Network architecture using firewalls

• US 20040088409A1
• Filed: 10/31/2002
• Published: 05/06/2004
• Est. Priority Date: 10/31/2002
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP AG (SAP SE)
• Inventors: Braemer, Achim, Paulus, Sachar
• Granted Patent: US 7,313,618 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/10015 Access to distributed or replicated servers, e.g. using brokers

Abstract

Systems, methods, and apparatus, including computer program products, for securing access to a server computer that is operable to process client requests from a client computer. A firewall is located between a dispatcher and the server computer. The firewall prevents requests from the dispatcher'"'"'s side of the firewall from crossing through the firewall. The dispatcher is operable to establish a static connection with the server computer through the firewall, to receive a client request transmitted from the client computer, and to transmit the client request to the server computer through the static connection.

Claims

1. A system for securing access to a server computer, wherein the server computer is operable to process client requests from a client computer, the system comprising:

a dispatcher; and

a firewall between the dispatcher and the server computer, wherein the firewall prevents requests from the dispatcher'"'"'s side of the firewall from crossing through the firewall;

wherein the dispatcher is operable to establish a static connection with the server computer through the firewall, and wherein the dispatcher is further operable to receive a client request from the client computer and to transmit the client request to the server computer through the static connection.

2. The system of claim 1 wherein the dispatcher is operable to directly transmit the client request to the server computer.

3. A system for securing access to a server computer, wherein the server computer is operable to process client requests from a client computer, the system comprising:

a dispatcher;

a first firewall between the client computer and the dispatcher; and

a second firewall between the dispatcher and the server computer, wherein the second firewall prevents requests from the dispatcher'"'"'s side of the second firewall from crossing through the second firewall;

wherein the dispatcher is operable to establish a static connection with the server computer through the second firewall, and wherein the dispatcher is further operable to receive a client request transmitted from the client computer through the first firewall and to transmit the client request to the server computer through the static connection.

4. The system of claim 3 wherein the server computer is further operable to transmit to the dispatcher a request to establish the static connection through the second firewall, and wherein the dispatcher is operable to establish the static connection upon receipt of the server request.

5. The system of claim 3 wherein the dispatcher is operable to directly transmit the client request to the server computer.

6. The system of claim 3 wherein the dispatcher is operable to transmit the client request to the server computer in real time.

7. The system of claim 3, further comprising a plurality of server computers located on the other side of the second firewall from the dispatcher, wherein the dispatcher is further operable to establish a plurality of static connections through the second firewall, each being between the dispatcher and one of the plurality of server computers.

8. The system of claim 7 wherein the dispatcher is further operable to balance a load of client requests by selectively transmitting each of the client requests to an individual one of the plurality of server computers.

9. The system of claim 3 wherein the dispatcher is further operable to encrypt data transmitted over the static connection.

10. The system of claim 3 wherein the dispatcher is further operable to provide security services pertaining to the client request.

11. The system of claim 10 wherein the security services comprise verifying that the client request is authorized.

12. The system of claim 10 wherein the security services comprise verifying the authenticity of the client request.

13. The system of claim 10 wherein the security services comprise scanning the client request for virus infections.

14. The system of claim 3 wherein the first firewall prevents requests from the dispatcher'"'"'s side of the first firewall from crossing through the first firewall.

15. A method comprising:

establishing a static connection between a dispatcher and a server computer through a firewall located between the dispatcher and the server computer, wherein the firewall prevents requests from the dispatcher'"'"'s side of the firewall from passing through the firewall;

receiving a client request from a client computer at the dispatcher; and

transmitting the client request from the dispatcher to the server computer through the static connection.

16. The method of claim 15 wherein the client request is directly transmitted from the dispatcher to the server computer.

17. A method comprising:

establishing a static connection between a dispatcher and a server computer through a second firewall located between the dispatcher and the server computer, wherein the second firewall prevents requests from the dispatcher'"'"'s side of the second firewall from passing through the second firewall;

receiving a client request at the dispatcher, wherein the client request is transmitted from a client computer through a first firewall located between the client computer and the dispatcher; and

transmitting the client request from the dispatcher to the server computer through the static connection.

18. The method of claim 17 wherein the client request is directly transmitted from the dispatcher to the server computer.

19. The method of claim 17 wherein the client request is transmitted from the dispatcher to the server computer in real time.

20. The method of claim 17 wherein the step of transmitting the client request occurs directly after the step of receiving the client request.

21. The method of claim 17 wherein the step of transmitting the client request occurs substantially immediately after the step of receiving the client request.

22. The method of claim 17 wherein the step of transmitting the client request occurs within a specified period of time after the step of receiving the client request.

23. The method of claim 17 further comprising performing security services pertaining to the client request before transmitting the client request from the dispatcher to the server computer.

24. The method of claim 17 further comprising transmitting a request from the server computer to the dispatcher to establish the static connection through the second firewall.

25. The method of claim 17 wherein the first firewall prevents requests from the dispatcher'"'"'s side of the first firewall from crossing through the first firewall.

26. The method of claim 17 further comprising:

transmitting a response to the client request from the server computer to the dispatcher through the static connection; and

transmitting the response from the dispatcher to the client computer through the first firewall.

27. A computer program product, stored on a machine-readable medium, comprising instructions operable to cause a programmable processor to:

establish a static connection between a dispatcher and a server computer through a firewall located between the dispatcher and the server computer, wherein the firewall prevents requests from the dispatcher'"'"'s side of the firewall from passing through the firewall;

receive a client request from a client computer at the dispatcher; and

transmit the client request from the dispatcher to the server computer through the static connection.

28. A computer program product, stored on a machine-readable medium, comprising instructions operable to cause a programmable processor to:

establish a static connection between a dispatcher and a server computer through a firewall located between the dispatcher and the server computer, wherein the firewall prevents requests from the dispatcher'"'"'s side of the firewall from passing through the firewall;

receive a client request from a client computer at the dispatcher; and

directly transmit the client request from the dispatcher to the server computer through the static connection.

29. A computer program product, stored on a machine-readable medium, comprising instructions operable to cause a programmable processor to:

establish a static connection between a dispatcher and a server computer through a second firewall located between the dispatcher and the server computer, wherein the second firewall prevents requests from the dispatcher'"'"'s side of the second firewall from passing through the second firewall;

receive a client request at the dispatcher, wherein the client request is transmitted from a client computer through a first firewall located between the client computer and the dispatcher; and

transmit the client request from the dispatcher to the server computer through the static connection.

30. The computer program product of claim 29 wherein the first firewall prevents requests from the dispatcher'"'"'s side of the first firewall from crossing through the first firewall.

31. A computer program product, stored on a machine-readable medium, comprising instructions operable to cause a programmable processor to:

establish a static connection between a dispatcher and a server computer through a second firewall, wherein the second firewall prevents requests from the dispatcher'"'"'s side of the second firewall from passing through the second firewall;

receive a client request at the dispatcher, wherein the client request is transmitted from a client computer through a first firewall located between the client computer and the dispatcher; and

directly transmit the client request from the dispatcher to the server computer through the static connection.

32. A computer program product, stored on a machine-readable medium, comprising instructions operable to cause a programmable processor to:

establish a static connection between a dispatcher and a server computer through a second firewall, wherein the second firewall prevents requests from the dispatcher'"'"'s side of the second firewall from passing through the second firewall;

receive a client request at the dispatcher, wherein the client request is transmitted from a client computer through a first firewall located between the client computer and the dispatcher; and

substantially immediately after receipt of the client request, transmit the client request from the dispatcher to the server computer through the static connection.

33. A computer program product, stored on a machine-readable medium, comprising instructions operable to cause a programmable processor to:

establish a static connection between a dispatcher and a server computer through a second firewall, wherein the second firewall prevents requests from the dispatcher'"'"'s side of the second firewall from passing through the second firewall;

receive a client request at the dispatcher, wherein the client request is transmitted from a client computer through a first firewall located between the client computer and the dispatcher; and

within a specified period of time after receipt of the client request, transmit the client request from the dispatcher to the server computer through the static connection.

34. A computer program product, stored on a machine-readable medium, comprising instructions operable to cause a programmable processor to:

establish a static connection between a dispatcher and a server computer through a second firewall, wherein the second firewall prevents requests from the dispatcher'"'"'s side of the second firewall from passing through the second firewall;

receive a client request at the dispatcher, wherein the client request is transmitted from a client computer through a first firewall located between the client computer and the dispatcher;

perform security services pertaining to the client request; and

transmit the client request from the dispatcher to the server computer through the static connection.