7

I'm contemplating using Amazon's Simple Queue System as the basis of an enterprise message bus. According to Amazon, the contents are not encrypted, which means the application(s) will have to handle encryption / decryption.

It seems likely that this cryptosystem will need:

  • key distribution among services that access the message bus
  • key rotation / revocation
  • authentication and integrity checks
  • performance (use symmetric encryption)

This seems like an extremely common problem, is there an existing methodology or standard around message bus encryption for these situations?

Improve this question
6
  • Are the readers of the queue known before putting the message in?
    – SEJPM
    Aug 3 '15 at 14:15
  • I hate to put something like "not that I know of" as an answer, but that's about all I could give you. You could of course reuse CMS or XML encryption/digital signature. Those are standardized container formats, but not specifically for message bus systems.
    – Maarten Bodewes
    Aug 3 '15 at 15:29
  • I wouldn't think so @SEJPM ...if its a SOA architecture reading from it, new members might be added or removed
    – Allyl Isocyanate
    Aug 3 '15 at 15:44
  • @MaartenBodewes is CMS appropriate for this sort of thing?
    – Allyl Isocyanate
    Aug 3 '15 at 15:50
  • CMS could certainly be part of an answer. Just using CMS doesn't solve, for instance, the key distribution problems you face. Besides that, there are many ways of using CMS, so you need a specific form of CMS too.
    – Maarten Bodewes
    Aug 6 '15 at 18:53
0

For posterity and folks who end up here from search engines:

Amazon SQS now supports content encryption: https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-server-side-encryption.html#sqs-encryption-what-does-sse-encrypt

From the documentation:

SSE doesn't encrypt the following:

Queue metadata (queue name and attributes)

Message metadata (message ID, timestamp, and attributes)

Per-queue metrics

SQS server-side encryption is backed by Amazon's KMS by default, which are themselves backed by FIPS 140-2 HSMs. Data keys are derived from an account master key on a per-principal basis. Lifetime of these keys is configurable from 1 minute to 24 hours with a default of 5 minutes.

If key residency is not an issue, SSE should solve your problem.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.