This is a message flow stereotype to denote that the confidentiality of the delivered messages is protected from the network eavesdropper.

1…n data object

1…n data objects

Restriction: there must be at least one input-output data objects pair going through the message flow
Error: at least 1 incoming-outgoing pair of data objects is required

Restriction: numbers of incoming and outgoing data objects of the message flow must match
Error: number of incoming-outgoing pair of data objects does not match

Restriction: the list of names of incoming data objects must match with the list of names of outgoing data objects
Error: names of incoming and outgoing data objects must match