Secure message handling of an application across deployment locations

A computer system, comprising one or more processors, one or more memories, and one or more computer readable hardware storage devices, said one or more hardware storage device containing program code executable by the one or more processors via the one or more memories to implement a method for secure message handling of an application across deployment locations, said method comprising:

• said one or more processors analyzing the application to identify one or more processing nodes of multiple processing nodes, wherein the one or more processing nodes reference one or more data aspects, wherein the application processes a first message comprising a plurality of data aspects that include the one or more data aspects, and wherein each data aspect in the first message includes aspect data having a data aspect value in one or more fields in the first message;
• said one or more processors ascertaining whether the one or more data aspects are accessed by an identified processing node of the multiple processing nodes, wherein access to each data aspect of the one or more data aspects requires a data aspect value of said each data aspect of the one or more data aspects to be known;
• if said ascertaining ascertains that the one or more data aspects are accessed by the identified processing node, then said one or more processors determining a restriction for the identified processing node based on the respective deployment constraints included in the accessed one or more data aspects and deploying the identified processing node according to the determined restriction for the identified processing node;
• if said ascertaining ascertains that none of the one or more data aspects are accessed by the identified processing node, then said one or more processors marking the identified processing node or a preceding processing node that precedes the identified processing node to indicate a required tokenization of the one or more data aspects, said tokenization removing the deployment constraints for the identified processing node;
• said one or more processors transforming the first message into a second message, said transforming comprising moving a restriction in the first message into the second message, said restriction being annotated in the first message and not being annotated in the second message, said one or more processing nodes comprising metadata pertaining to the restriction;
• and
• said one or more processors tracking the one or more processing nodes, said restriction in the second message being identified by said tracking instead of being identified by annotation.

A computer program product, comprising one or more computer readable hardware storage devices having computer readable program code stored therein, said program code containing instructions executable by one or more processors of a computer system to implement a method for secure message handling of an application across deployment locations, said method comprising:

• said one or more processors analyzing the application to identify one or more processing nodes of multiple processing nodes, wherein the one or more processing nodes reference one or more data aspects, wherein the application processes a first message comprising a plurality of data aspects that include the one or more data aspects, and wherein each data aspect in the first message includes aspect data having a data aspect value in one or more fields in the first message;
• said one or more processors ascertaining whether the one or more data aspects are accessed by an identified processing node of the multiple processing nodes, wherein access to each data aspect of the one or more data aspects requires a data aspect value of said each data aspect of the one or more data aspects to be known;
• if said ascertaining ascertains that the one or more data aspects are accessed by the identified processing node, then said one or more processors determining a restriction for the identified processing node based on the respective deployment constraints included in the accessed one or more data aspects and deploying the identified processing node according to the determined restriction for the identified processing node;
• if said ascertaining ascertains that none of the one or more data aspects are accessed by the identified processing node, then said one or more processors marking the identified processing node or a preceding processing node that precedes the identified processing node to indicate a required tokenization of the one or more data aspects, said tokenization removing the deployment constraints for the identified processing node;
• said one or more processors transforming the first message into a second message, said transforming comprising moving a restriction in the first message into the second message, said restriction being annotated in the first message and not being annotated in the second message, said one or more processing nodes comprising metadata pertaining to the restriction;
• and
• said one or more processors tracking the one or more processing nodes, said restriction in the second message being identified by said tracking instead of being identified by annotation message being identified by constraint tracking instead of being identified by annotation.