Modeling topic-based message-oriented middleware within a security system

Patent metadata

Field	Value
Publication number	US-11818152-B2
Application number	US-202017133451-A
Country	US
Kind code	B2
Filing date	Dec 23, 2020
Priority date	Dec 23, 2020
Publication date	Nov 14, 2023
Grant date	Nov 14, 2023

Abstract

A system and a method for modeling topic-based message-oriented middleware (MoM) are provided. The method commences with connecting with a MoM system and converting information associated with the MoM system into a standardized object model. The standardized object model may include a topic-based node associated with a topic, at least one producer application, and at least one consumer application. The at least one producer application provides one or more messages related to the topic to the topic-based node. The at least one consumer application receives the one or more messages from the topic-based node. The method continues with generating a standardized graph of relationships between producers and consumers over a period of time. The method further includes creating a policy, periodically analyzing the standardized graph for at least one deviation from the policy, and issuing an alert in response to detecting the at least one deviation.

First claim

What is claimed is:

1. An enterprise security system for modeling topic-based message-oriented middleware (MoM), the system comprising:
a cloud connector configured to:
connect with a MoM system; and
convert information associated with the MoM system into a standardized object model;
wherein the standardized object model includes:
a topic-based node associated with a topic of the MoM system;
at least one producer application configured to provide one or more messages to the topic-based node, the one or more messages being related to the topic and generated by one or more producers associated with the at least one producer application; and
at least one consumer application configured to receive the one or more messages from the topic-based node, the one or more messages being consumed by one or more consumers associated with the at least one consumer application;

a graphical unit implemented on a computing system communicatively coupled to the MoM system, the computing system having one or more processors communicatively coupled to one or more memory units, the graphical unit configured to generate a standardized graph of relationships between the one or more producers and the one or more consumers over a period of time; and
a policy compute engine configured to:
create a policy;
periodically analyze the standardized graph for at least one deviation from the policy; and
in response to detecting the at least one deviation, issue an alert.

2. The system of claim 1 , wherein the standardized graph is configured to generate data flow diagrams and infrastructure dependencies associated with the MoM system.

3. The system of claim 1 , wherein the at least one deviation is indicative of an operational risk or a cyber risk.

4. The system of claim 3 , wherein the at least one deviation is determined based on at least one of the following events: an unexpected change in usage, a new node, an unexpected change in a node, a new relationship between nodes, a threshold of communications exceeded, events occurring at a different time, a higher Service Level Agreement requirement, a Recovery Time Objective mismatch between nodes, and a Recovery Point Objective mismatch between nodes.

5. The system of claim 1 , wherein the MoM system is associated with one of a private data center, a private cloud, and a public cloud.

6. The system of claim 1 , wherein the policy compute engine is further configured to set permissions to control access to the topic.

7. The system of claim 1 , wherein the policy compute engine is further configured to periodically review critical business functions visualized in the standardized graph.

8. The system of claim 1 , wherein the policy compute engine is further configured to take a mitigating action in response to the alert.

9. The system of claim 1 , wherein the MoM system includes at least one of the following: Kafka, IBM MQ, RabbitMQ, TIBCO Rendezvous, AWS Kinesis, Microsoft Azure Service Bus, Microsoft Message Queuing (MSMQ), NServiceBus, Simple Queue Service (SQS), Simple Notification Service (SNS), Advanced Message Processing System (AMPS), and one or more systems for relaying, routing, or transforming messages.

10. The system of claim 1 , wherein the information received from the MoM system by the cloud connector includes a telemetry feed with events of the MoM system, the cloud connector being configured to convert the events into the relationships and summarize the relationships.

11. The system of claim 1 , wherein the cloud connector is configured to:
periodically:
request a data snapshot of requests from the MoM system; or
receive the data snapshot directly from the MoM system through one or more of the following: logs and accounting information;

determine status information based on the data snapshot; and
convert the status information into the standardized object model.

12. The system of claim 1 , wherein the policy compute engine is further configured to create a report showing the relationships between the one or more producers and the one or more consumers of the MoM system.

13. The system of claim 1 , wherein the policy is created by the policy compute engine based on the one or more producers, the one or more consumers, and the topic.

14. The system of claim 1 , wherein the analyzing the standardized graph is based on one or more of the following: baselined historical data, a set of predetermined permissions, and regulatory requirements.

15. A method for modeling topic-based message-oriented middleware (MoM), the method comprising:
connecting, by a cloud connector, with a MoM system;
converting, by the cloud connector, information associated with the MoM system into a standardized object model, wherein the standardized object model includes:
a topic-based node associated with a topic of the MoM system;
at least one producer application, the at least one producer application providing one or more messages to the topic-based node, the one or more messages being related to the topic and generated by one or more producers associated with the at least one producer application; and
at least one consumer application, the at least one consumer application receiving the one or more messages from the topic-based node, the one or more messages being consumed by one or more consumers associated with the at least one consumer application;

generating, by a graphical unit, a standardized graph of relationships between the one or more producers and the one or more consumers over a period of time;
creating, by a policy compute engine, a policy;
periodically analyzing, by the policy compute engine, the standardized graph for at least one deviation from the policy; and
in response to detecting the at least one deviation, issuing, by the policy compute engine, an alert.

16. The method of claim 15 , further comprising, generating, via the standardized graph, data flow diagrams and infrastructure dependencies associated with the MoM system.

17. The method of claim 15 , further comprising setting, by the policy compute engine, permissions to control access to the topic.

18. The method of claim 15 , further comprising creating, by the policy compute engine, a report showing the relationships between the one or more producers and the one or more consumers of the MoM system.

19. The method of claim 15 , further comprising:
receiving, by the cloud connector, the information from the MoM system, wherein the information includes at least a telemetry feed with events of the MoM system;
converting, by the cloud connector, the events into the relationships; and
summarizing, by the cloud connector, the relationships.

20. An enterprise security system for modeling topic-based message-oriented middleware (MoM), the system comprising:
a cloud connector configured to:
connect with a MoM system;
receive information from the MoM system, wherein the information includes at least a telemetry feed with events of the MoM system;
convert the information associated with the MoM system into a standardized object model;
convert, the events into relationships; and
summarize the relationships;
wherein the standardized object model includes:
a topic-based node associated with a topic of the MoM system;
at least one producer application configured to provide one or more messages to the topic-based node, the one or more messages being related to the topic and generated by one or more producers associated with the at least one producer application; and
at least one consumer application co

Assignees

• Varmour Networks Inc

Inventors

• Ross Colin
• Woolward Marc
• Stewart Keith

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• G06F30/20

  Design optimisation, verification or simulation (optimisation, verification or simulation of circuit designs G06F30/30) · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title