Method and system for secure alert messaging

• US 7,240,212 B2
• Filed: 02/18/2003
• Issued: 07/03/2007
• Est. Priority Date: 02/18/2003
• Status: Active Grant

• Current Assignee: UBS Business Solutions AG (UBS Ag)
• Original Assignee: UBS PaineWebber, Inc. (UBS Ag)
• Inventors: Arnone, David J., Kosoy, Alex, Olivares, David R., Samtani, Gunjan, Sexton, David J.
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US10/369,192
• Publication Number:
  US 20040162880A1
• Time in Patent Office: 1,596 Days
• Field of Search: 713/184, 713/182, 726/9, 726/12, 726/20, 709/206
• US Class Current: 713/182
• CPC Class Codes: H04L 12/1895 for short real-time information, e.g. alarms, notifications, alerts, updates
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

An alert messaging system and method to securely transmit and receive alert messages via secure connection among one or more messaging servers and at least one client user station using a token-based, one-way handshake mechanism.

Claims

1. An alert messaging method, comprising:

receiving at a secure web application server a registration request from a user station to receive alert messages from a first messaging server;

registering the user station for receipt of alert messages, the user station being located outside a de-militarized zone interposed between the user station and a cluster of internal messaging servers, the first messaging server being located, inside the de-militarized zone, and the registering further including generating, at a secure web application server, a one-time use token including a user name and password combination;

generating, at the secure web application server, a secure registration response, the response including connection location information for the first messaging server and a combination of a unique login value and a password, wherein the connection information includes a host identifier, port identifier, correlation identifier, and a queue name;

upon subsequent successful matching of the user name and password combination to its corresponding stored value, outputting a connection request to the first messaging server, the first messaging server configured to perform a security exit upon receiving the connection request, the security exit being configured to verify that the one-time use token has not been previously used;

receiving, at the registered user station, alert message notifications from the first messaging server via a first network; and

receiving, at the registered user station, alert message content from a secure web application server via second network.

2. The method of claim 1, wherein generating the secure registration response further comprises:

generating a login value by determining a random number; and

generating a password comprising a multiple digit integer representing a particular date and time.

3. An alert messaging system, comprising:

a cluster of one or more internal messaging servers and one or more alert message routers;

a region of one or more de-militarized zone messaging servers, each of the de-militarized zone messaging servers in a de-militarized zone operably coupled through one or more of the alert message routers to each of the first messaging servers;

the de-militarized zone further including one or more secure web application servers, each of the secure web application servers being coupled to each of the de-militarized zone messaging servers;

at least one client user station, the at least one client user station coupled to at least one of the Java Messaging Service servers and at least one of the secure web application servers, the client user station configured to receive alert messages and including a user interface configured to display the contents of the received alert messages to a user; and

the de-militarized zone comprising a region formed by a first secure firewall interposed between the cluster of internal messaging servers the region and at least a second secure firewall interposed between the external user stations and the region.

4. The system of claim 3, wherein the cluster is a private network.

5. The system of claim 3, wherein the secure web application servers are coupled to the at least one user station via a load balancer.

6. The system of claim 3, wherein the system further includes a database coupled to the alert message routers and the secure web application servers.

7. The system of claim 3, wherein the system further includes a mainframe coupled to the internal messaging servers of the cluster.

8. The system of claim 3, wherein the at least one client user station is coupled to the secure web application server in accordance with the Secure Hypertext Transfer Protocol (HTTPS).

9. The system of claim 3, wherein the at least one client user station is coupled to the de-militarized messaging server via the Java Messaging Service (JMS).

10. An alert messaging system, comprising:

a first messaging server including one or more alert message routers;

at least one second messaging server, the first messaging server coupled through one or more alert message routers to the second messaging servers, the second messaging servers being provided in a neutral zone;

the second messaging servers including at least a Java Messaging Service server and a secure web application servers;

an alert messaging database coupled to each of the alert message routers and each the secure web application servers; and

at least one client user station, the at least one client user station coupled to at least one of the Java Messaging Service servers via a first network and at least one of the secure web application servers via a second network, the client user station configured to receive alert message content from the secure web application server via the second network and alert message notification messages from the Java Messaging Service server via the first network, and including a user interface configured to display the contents of the received alert messages to a user.

11. The system of claim 10, wherein the alert message router further includes processes for the management of alert message content type messages and the routing of alert message notification type messages to particular de-militarized zone messaging servers.

12. The system of claim 10, wherein the alert messages are review and release messages.

13. The system of claim 10, wherein the secure web application servers are coupled to the at least one user station via a load balancer.

14. The system of claim 10, wherein the system further includes a mainframe coupled to the first messaging server.

15. The system of claim 10, wherein the at least one client user station is coupled to the secure web application server in accordance with the Secure Hypertext Transfer Protocol (HTTPS).

16. The system of claim 10, wherein the at least one client user station is coupled to the second messaging server via the Java Messaging Service (JMS).

17. A method of alert messaging, comprising:

receiving at a secure web application server a registration request for a messaging server;

generating, at the secure web application server, a secure registration response, the response including connection location information and a combination of a unique login value and a password, wherein the connection information includes a host identifier, port identifier, correlation identifier, and a queue name;

associating portions of the secure registration response with the requesting user station;

storing the secure registration response and the user station association information in a database;

outputting the secure registration response to the requesting user station from the secure web application server using a network;

receiving, at a messaging server, an alert message from a mainframe;

determining the user stations securely registered and entitled to receive the alert message based on information contained in the database; and

sending the alert message content from the secure web application server to one or more user stations for output to a user.

18. The method of claim 17, wherein generating the secure registration response further comprises:

generating a login value by determining a random number; and

generating a password comprising a multiple digit integer representing a particular date and time.

19. The method of claim 17, further comprising:

receiving an alert message information request from a user station, the information request containing at least the connection location information, unique login value and password provided in the secure registration response;

determining, based on the stored secure registration response, a valid connection between the requesting user station and the messaging server;

performing a security exit;

determining, from the stored secure registration response, whether the unique login value and the password received in the alert message information request has been used previously to access the messaging server; and

if the unique login value and the password received in the alert message registration request has not been used previously, outputting the requested alert message content to the requesting user station.