaptable to various encryption requirements without requiring separate management mechanisms for each configuration. This multi-functional approach improves adaptability while consolidating complexity into a single manageable subsystem.
4Reliability
If encryption configuration is checked at runtime for each message, then encryption accuracy and security are improved, but processing time and system overhead increase
Solution Approach 1:
The system performs preliminary acquisition of encryption configuration data by the encryption services subsystem before message transmission. The encryption state is determined in advance based on the current encryption configuration and the recipient application's capabilities. This preliminary action allows the system to make encryption decisions before message processing, ensuring encryption accuracy while minimizing the time impact during actual message transmission by avoiding repeated runtime checks for each message.
Data Source
AI summary
An exemplary method includes transmitting, by a software application subsystem, a request to an encryption services subsystem to route a message generated by an originating software application to a recipient software application through a message broker subsystem, acquiring, by the software application subsystem, data representative of a current encryption configuration of the message broker subsystem from the encryption services subsystem in response to the request, and determining, by the software application subsystem, during a run time of the originating software application whether to encrypt the message before the message is transmitted to the message broker subsystem for routing to the recipient software application, the determination based at least in part on the current encryption configuration of the message broker subsystem. Corresponding methods and systems are also disclosed.