Publish-subscribe broker network overlay system
Systems and methods for a publish-subscribe broker network that distributes data packets between authorized entities and includes one or more publish-subscribe brokers. Each publish-subscribe broker is reachable by an entity attempting to connect thereto via a transport network configured to transport IP packets. The publish-subscribe brokers are configured to check credentials of entities attempting to connect to the publish-subscribe broker network and ensure that first and second entities are authorized for publishing packets on the secured named channel or for receiving published packets via the secured named channel. Cipher keys are used by the first and second authorized entities to encrypt and decrypt messages distributed via the publish-subscribe broker network and the publish-subscribe brokers are configured to route encrypted messages as data packets on behalf of the first authorized entity to the second authorized entity using the secured named channel.
1 . A non-transitory computer-readable medium storing instructions that, when executed by at least one processor, cause the at least one processor to:
generate a first publish-subscribe broker structured to form a publish-subscribe broker network with a second publish-subscribe broker, wherein:
the publish-subscribe broker network includes a third publish-subscribe broker,
the first publish-subscribe broker and the second publish-subscribe broker execute on respective host computers, and
the publish-subscribe broker network comprises a secured named channel and another secured named channel;
receive, via the first publish-subscribe broker, an encrypted message from a first authorized entity;
prior to routing the encrypted message from the first publish-subscribe broker through the second publish-subscribe broker, check, via the first publish-subscribe broker, credentials of the first authorized entity to verify that the first authorized entity is authorized to publish the encrypted message on the secured named channel;
publish, via the first publish-subscribe broker, the encrypted message on the secured named channel by routing the encrypted message from the first publish-subscribe broker through the second publish-subscribe broker to a second authorized entity subscribed to the secured named channel, the second authorized entity being subscribed to the secured named channel via the second publish-subscribe broker;
publish, via the first publish-subscribe broker, the encrypted message on the secured named channel by routing the encrypted message from the first publish-subscribe broker through the third publish-subscribe broker to a third authorized entity subscribed to the secured named channel, the third authorized entity subscribed to the secured named channel via the third publish-subscribe broker;
distribute a cipher key, via a key management application, to the first authorized entity, the second authorized entity, and the third authorized entity, wherein the cipher key is for the encrypted message;
receive, via the first publish-subscribe broker, another encrypted message from the first authorized entity;
publish, via the first publish-subscribe broker, the another encrypted message on the another secured named channel by routing the another encrypted message from the first publish-subscribe broker through the third publish-subscribe broker to the third authorized entity when the third authorized entity is subscribed to the another secured named channel via the third publish-subscribe broker, wherein the another encrypted message is routed, via the first publish-subscribe broker, through the second publish-subscribe broker before the third publish-subscribe broker; and
generate a service application structured to:
connect to the publish-subscribe broker network and provide, to an authorized entity connecting to the publish-subscribe broker network, an IP address and a port number of a closest publish-subscribe broker, of the publish-subscribe broker network, that is the closest to a physical location of the authorized entity.
2 . The non-transitory computer-readable medium of claim 1 , wherein a single connection between the second authorized entity and the second publish-subscribe broker is used to send and receive data packets between the second authorized entity and both the first authorized entity and the third authorized entity.
3 . The non-transitory computer-readable medium of claim 1 , wherein the secured named channel is a multi-party channel with a prescribed set of authorized publisher entities and a prescribed set of authorized subscriber entities.
4 . The non-transitory computer-readable medium of claim 3 , wherein the prescribed set of authorized publisher entities for the multi-party channel includes those entities that are authorized to publish on the multi-party channel via at least one of:
an original secure channel registration; or
an authorized update to the original secure channel registration.
5 . The non-transitory computer-readable medium of claim 4 , wherein the prescribed set of authorized subscriber entities on the multi-party channel includes entities authorized to subscribe on the multi-party channel via at least one of:
an original secure channel registration; or
an authorized update to the original secure channel registration.
6 . The non-transitory computer-readable medium of claim 5 , wherein the multi-party channel allows for one-to-many, many-to-one, and many-to-many communications among authorized entities.
7 . A method comprising:
generating, via at least one processor, a first publish-subscribe broker structured to form a publish-subscribe broker network with a second publish-subscribe broker, wherein:
the publish-subscribe broker network includes a third publish-subscribe broker,
the first publish-subscribe broker and the second publish-subscribe broker execute on respective host computers, and
the publish-subscribe broker network comprises a secured named channel and another secured named channel;
receiving, via the first publish-subscribe broker, an encrypted message from a first authorized entity;
prior to routing the encrypted message from the first publish-subscribe broker through the second publish-subscribe broker, checking, via the first publish-subscribe broker, credentials of the first authorized entity to verify that the first authorized entity is authorized to publish the encrypted message on the secured named channel;
publishing, via the first publish-subscribe broker, the encrypted message on the secured named channel by routing the encrypted message from the first publish-subscribe broker through the second publish-subscribe broker to a second authorized entity subscribed to the secured named channel, the second authorized entity being subscribed to the secured named channel via the second publish-subscribe broker;
publishing, via the first publish-subscribe broker, the encrypted message on the secured named channel by routing the encrypted message from the first publish-subscribe broker through the third publish-subscribe broker to a third authorized entity subscribed to the secured named channel, the third authorized entity subscribed to the secured named channel via the third publish-subscribe broker;
distributing a cipher key, via a key management application executing on the at least one processor, to the first authorized entity, the second authorized entity, and the third authorized entity, wherein the cipher key is for the encrypted message;
receiving, via the first publish-subscribe broker, another encrypted message from the first authorized entity;
publishing, via the first publish-subscribe broker, the another encrypted message on the another secured named channel by routing the another encrypted message from the first publish-subscribe broker through the third publish-subscribe broker to the third authorized entity when the third authorized entity is subscribed to the another secured named channel via the third publish-subscribe broker, wherein the another encrypted message is routed, via the first publish-subscribe broker, through the second publish-subscribe broker before the third publish-subscribe broker; and
generating, via the at least one processor, a service application structured to:
connect to the publish-subscribe broker network and provide, to an authorized entity connecting to the publish-subscribe broker network, an IP address and a port number of a closest publish-subscribe broker, of the publish-subscribe broker network, that is the closest to a physical location of the authorized entity.
8 . The method of claim 7 further comprising:
sending and receiving, via a single connection between the second authorized entity and the second publish-subscribe broker, data packets between the second authorized entity and both the first authorized entity and the third authorized entity.
9 . The method of claim 7 , wherein the secured named channel is a multi-party channel with a prescribed set of authorized publisher entities and a prescribed set of authorized subscriber entities.
10 . The method of claim 9 , wherein the prescribed set of authorized publisher entities for the multi-party channel includes those entities that are authorized to publish on the multi-party channel via at least one of:
an original secure channel registration; or
an authorized update to the original secure channel registration.
11 . The method of claim 10 , wherein the prescribed set of authorized subscriber entities on the multi-party channel includes entities authorized to subscribe on the multi-party channel via at least one of:
an original secure channel registration; or
an authorized update to the original secure channel registration.
12 . The method of claim 11 , wherein the multi-party channel allows for one-to-many, many-to-one, and many-to-many communications among authorized entities.
13 . A system comprising:
at least one processor and a memory device that stores an application that, when loaded into the at least one processor, causes the at least one processor to:
generate a first publish-subscribe broker structured to form a publish-subscribe broker network with a second publish-subscribe broker, wherein:
the publish-subscribe broker network includes a third publish-subscribe broker,
the first publish-subscribe broker and the second publish-subscribe broker execute on respective host computers, and
the publish-subscribe broker network comprises a secured named channel and another secured named channel;
receive, via the first publish-subscribe broker, an encrypted message from a first authorized entity;
prior to routing the encrypted message from the first publish-subscribe broker through the second publish-subscribe broker, check, via the first publish-subscribe broker, credentials of the first authorized entity to verify that the first authorized entity is authorized to publish the encrypted message on the secured named channel;
publish, via the first publish-subscribe broker, the encrypted message on the secured named channel by routing the encrypted message from the first publish-subscribe broker through the second publish-subscribe broker to a second authorized entity subscribed to the secured named channel, the second authorized entity being subscribed to the secured named channel via the second publish-subscribe broker;
publish, via the first publish-subscribe broker, the encrypted message on the secured named channel by routing the encrypted message from the first publish-subscribe broker through the third publish-subscribe broker to a third authorized entity subscribed to the secured named channel, the third authorized entity subscribed to the secured named channel via the third publish-subscribe broker;
distribute a cipher key, via a key management application, to the first authorized entity, the second authorized entity, and the third authorized entity, wherein the cipher key is for the encrypted message;
receive, via the first publish-subscribe broker, another encrypted message from the first authorized entity;
publish, via the first publish-subscribe broker, the another encrypted message on the another secured named channel by routing the another encrypted message from the first publish-subscribe broker through the third publish-subscribe broker to the third authorized entity when the third authorized entity is subscribed to the another secured named channel via the third publish-subscribe broker, wherein the another encrypted message is routed, via the first publish-subscribe broker, through the second publish-subscribe broker before the third publish-subscribe broker; and
generate a service application structured to:
connect to the publish-subscribe broker network and provide, to an authorized entity connecting to the publish-subscribe broker network, an IP address and a port number of a closest publish-subscribe broker, of the publish-subscribe broker network, that is the closest to a physical location of the authorized entity.
14 . The system of claim 13 , wherein a single connection between the second authorized entity and the second publish-subscribe broker is used to send and receive data packets between the second authorized entity and both the first authorized entity and the third authorized entity.
15 . The system of claim 13 , wherein the secured named channel is a multi-party channel with a prescribed set of authorized publisher entities and a prescribed set of authorized subscriber entities.
16 . The system of claim 15 , wherein the prescribed set of authorized publisher entities for the multi-party channel includes those entities that are authorized to publish on the multi-party channel via at least one of:
an original secure channel registration; or
an authorized update to the original secure channel registration.
17 . The system of claim 16 , wherein the prescribed set of authorized subscriber entities on the multi-party channel includes entities authorized to subscribe on the multi-party channel via at least one of:
an original secure channel registration; or
an authorized update to the original secure channel registration.
18 . The system of claim 17 , wherein the multi-party channel allows for one-to-many, many-to-one, and many-to-many communications among authorized entities.