Service Mesh WASM Routing for Sensitive Data Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing systems fail to effectively protect sensitive data communicated through microservices and service mesh runtime logic, leading to potential data breaches and compliance issues.

Innovation Solution

Deploying a WebAssembly (WASM) binary package in the service routing layer of a service mesh to detect patterns indicative of sensitive information, with a security policy, and transmitting telemetry to a cloud-based command module for verification and remediation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If traditional data protection methods are used in service mesh, then implementation is simpler, but detection precision and real-time monitoring capability are insufficient

Engineering Contradiction:

Improvesensitive data detection precisionVSAvoidsystem complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent introduces WebAssembly (WASM) modules as intermediary components deployed within service mesh sidecars. These WASM modules act as mediators between the service mesh infrastructure and the sensitive data detection logic, enabling precise pattern matching for sensitive information without requiring complex native code deployment. The WASM intermediary layer provides portable, secure, and efficient detection capabilities while maintaining system modularity.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces traditional mechanical or native code-based data inspection mechanisms with WebAssembly technology. Instead of using complex native binaries or heavy security appliances, the system substitutes these with lightweight, sandboxed WASM modules that can be easily deployed and updated. This substitution maintains detection precision while significantly reducing deployment complexity and improving portability across different service mesh environments.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If comprehensive data monitoring is implemented, then sensitive data protection improves, but data processing time increases

Engineering Contradiction:

Improvedata protection reliabilityVSAvoiddata processing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent implements preliminary action by pre-compiling sensitive data detection patterns into optimized WebAssembly modules before deployment. The WASM modules contain pre-processed regex patterns and detection logic that are ready for immediate execution. This preliminary preparation enables the system to perform fast, real-time detection of sensitive data without incurring compilation or interpretation overhead during actual data processing, thus maintaining both reliability and speed.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent changes the execution parameters of detection logic by using WebAssembly's intermediate representation and optimized runtime execution. The detection patterns are transformed from traditional scripting or native code into WASM bytecode, which can be executed with significantly improved performance characteristics. This parameter change in the execution environment allows comprehensive monitoring without proportionally increasing processing time, as WASM provides both safety and speed.

Inventive Principle:

Principle #35Parameter changes

3Adaptability or versatility

If custom detection logic is deployed in service mesh, then detection capability improves, but deployment complexity and maintenance difficulty increase

Engineering Contradiction:

Improvedetection capabilityVSAvoiddeployment ease

Core Design Contradiction:

Adaptability or versatilityVSEase of manufacture

Solution Approach 1:

The patent achieves universality by using WebAssembly as a common deployment format that can run across different service mesh platforms and environments. The WASM modules encapsulate custom detection logic in a portable, platform-independent manner, allowing the same detection capability to be deployed universally across various service mesh implementations without modification. This universal format simplifies deployment while maintaining high adaptability and custom detection capabilities.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The patent applies segmentation by separating detection logic into independent, modular WASM modules that can be developed, tested, and deployed independently. Each WASM module represents a discrete detection capability that can be individually managed, updated, and scaled. This segmentation reduces deployment complexity by allowing incremental rollout and independent maintenance of different detection functions, while still providing comprehensive and adaptable detection coverage when modules work together.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS12579301B2Data plane management systems and methods

Publication Date: 2026.03.17 F5 NETWORKS INC

AI summary

Systems and methods for data plane management are disclosed herein. An example method includes deploying a WASM that is embedded in a service routing layer of the service mesh, assigning a security policy to the WASM from a bootstrapping layer of the service mesh, the security policy enabling the WASM to detect patterns in the service mesh data that are indicative of sensitive information, evaluating service mesh data by the WASM with the security policy, and transmitting telemetry to a cloud-based command module when the WASM has detected patterns in the service mesh data.