Patent Application
20100131600
Currently in WebSphere MQ (a family of network communication software products launched by IBM in 1992) and in other message-oriented middleware (MOM) products, a sender can send a message to a particular queue (in a point-to-point model), but the sender does not have the ability to authorize or control who can get or view the messages. Generally, MOM is a client/server infrastructure embodied by software that resides in both portions of client/server architecture and typically supports asynchronous calls between the client and server applications. However, similar arrangements can be made in a point-to-point (client-to-client) environment as well. In any environment employed, message queues provide temporary storage when the destination program is busy or not connected.
Currently, if there are two are more receivers (or “consumers”) polling on the same queue for messages, as long as the consumers have authority to access the queue itself then any of them can retrieve any message from the queue. This clearly creates problems from a security point of view, and solutions have indeed been attempted.
In one solution, the sender can set message properties on the message and send the message to the queue, while the consumer/receiver can then specify message selectors to retrieve only specific messages from the queue. However, this merely results in client-side security, meaning any malicious application need not necessarily specify a message selector and can still pull messages from queue.
In another solution, different queues can be used for different kinds of messages, or “virtual queues” can be used which point to the local queue and to users configured for those virtual queues. While this does more to address security issues, it leads to a great increase in administrative and “housekeeping” tasks, such as the need to maintain multiple queues, while an undesirable byproduct is that multiple I/O resources are consumed.
Broadly contemplated herein, in accordance with at least one embodiment of the invention, is an arrangement wherein a sender tags messages with authorization information identifying those users or groups who are authorized to view or receive the messages. Thus, even if multiple users will be connected to the same queue for reading messages, only specific receivers/consumers will be able to get the messages. Not only is a comfortable degree of security ensured, but the need to waste system resources, e.g., by using multiple queues for different kinds of messages, is summarily avoided.
In summary, this disclosure describes a method comprising providing a physical computing device, providing message-oriented middleware at the physical computing device, appending a masking property to a message, sending the message to the message-oriented middleware, accepting information relating to a receiver, validating the accepted receiver information, and availing the message to the receiver upon successful validation of the receiver information.
This disclosure also described an apparatus comprising a physical computing device, the physical computing device comprising a main memory, message-oriented middleware provided at the physical computing device and being in communication with the main memory, an appender which acts to append a masking property to a message, a sender which acts to send a message to the message-oriented middleware, an accepter which accepts information relating to a receiver, a validator which validates accepted receiver information, and an availer which avails a message to a receiver upon successful validation of receiver information.
Furthermore, this disclosure additionally describes a program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform a method comprising: providing a physical computing device, providing message-oriented middleware at the physical computing device, appending a masking property to a message, sending the message to the message-oriented middleware, accepting information relating to a receiver, validating the accepted receiver information, and availing the message to the receiver upon successful validation of the receiver information.
It will be readily understood that the embodiments of the invention, as generally described and illustrated in the Figures herein, may be arranged and designed in a wide variety of different configurations. Thus, the following more detailed description of the embodiments of the apparatus, system, and method of the embodiments of the invention, as represented in
Reference throughout this specification to “one embodiment” or “an embodiment” (or the like) means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Thus, appearances of the phrases “in one embodiment” or “in an embodiment” in various places throughout this specification are not necessarily all referring to the same embodiment.
Furthermore, the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided, such as examples of programming, software modules, user selections, network transactions, database queries, database structures, hardware modules, hardware circuits, hardware chips, etc., to provide a thorough understanding of embodiments of the invention. One skilled in the relevant art will recognize, however, that embodiment of the invention can be practiced without one or more of the specific details, or with other methods, components, materials, etc. In other instances, well-known structures, materials, or operations are not shown or described in detail to avoid obscuring aspects of embodiments of the invention.
The illustrated embodiments of the invention will be best understood by reference to the drawings, wherein like parts are designated by like numerals or other labels throughout. The following description is intended only by way of example, and simply illustrates certain selected embodiments of devices, systems, and processes.
Referring now to
As shown in
PCI local bus 50 supports the attachment of a number of devices, including adapters and bridges. Among these devices is network adapter 66, which interfaces computer system 12 to a local area network (LAN), and graphics adapter 68, which interfaces computer system 12 to display 69. Communication on PCI local bus 50 is governed by local PCI controller 52, which is in turn coupled to non-volatile random access memory (NVRAM) 56 via memory bus 54. Local PCI controller 52 can be coupled to additional buses and devices via a second host bridge 60.
Computer system 12 further includes Industry Standard Architecture (ISA) bus 62, which is coupled to PCI local bus 50 by ISA bridge 64. Coupled to ISA bus 62 is an input/output (I/O) controller 70, which controls communication between computer system 12 and attached peripheral devices such as a keyboard and mouse. In addition, I/O controller 70 supports external communication by computer system 12 via serial and parallel ports, including communication over a wide area network (WAN) such as the Internet. A disk controller 72 is in communication with a disk drive 200 for accessing external memory. Of course, it should be appreciated that the system 12 may be built with different chip sets and a different bus structure, as well as with any other suitable substitute components, while providing comparable or analogous functions to those discussed above.
Reference may now be made herethroughout to
As mentioned above, there is broadly contemplated herein, in accordance with at least one embodiment of the invention, an arrangement wherein a sender tags messages with authorization information identifying those users or groups who are authorized to view or receive the messages.
For example, in a banking environment, there can be one common queue called “Account”, where both “SavingsAccount” and “CurrentAccount” users can connect to the same queue. If it is assumed that messages for both Savings and Current account can be sent to the same queue then, in accordance with embodiments of the invention, even though SavingsAccount users and CurrentAccount users are connected to the same queue, each group user will be able to view or receive only their group specific messages, thereby reducing the overhead of maintaining multiple queues and multiple I/O resources. Accordingly, there is broadly contemplated, in accordance with embodiments of the invention, an arrangement for securing or masking a message sent by the sender so that only a specified user can view the messages.
Referring to
The disclosure now turns to an example of a solution in accordance with at least one embodiment of the invention. The solution may be implemented essentially on any suitable MOM arrangement, such as WebSphere MQ as the messaging provider. Reference may be made to the process flowchart in
When a sender intends to send a message authorized to a particular user or group (either or which may be regarded as “receiver”), the sender may set a property on the message specifying one or more UserID's corresponding to the intended receiver(s) (302) along with a “masking” property (304) indicating that the message is to be masked. For instance, the masking property can be embodied by “MaskMessage=true”. Accordingly, by way of an illustrative and non-restrictive example, the message may have the following parameters attached to it:
MQMD.DestinedUsers=SavingAccountUser,SavingsAccountGroup
MQMD.MaskMessage=true
The message can then be sent to the MOM (e.g., WebSphere MQ) (306). Once the message is sent, and as long as a potential receiver has not yet connected, no immediate check need be made by the MOM, and nothing more need be done with the message (308, 310). However, when a user at the receiving end does connect to the MOM (308,312) to receive and/or read messages, that user (the receiver) may provide security information implicitly in the form of user-id and/or password. Before the receiver is able to read a message, UserID/Password and/or group memberships can be validated against the “DestinedUsers” property of the message (316). This validation will be primarily done by the server side part of MOM (308,312). If such data match, then the receiver will be able to view and/or receive the message (318).
On the other hand, should there be another user connected to the same queue and that user's UserID does not match the message parameters, then the message will not be visible to that user (320).
Generally, the sender (or sender application) need only specify the UserID or GroupID corresponding to any intended recipient(s), thereby providing the sender with complete control as to who can view or receive the message.
It is to be understood that the invention, in accordance with at least one embodiment, includes elements that may be implemented on at least one general-purpose computer running suitable software programs. These may also be implemented on at least one Integrated Circuit or part of at least one Integrated Circuit. Thus, it is to be understood that the invention may be implemented in hardware, software, or a combination of both.
Generally, embodiments may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment containing both hardware and software elements. An embodiment that is implemented in software may include, but is not limited to, firmware, resident software, microcode, etc.
Furthermore, embodiments may take the form of a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer or any instruction execution system. For the purposes of this description, a computer-usable or computer readable medium can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.
The medium can be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, (or apparatus or device) or a propagation medium. Examples of a computer-readable medium include a semiconductor or solid state memory, magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk and an optical disk. Current examples of optical disks include compact disk-read only memory (CD-ROM), compact disk-read/write (CD-R/W) and DVD.
A data processing system suitable for storing and/or executing program code may include at least one processor coupled directly or indirectly to memory elements through a system bus. The memory elements can include local memory employed during actual execution of the program code, bulk storage, and cache memories which provide temporary storage of at least some program code in order to reduce the number of times code must be retrieved from bulk storage during execution.
Input/output or I/O devices (including but not limited to keyboards, displays, pointing devices, etc.) can be coupled to the system either directly or through intervening I/O controllers.
Network adapters may also be coupled to the system to enable the data processing system to become coupled to other data processing systems or remote printers or storage devices through intervening private or public networks. Modems, cable modems and Ethernet cards are just a few of the currently available types of network adapters.
This disclosure has been presented for purposes of illustration and description but is not intended to be exhaustive or limiting. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiments were chosen and described in order to explain principles and practical application, and to enable others of ordinary skill in the art to understand the disclosure for various embodiments with various modifications as are suited to the particular use contemplated.
Generally, although illustrative embodiments of the present invention have been described herein with reference to the accompanying drawings, it is to be understood that the invention is not limited to those precise embodiments.
