Apparatus, system, and method for message level security

• US 20060064751A1
• Filed: 09/23/2004
• Published: 03/23/2006
• Est. Priority Date: 09/23/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Zhang, Kai Mike, Khangaonkar, Manoj, Ahuja, Pratima
• Granted Patent: US 7,644,266 B2
• Time in Patent Office: Days
• US Class Current: 726/14
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An apparatus, system, and method are disclosed for selective, end-to-end message level security. The apparatus includes a message class definition module, a security module, and a messaging module. The message class definition module identifies a predetermined message class of an internode message. The security module applies security to the message at an application layer. The security that is applied to the message corresponds to a security level, which depends on the message class of the message. The security may include encryption, authentication, and/or other security features. The messaging module communicates the message between a first node and a second node. A third node, such as a broker, may be interposed between the first and second nodes, in which case the security of the message is preserved at the third node.

Claims

1. An apparatus to facilitate message security, the apparatus comprising:

a message class definition module configured to identify a predetermined message class of an internode message;

a security module configured to apply security to the message at an application layer, the security corresponding to a security level, the security level depending on the message class; and

a messaging module configured to communicate the message between a first node and a second node.

2. The apparatus of claim 1, wherein the messaging module is further configured to communicate the message via a third node interposed between the first node and the second node.

3. The apparatus of claim 2, wherein the third node is configured to preserve the security of the message at the third node.

4. The apparatus of claim 1, wherein the messaging module is further configured to communicate the message in a synchronous communication environment.

5. The apparatus of claim 1, wherein the messaging module is further configured to communicate the message in an asynchronous communication environment.

6. The apparatus of claim 1, further comprising an encryption module configured to encrypt the message.

7. The apparatus of claim 1, further comprising a signature module configured to digitally sign the message.

8. The apparatus of claim 1, wherein the message class definition module is further configured to maintain a message class definition descriptive of a message type within the message class.

9. The apparatus of claim 1, further comprising a security level definition module configured to maintain a security level definition descriptive of the security level.

10. The apparatus of claim 1, further comprising a security level mapping module configured to map the security level to the message class.

11. A system to facilitate message security, the system comprising:

an electronic storage device configured to store a message class definition descriptive of a predetermined message class;

a message apparatus configured to identify an internode message within the predetermined message class and to apply security to the internode message at an application layer, the security corresponding to a security level, the security level depending on the message class; and

a network interface configured to transmit the internode message from a first node to a second node.

12. The system of claim 11, further comprising a security level mapping module configured to map the security level to the message class.

13. The system of claim 11, wherein the message apparatus is further configured to communicate the message in an asynchronous communication environment.

14. A system to facilitate message security, the system comprising:

a first node configured to apply security to a message at an application level, the security corresponding to a security level, the security level depending on a message class of the message;

a broker node configured to receive the message from the first node and to maintain the security of the message at the broker node; and

a second node configured to receive the message from the first node via the broker node.

15. A signal bearing medium tangibly embodying a program of machine-readable instructions executable by a digital processing apparatus to perform operations to facilitate message security, the operations comprising:

identifying a predetermined message class of an internode message;

applying security to the message at an application layer, the security corresponding to a security level, the security level depending on the message class; and

communicating the message between a first node and a second node.

16. The signal bearing medium of claim 15, wherein the instructions further comprise an operation to communicate the message via a third node interposed between the first node and the second node.

17. The signal bearing medium of claim 15, wherein the instructions further comprise an operation to preserve the security of the message at the third node.

18. The signal bearing medium of claim 15, wherein the instructions further comprise an operation to communicate the message further comprises communicating the message in a synchronous communication environment.

19. The signal bearing medium of claim 15, wherein the instructions further comprise an operation to communicate the message in an asynchronous communication environment.

20. The signal bearing medium of claim 15, wherein the instructions further comprise an operation to encrypt the message.

21. The signal bearing medium of claim 15, wherein the instructions further comprise an operation to digitally sign the message.

22. The signal bearing medium of claim 15, wherein the instructions further comprise an operation to maintain a security level definition descriptive of the security level.

23. The signal bearing medium of claim 15, wherein the instructions further comprise an operation to maintain a security level map mapping the security level to the message class.

24. The signal bearing medium of claim 15, wherein the instructions further comprise an operation to maintain a message class definition descriptive of a message type within the message class.

25. A method for message security, the method comprising:

identifying a predetermined message class of an internode message;

applying security to the message at an application layer, the security corresponding to a security level, the security level depending on the message class; and

communicating the message between a first node and a second node.

26. The method of claim 25, wherein communicating the message further comprises communicating the message via a third node interposed between the first node and the second node.

27. The method of claim 25, further comprising preserving the security of the message at the third node.

28. The method of claim 25, wherein applying the security level to the message further comprises encrypting the message.

29. The method of claim 25, wherein applying the security level to the message further comprises digitally signing the message.

30. The method of claim 25, further comprising maintaining a security level map mapping the security level to the message class.

31. A method for message security, the method comprising:

maintaining a security level map mapping a security level to a predetermined message class;

identifying an internode message within the predetermined message class;

applying security to the message at an application layer, the security corresponding to a security level, the security level depending on the message class;

communicating the message between a first node and a second node via a third node interposed between the first node and the second node; and

preserving the security of the message at the third node.

32. An apparatus to facilitate message security, the apparatus comprising:

means for identifying a predetermined message class of an internode message;

means for applying security to the message at an application layer, the security corresponding to a security level, the security level depending on the message class; and

means for communicating the message between a first node and a second node.