Hierarchical SOAR Data Replication via Tenant ID Propagation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing hierarchical multitenant Security Orchestration and Automated Response (SOAR) deployments face challenges in managing data flow across multiple tiers, particularly in geographically distributed environments, where network segments differ and VPN connections are not always feasible, leading to issues with message delivery and synchronization.
Innovation Solution
The implementation of a hierarchical SOAR deployment model that uses tenant identifiers (IDs) to control data flow propagation, maintaining parent-tenant IDs and child-tenant IDs within records, and enforcing propagation rules to ensure secure, reliable, and bidirectional synchronization across tiers, preventing infinite looping and handling network disconnects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VPN connections are used to connect network segments in hierarchical SOAR deployment, then secure communication between tiers is improved, but network complexity and connection reliability worsen due to VPN configuration issues and potential disconnects
Solution Approach 1:
The patent introduces an intermediary mechanism (message queue/ broker) that mediates communication between SOAR nodes across different network segments. Instead of relying on direct VPN connections, messages are routed through this intermediary component that handles serialization, deserialization, and forwarding, eliminating the need for complex VPN configurations while maintaining secure communication.
Solution Approach 2:
The system segments the hierarchical SOAR deployment into independent tiers (first tier, second tier, third tier) that can communicate through standardized message interfaces. Each tier operates semi-independently with its own message handling logic, allowing network segments to be managed separately without requiring end-to-end VPN connectivity across the entire hierarchy.
2Reliability
If data is propagated across multiple tiers in hierarchical SOAR deployment, then data synchronization is improved, but infinite looping and synchronization errors worsen
Solution Approach 1:
The patent implements feedback mechanisms where each SOAR node tracks the propagation state of messages and sends acknowledgment signals back through the hierarchy. When a message is propagated from one tier to another, the receiving node generates feedback that prevents re-propagation of the same message, thereby eliminating infinite loops while maintaining synchronization.
Solution Approach 2:
Before propagating data across tiers, the system performs preliminary actions including setting propagation flags, establishing parent-child tier relationships, and configuring message routing rules. These preliminary configurations ensure that data flows in the correct direction through the hierarchy without creating loops, simplifying the overall propagation control.
3Adaptability or versatility
If direct network connectivity is assumed between all tiers, then message delivery simplicity is improved, but adaptability to distributed environments without direct connectivity worsens
Solution Approach 1:
The patent creates a universal message delivery mechanism that functions across multiple network configurations. The message broker and serialization layer are designed to handle both direct-connected environments and distributed environments with indirect connectivity, making the system adaptable to various deployment scenarios without requiring separate delivery mechanisms for each case.
Data Source
AI summary
Systems and methods for facilitating secure and reliable communications among nodes of different tiers of a multi-tenant SOAR deployment are provided. According to one embodiment, data flow propagation within a hierarchy of nodes of the SOAR deployment is controlled. Responsive to creation of a record by a node: (i) when there exists a parent node in the hierarchy, setting a PID of the record to a TID of the parent node; otherwise, to a TID of the node; (ii) when there exists a child node in the hierarchy, setting a CID of the record to the TID of the child node; otherwise, to the TID of the node; and (iii) maintaining a set of propagation rules for the node relating to permissibility of propagation of the record within the hierarchy. During propagation of the record by the node, the PID and the CID of the record are updated.