Multi-tiered protection platform

• US 10,263,955 B2
• Filed: 03/16/2018
• Issued: 04/16/2019
• Est. Priority Date: 12/14/2015
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Cismas, Sorin, Kurian, Manu
• Primary Examiner(s): Shehni, Ghazal B
• Application Number:
  US15/923,069
• Publication Number:
  US 20180205702A1
• Time in Patent Office: 396 Days
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A multi-tier platform provides security at a perimeter of a computer system, where an intermediate layer interacts between a web layer and an application layer. A data request that is associated with a data set is received at the web layer and passed to the intermediate layer. The intermediate layer determines the authoritative source for the data set and whether the data set has a static or dynamic value. If the value is static, the intermediate layer accesses the value stored at the intermediate layer. However, if the value is dynamic, the intermediate layer queries the source registered to the data set, obtains the value from the authoritative source, and returns the dynamic value via the web layer, where the registered source may be internal or external to the computer system. Consequently, the intermediate layer may function as an aggregate layer that supports both database and messaging services.

Claims

1. An apparatus for supporting an intermediate layer comprising:

a processor;

a memory device;

a storage subsystem;

a first communication interface configured to communicate with a plurality of sources of data, wherein the plurality of sources comprises first, second, and third sources;

a second communication interface interconnected with a web layer;

an intermediate layer module stored in the memory device, executable by the processor, wherein the intermediate layer module supports an intermediate layer that interacts with the web layer, the intermediate layer module configured to cause the processor to;

receive a data request through the second communication interface for requested data through the web layer, wherein the requested data comprises a first data component and wherein the first source is registered for the first data component and wherein the requested data further comprises a second data component;

when the first data component comprises dynamic data,

generate a first message to the first source via the first communication interface to access the first data component, wherein the first source comprises an external source of an external service provider and wherein the apparatus interacts with the external service provider via the first communication interface without interacting with the web layer; and

receive a first response with the first data component from the first source via the first communication interface;

when the second data component comprises static data,

access the second data component from the storage subsystem at the intermediate layer, wherein the second source is registered for the second data component; and

return the requested data to the web layer via the second communication interface.

2. The apparatus of claim 1, wherein the intermediate layer module is further configured to cause the processor to:

when a time to access the second data component is past an expiration time limit, send a second message to the second source for an updated second data component;

receive a second response with the updated second data component; and

replace the second data component with the updated second data component at the storage subsystem.

3. The apparatus of claim 1, wherein the requested data further comprises a third data component and wherein the intermediate layer module is further configured to cause the processor to:

when the third data component comprises dynamic data, generate a third message to the third source via the first communication interface to access the third data component, wherein the third source is registered for the third data component and wherein the third source is different from the first source; and

receive a third response with the third data component from the third source via the first communication interface.

4. The apparatus of claim 1, wherein the first source comprises an application associated with an application layer and wherein the intermediate layer interacts between the web layer and the application layer.

5. The apparatus of claim 1, wherein the requested data comprises a plurality of data components and wherein the intermediate layer module is further configured to cause the processor to:

map the requested data into the plurality of data components;

when one data component of the plurality of data components comprises dynamic data,

generate a corresponding message to a registered source via the first communication interface to access said one data component; and

receive a corresponding response with said one data component from the registered source via the first communication interface; and

when said one data component comprises static data, access said one data component from the storage subsystem at the intermediate layer, wherein said one data component is registered for the registered source.

6. The apparatus of claim 5, wherein the intermediate layer module is further configured to cause the processor to:

repeat the generating, receiving, and accessing for all remaining data components of the plurality of data components.

7. The apparatus of claim 5, wherein the intermediate layer module is further configured to cause the processor to:

deny access to said one data component when returning the requested data to the web layer via the second communication interface.

8. The apparatus of claim 1, wherein the apparatus comprises a third communication interface and wherein the intermediate layer module is further configured to cause the processor to:

receive a configuration message via the third communication interface; and

register the first data component to the first source based on the configuration message.

9. One or more non-transitory computer-readable media for supporting an intermediate layer that interacts with a web layer and having computer-executable instructions stored thereon, the computer-readable media comprising:

a first set of codes for causing a computing device to receive a data request for requested data through the web layer, wherein the requested data comprises a first data component and wherein a first source is registered for the first data component;

a second set of codes for causing the computing device to generate a first message to the first source to access the first data component when the first data component comprises dynamic data, wherein the first source comprises an external source of an external service provider and wherein the intermediate layer interacts with the external service provider without interacting with the web layer;

a third set of codes for causing the computing device to receive, in response to generating the first message, a first response with the first data component from the first source;

a fourth set of codes for causing the computing device to return the requested data to the web layer; and

a fifth set of codes for causing the computing device to access a second data component from a storage subsystem at the intermediate layer when the second data component comprises static data, wherein the requested data comprises the second data component and wherein a second source is registered for the second data component.

10. The computer-readable media of claim 9, further comprising:

a sixth set of codes for causing the computing device to send a second message to the second source for an updated second data component when a time to access the second data component is past an expiration time limit;

a seventh set of codes for causing the computing device to receive a second response with the updated second data component; and

an eighth set of codes for causing the computing device to replace the second data component with the updated second data component at the storage subsystem.

11. The computer-readable media of claim 9, further comprising:

a ninth set of codes for causing the computing device to generate a third message to a third source to access a third data component when the third data component comprises dynamic data, wherein the requested data comprises the third data component, the third source is registered for the third data component, and the third source is different from the first source; and

a tenth set of codes for causing the computing device to receive a third response with the third data component from the third source.

12. The computer-readable media of claim 9, further comprising:

an eleventh set of codes for causing the computing device to map the requested data into a plurality of data components;

a twelfth set of codes for causing the computing device to, when one data component of the plurality of data components comprises dynamic data, generate a corresponding message to a registered source via a first communication interface to access said one data component;

a thirteenth set of codes for causing the computing device to receive, responsive to the generating, a corresponding response with said one data component from the registered source;

a fourteenth set of codes for causing the computing device to access said one data component from the storage subsystem at the intermediate layer when said one data component comprises static data, wherein said one data component is registered for the registered source; and

a fifteenth set of codes for causing the computing device to repeat the generating, receiving, and accessing for all remaining data components of the plurality of data components.

13. A method for supporting an intermediate layer that interacts with a web layer, the method comprising:

receiving a data request for requested data through the web layer, wherein the requested data comprises a first data component and wherein a first source is registered for the first data component;

when the first data component comprises dynamic data,

generating a first message to the first source via a first communication interface to access the first data component, wherein the first source comprises an external source of an external service provider and wherein the intermediate layer interacts with the external service provider via the first communication interface without interacting with the web layer;

receiving a first response with the first data component from the first source; and

returning the requested data to the web layer; and

when a second data component comprises static data, accessing the second data component from a storage subsystem at the intermediate layer, wherein the requested data further comprises the second data component and wherein a second source is registered for the second data component.

14. The method of claim 13, further comprising:

when a time to access the second data component is past an expiration time limit, sending a second message to the second source for an updated second data component;

receiving a second response with the updated second data component; and

replacing the second data component with the updated second data component at the storage subsystem.

15. The method of claim 13, further comprising:

when a third data component comprises dynamic data, generating a third message to a third source to access the third data component, wherein the requested data further comprises the third data component, the third source is registered for the third data component, and the third source is different from the first source; and

receiving a third response with the third data component from the third source.

16. The method of claim 13, further comprising:

mapping the requested data into a plurality of data components;

when one data component of the plurality of data components comprises dynamic data,

generating a corresponding message to a registered source to access said one data component; and

receiving a corresponding response with said one data component from the registered source via the first communication interface;

when said one data component comprises static data, accessing said one data component from the storage subsystem at the intermediate layer, wherein said one data component is registered for the registered source; and

repeating the generating, receiving, and accessing for all remaining data components of the plurality of data components.