TRANSACTION GATEWAY

• US 20140101774A1
• Filed: 05/27/2011
• Published: 04/10/2014
• Est. Priority Date: 05/27/2011
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Armington, John P., Graves, David
• Granted Patent: US 9,275,239 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways

Abstract

According to one aspect of an example, there is provided a transaction gateway in a first network for receiving a transaction from the first network and for sending the transaction to a transaction processor in a second network. The transaction gateway is arranged to identify restricted data in the transaction, to modify the received transaction by replacing identified restricted data with replacement data different to the identified restricted data, and to send the modified transaction to the transaction processor in the second network.

Claims

1. A transaction gateway in a first network for receiving a transaction from the first network and for sending the transaction to a transaction processor in a second network, the transaction gateway being arranged to:

identify restricted data in the transaction;

modify the received transaction by replacing identified restricted data with replacement data different to the identified restricted data; and

send the modified transaction to the transaction processor in the second network.

2. The transaction gateway of claim 1, wherein the transaction gateway is further arranged to:

maintain a mapping database of identified restricted data and corresponding replacement data;

receive a processed transaction from the transaction processor;

modify the received processed transaction by restoring, using the mapping database, data previously replaced in the received transaction; and

send the modified transaction to a destination in the first network, the destination being identified by restored data.

3. The transaction gateway of claim 1, wherein the transaction gateway is further arranged to identify restricted data in the transaction by one of:

identifying data in a predetermined data field in the transaction;

identifying a flag associated with a data field in the transaction;

or performing lexical, textual, or numerical analysis on data in the transaction.

4. The transaction gateway of claim 2, wherein the transaction gateway is further arranged to generate replacement data from which the corresponding restricted data is not directly derivable.

5. The transaction gateway of claim 1, wherein the restricted data is data that is identified as data not to be transmitted outside of the first network.

6. The transaction gateway of claim 1, wherein the restricted data is data that is identified as being subject to legislative restrictions on where the data may be sent.

7. A system for providing a service to a service requestor in a first network, the service being provided by a support center in a second network, the system comprising:

a gateway controller in the first network for receiving a service request from a service requestor in the first network,

the gateway controller arranged to;

identify data in the service request not to be sent outside of the first network;

generate a modified service request by replacing identified data with replacement data; and

send the modified service request to the support center in the second network.

8. The system of claim 7, wherein the gateway controller is further arranged to:

store in a mapping database identified data and associated replacement data;

receive a service request response from the support center;

generate a modified service request response by replacing, using the mapping database, data previously replaced in the service request; and

send the modified service request response to a destination in the first network, the destination being identified by restored data in the modified service request.

9. The system of claim 7, wherein the service requestor in the first network is a computing device, the system further comprising a monitoring application to generate a service request in response to an event detected on the computing device.

10. The system of claim 9, wherein the service request includes a network address or alias of the computing device.

11. The system of claim 10, wherein the service request includes header data and payload data, the gateway controller further comprising:

a network address translator to replace, in the header data, the network address of the computing device in the first network with a network address in the second network.

12. The system of claim 11, wherein the gateway controller further comprises a payload processor to identify data in the data payload not to be sent outside of the first network and to replace such data with replacement data.

13. A tangible, machine-readable medium that stores machine-readable instructions executable by a processor to provide a method of providing a service, the tangible machine-readable medium comprising:

machine readable instructions that, when executed by the processor, provide a proxy on a first network to a support application in a second network, the proxy arranged to;

receive a user identifier from a user of the first network;

replace the user identifier with an anonymized version of the user identifier;

forward the anonymized version of the user identifier to the support application; and

enable the user to interact with the support application in an anonymized manner.

14. The tangible machine-readable medium of claim 13, further comprising machine readable instructions that, when executed by the processor, identifies at the proxy data not to be sent outside of the first network;

machine readable instructions that, when executed by the processor, anonymize any identified data by replacing it with replacement data; and

machine readable instructions that, when executed by the processor, store, in a mapping database, identified data and associated replacement data.

15. The tangible machine-readable medium of claim 14, further comprising:

machine readable instructions that, when executed by the processor, receive a message from the support application, the message including an anonymized user identifier;

machine readable instructions that, when executed by the processor, replace the anonymized user identifier with associated data in the mapping database;

machine readable instructions that, when executed by the processor, obtain, from a directory server, an email address corresponding to the user identifier; and

machine readable instructions that, when executed by the processor, sends the received message to the obtained email address.