Scalable brokerless messaging strategy with sidecar security container stack

Patent metadata

Field	Value
Publication number	US-2022263805-A1
Application number	US-202117174848-A
Country	US
Kind code	A1
Filing date	Feb 12, 2021
Priority date	Feb 12, 2021
Publication date	Aug 18, 2022
Grant date	—

Abstract

A scalable brokerless messaging network includes a service mesh implementing a plurality of service nodes in signal communication with one another to exchange a plurality of messages. A control plane is in signal communication with the plurality of service nodes and is configured to register an application service associated with a given service node included in the service mesh. The plurality of service nodes define a messaging middleware layer that establishes several point-to-point connections between each service in the network via transmission control protocol (TCP) sockets.

First claim

What is claimed is:

1 . A scalable brokerless messaging network comprising:
a service mesh including a plurality of service nodes in signal communication with one another to exchange a plurality of messages; and a control plane in signal communication with the plurality of service nodes and configured to register an application service associated with a given service node included in the service mesh, wherein the plurality of service nodes define a messaging middleware layer that establishes several point-to-point connections between each service in the network via transmission control protocol (TCP) sockets.

2 . The scalable brokerless messaging network of claim 1 , wherein each of the service nodes includes a sidecar proxy, the sidecar proxy configured to encrypt an outgoing message generated by a host application process with a public key of a destination service node among the plurality of service nodes, and to decrypt an incoming message with a private key and deliver the decrypted incoming message to a destination application process.

3 . The scalable brokerless messaging network of claim 2 , wherein at least one of the service nodes among the plurality of service nodes operates as a control service node and the remaining service nodes included in the plurality of service nodes service as worker service nodes.

4 . The scalable brokerless messaging network of claim 3 , wherein each instance of the work service nodes is scaled to established individual scaled instances of the worker services.

5 . The scalable brokerless messaging network of claim 4 , wherein the control service node is configured to distribute the messages to each of the individual scaled instance of the worker service nodes according to at least one routing rule defined by the service plane.

6 . The scalable brokerless messaging network of claim 2 , wherein the at least one routing rule provides “zero trust” architecture and mutual Transport Layer Security (mTLS) encryption between each service node among the plurality of service nodes.

7 . The scalable brokerless messaging network of claim 1 , further comprising at least one service forwarder pod in signal communication with the plurality of service nodes, the at least one service forwarder pod configured to aggregate the plurality of messages to a corresponding service nodes and distribute the plurality of messages in accordance with load balancing rules defined by the control plane.

8 . The scalable brokerless messaging network of claim 1 , wherein the messaging middleware layer is implemented in a cloud computing environment.

9 . A method of exchanging data in a scalable brokerless messaging network, the method comprising:
establishing signal communication between a service mesh including a plurality of service nodes to exchange a plurality of messages; establishing signal communication between a control plane and the plurality of service nodes; registering an application service associated with a given service node included in the service mesh and the control plane; and defining a messaging middleware layer via the plurality of service nodes to establish a plurality of point-to-point connections between each service node in the service mesh via transmission control protocol (TCP) sockets.

10 . The method of claim 9 , further comprising:
encrypting, via a sidecar proxy included in at least one of the service nodes, outgoing messages generated by a host application process with a public key of a destination service node among the plurality of service nodes; and decrypting, via the sidecar included in at least one of the service nodes, an incoming message with a private key and deliver the decrypted incoming message to a destination application process.

11 . The method of claim 10 , further comprising establishing a first data connection, via the TCP sockets included in each of the service nodes, a first data connection between the application process and the sidecar proxy; and
establishing a second data connection, via a data socket, between the application process and the sidecar proxy that is independent from the first data connection.

12 . The method of claim 11 , further comprising operating at least one of the service nodes among the plurality of service nodes as a control service node; and
operating the remaining service nodes included in the plurality of service nodes service as worker service nodes.

13 . The method of claim 12 , wherein each instance of the work service nodes is scaled to established individual scaled instances of the worker services.

14 . The method of claim 13 , further comprising distributing, via the control service node, the messages to each of the individual scaled instance of the worker service nodes according to at least one routing rule defined by the service plane.

15 . The method of claim 10 , wherein the at least one routing rule provides “zero trust” architecture and mutual Transport Layer Security (mTLS) encryption between each service node among the plurality of service nodes.

16 . The method of claim 9 , further comprising:
establishing signal communication between at least one service forwarder pod in and the plurality of service nodes; aggregating, via the at least one service forwarder pod, the plurality of messages to a corresponding service node; and distributing the plurality of messages in accordance with load balancing rules defined by the control plane.

17 . The method of claim 9 , wherein the messaging middleware layer is implemented in a cloud computing environment.

18 . A messaging middleware layer included in a scalable brokerless messaging network, the messaging middleware layer comprising:
a first application process included in a first service node and configured to operate according to the messaging middleware layer, the first application process configured to exchange data with at least one second application process included in a at least one second service node, wherein the messaging middleware layer dynamically manages a transmission control protocol (TCP) socket connection established between the first service node and the second service node.

19 . The messaging middleware layer of claim 18 , wherein the first application process detects a message to be published and delivers the message to the at least one second service node based on the TCP socket connection.

20 . The messaging middleware layer of claim 19 , wherein the at least one second application process includes a plurality of second application processes, each second application process having a TCP socket connection with the first application process,
wherein the first service node generates a TCP list including each TCP socket connection corresponding to the plurality of second application processes and delivers the message based on the TCP list.

Assignees

• Raytheon Co

Inventors

• Ray Alex C
• Caldas Juan D

Classifications

• H04L69/162 Primary

  involving adaptations of sockets based mechanisms (secure socket layer H04L63/168) · CPC title

• H04L67/56

  Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) · CPC title

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/166

  at the transport layer · CPC title

• H04L9/30

  Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy · CPC title