DSM

Appearance

Security Model ​

DSM includes production-oriented security primitives for replication traffic.

Core Protections ​

  • HMAC message signing
  • nonce-based replay protection
  • cluster admission validation
  • sender rate limiting and temporary bans
  • optional payload encryption inside secure envelopes
  • minimum accepted key version for downgrade protection

Spring Boot Properties ​

Security is configured under dsm.security.*.

Key properties:

  • dsm.security.enabled
  • dsm.security.cluster-secret
  • dsm.security.min-acceptable-key-version
  • dsm.security.nonce.window-size
  • dsm.security.nonce.max-clock-drift
  • dsm.security.nonce.max-tracked-senders
  • dsm.security.rate-limit.max-consecutive-failures
  • dsm.security.rate-limit.ban-duration
  • dsm.security.encryption.enabled
  • dsm.security.encryption.algorithm
  • dsm.security.encryption.key-derivation-salt

Payload Encryption ​

Payload encryption is disabled by default. When enabled, DSM encrypts secure-envelope payloads with a built-in AEAD algorithm such as ChaCha20-Poly1305 or AES-256-GCM.

Encryption mode is strict:

  • a node requiring encryption rejects plaintext inbound envelopes before HMAC verification with DSM-2006
  • a plaintext-only node rejects encrypted inbound envelopes because it has no compatible decryptor
  • mixed-mode clusters should be rolled carefully, not left to silently downgrade

Sender Protection ​

Replay protection is bounded per sender. dsm.security.nonce.max-tracked-senders caps retained sender windows and uses LRU eviction when the cap is reached.

Repeated verification failures are handled before expensive decrypt/HMAC work:

  • max-consecutive-failures controls when a sender is temporarily banned
  • ban-duration controls how long the ban lasts
  • banned senders surface as DSM-2007

Operational Advice ​

  • treat the cluster secret as production credential material
  • rotate keys through controlled rollout plans
  • keep serviceId stable because it is part of the isolation model
  • monitor authentication failures and replay rejections through DsmMetrics
  • alert on encryption downgrade rejections and sender bans

Metrics Hooks ​

The metrics SPI includes callbacks for:

  • auth failures
  • replay rejections
  • encryption downgrade rejections
  • sender bans
  • nonce sender evictions
  • admission denials
  • service ID mismatches
  • dropped messages

That lets platform teams connect security events to existing dashboards and alerts.