Security broker for edge computing environment
A disclosed security broker receives a request message addressed to a message queue associated with an edge resource, identifies the message source, and leverages an authentication module to verify that the source has authorization to access the targeted message queue. The security broker may then deliver the request message to the targeted edge resource message queue. If the edge resource and security broker are physically isolated, the security broker may format the request message as a file, store the file to a storage device, and transfer the storage device to the edge resource, which may then process the file and upload the request message to the edge resource's message queue module. The security broker also monitors a response message from the edge resource, purges sensitive data from the response. If the broker and cloud resource are physically isolated, the response may be formatted and delivered as a file.
1. A method for managing security in an edge computing environment, the method comprising:
receiving, by a security broker, a request message from a cloud platform resource, wherein the request message is addressed to a targeted message queue, wherein the targeted message queue comprises a message queue associated with an edge appliance;
identifying a source of the request message;
retrieving, from the edge appliance, a public key of the targeted message queue; and
determining, based at least in part on the public key of the targeted message queue, whether the source is authorized to access the targeted message queue;
responsive to determining that the source is authorized to access the targeted message queue, forwarding information indicative of the request message to the edge appliance.
2. The method of claim 1 , wherein the security broker is physically isolated from at least one of:
the cloud platform resource; and
the edge computing resource.
3. The method of claim 2 , wherein forwarding the information indicative of the request message includes:
formatting the request message as a request message file in accordance with a file format; and
delivering the request message file to the edge appliance.
4. The method of claim 3 , wherein delivering the request message file comprises delivering the request message file via a universal serial bus (USB) transport and wherein the file format comprises a USB-supported file format.
5. The method of claim 3 , further comprising:
responsive to receiving, from the edge appliance, a response message responsive to the request message:
scanning the response message for sensitive data; and
responsive to detecting sensitive data, taking action to prevent distribution of the sensitive data beyond the edge appliance.
6. The method of claim 5 , further comprising:
formatting the response message as a response message file in accordance with the file format; and
delivering the response message file to the cloud resource.
7. The method of claim 2 , wherein the edge appliance comprises a component of a dark site data center.
8. The method of claim 1 , wherein the determining includes decrypting, based on the public key of the targeted message queue and a predetermined decryption algorithm, an indicator of the source of the request message.
9. An information handling system, comprising:
a central processing unit (CPU); and
a memory or storage resource, communicatively coupled to the CPU, including processor executable instructions, wherein the instructions, when executed by the processor, cause the system to perform security broker operations comprising:
receiving, by a security broker, a request message from a cloud platform resource, wherein the request message is addressed to a targeted message queue, wherein the targeted message queue comprises a message queue associated with an edge appliance;
identifying a source of the request message;
retrieving, from the edge appliance, a public key of the targeted message queue; and
determining, based at least in part on the public key of the targeted message queue, whether the source is authorized to access the targeted message queue;
responsive to determining that the source is authorized to access the targeted message queue, forwarding information indicative of the request message to the edge appliance.
10. The information handling system of claim 9 , wherein the security broker is physically isolated from at least one of:
the cloud platform resource; and
the edge computing resource.
11. The information handling system of claim 10 , wherein forwarding the information indicative of the request message includes:
formatting the request message as a request message file in accordance with a file format; and
delivering the request message file to the edge appliance.
12. The information handling system of claim 11 , wherein delivering the request message file comprises delivering the request message file via a universal serial bus (USB) transport and wherein the file format comprises a USB-supported file format.
13. The information handling system of claim 11 , wherein the security broker operations further comprise:
responsive to receiving, from the edge appliance, a response message responsive to the request message:
scanning the response message for sensitive data; and
responsive to detecting sensitive data, taking action to prevent distribution of the sensitive data beyond the edge appliance.
14. The information handling system of claim 13 , wherein the security broker operations further comprise:
formatting the response message as a response message file in accordance with the file format; and
delivering the response message file to the cloud resource.
15. The information handling system of claim 10 , wherein the edge appliance comprises a component of a dark site data center.
16. The information handling system of claim 9 , wherein the determining includes decrypting, based on the public key of the targeted message queue and a predetermined decryption algorithm, an indicator of the source of the request message.