Method and transaction interface for secure data exchange between distinguishable networks

• US 7,865,939 B2
• Filed: 09/15/2006
• Issued: 01/04/2011
• Est. Priority Date: 10/30/1999
• Status: Expired due to Fees

• Current Assignee: SAP SE
• Original Assignee: SAP AG (SAP SE)
• Inventors: Schuster, Wolfgang
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Tran; Tongoc
• Application Number:
  US11/522,098
• Publication Number:
  US 20070067837A1
• Time in Patent Office: 1,572 Days
• Field of Search: 726/2, 726/4, 726 11- 14, 726 22- 25, 709/219, 709/229
• US Class Current: 726/4
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes

Abstract

In one embodiment, the present invention includes a method for secure data exchange between an external network and an internal network (1 and 2) via a transaction interface (3), in which an external user can undertake predetermined data transactions within the internal network (2). An interface server (7) and interface memory (11) may be coupled between an external network and an internal network. The present invention discloses security techniquest that may be used, including encryption, request processing, and checking. In one embodiment, a first firewall is coupled between the external network and the interface server and a second firewall is coupled between the interface server and the internal network.

Claims

1. A method of secure data exchange comprising:

receiving, through an external firewall, a user request from an external network in a first interface server;

comparing, on the first interface server, the user request with a set of permissible requests;

storing the user request in an interface memory coupled to the first interface server;

checking, through an internal firewall, the interface memory exclusively from an internal server on an internal network;

processing the user request in the internal server if the user request matches one of the permissible requests; and

not processing the user request in the internal server if it does not match one of the permissible requests.

2. The method of claim 1 wherein the permissible requests have a predefined form and the received user request is verified for compliance with the predefined form.

3. The method of claim 1 wherein communication between the internal server and the first interface server is unidirectional such that calls into the first interface server are only accepted from the internal server and calls into the internal server from the first interface server are not possible.

4. The method of claim 1 further comprising:

generating a processing result in the internal server;

sending the result to the first interface server; and

determining if the result corresponds to the user request.

5. The method of claim 1 further comprising verifying the semantics of the user request.

6. The method of claim 5 further comprising processing the user request in the internal server if the semantics are verified.

7. The method of claim 1 further comprising authenticating the user request and processing the user request if the user request has been authenticated.

8. The method of claim 1 wherein the internal server checks the interface memory at regular intervals.

9. The method of claim 1 wherein the interface memory is scaled based on traffic.

10. A method of secure data exchange comprising:

receiving, from an external network through an external firewall, a user request in a first interface server;

verifying the user request on the first interface server based on permissible requests;

storing the user request in memory coupled to the first interface server if the user request is verified;

querying the memory exclusively from an internal server on an internal network through an internal firewall to determine if the user request was verified as permissible; and

sending the user request to the internal server when the query indicates the user request was verified as permissible, wherein the user request is not sent to the internal server if the query indicates the user request was not permissible.

11. The method of claim 10 wherein the memory is queried at a defined frequency.

12. The method of claim 10 further comprising:

processing the user request in the internal server, and in accordance therewith, generating a result;

sending the result from the internal server to the first interface server, and

determining if the result corresponds to the user request.

13. The method of claim 12 further comprising encrypting the result before sending the result to the first interface server.

14. The method of claim 10 wherein communication between the internal server and the first interface server is unidirectional such that calls into the first interface server are only accepted from the internal server and calls into the internal server from the first interface server are not possible.

15. The method of claim 10 further comprising encrypting the user request before sending the user request to the internal server.

16. The method of claim 15 wherein encrypting is synchronous.

17. The method of claim 15 wherein encrypting is asynchronous.

18. The method of claim 15 wherein encrypting uses a key that expires after a period of time.

19. The method of claim 15 wherein encrypting uses a key that is continuously varied.

20. The method of claim 15 wherein encrypting uses a key that has an individually configurable life so that a narrow time corridor for secure data exchange is opened upon allocation of the key.

21. The method of claim 15 further comprising decrypting the user request on the internal server.

22. The method of claim 10 wherein the user request is sent to the internal server if the user request corresponds to a predetermined transaction.

23. The method of claim 10 wherein verifying the user request comprises verifying the semantics of the user request.

24. A secure data exchange system comprising:

a first interface server;

an interface memory coupled to the first interface server;

a first firewall coupled between the first interface server and an external network;

a second firewall coupled between the first interface server and an internal server on an internal network,

wherein the first interface server receives a user request from the external network, wherein the user request is compared with a set of permissible requests, wherein the user request is stored in the interface memory, and wherein the interface memory is queried exclusively from the internal server; and

wherein the user request is sent to the internal server for processing in response to the query if the user request matches a permissible request, and the user request is not sent to the internal server for processing if the user request does not match the permissible request.

25. The system of claim 24 wherein communication between the internal server and the first interface server is unidirectional.

26. The system of claim 25 wherein calls into the first interface server are only accepted from the internal server and calls into the internal server from the first interface server are not possible.

27. The system of claim 24 wherein the user request is received in the first interface server through the first firewall and the semantics of the user request are verified.

28. The system of claim 27 wherein the user request is stored in the interface memory if the user request is verified.

29. The system of claim 28 wherein the user request is stored in the interface memory in encrypted form.

30. The system of claim 24 wherein the interface memory is interrogated exclusively from the internal network for user requests received from the external network.

31. The system of claim 24 further comprising a second server coupled to the first interface server, wherein the second server converts user requests received from the external network and forwards the results to the first interface server.

32. The system of claim 31 wherein the second server is a web server.

33. The system of claim 31 wherein the second server sends a confirmation of receipt of user requests.

34. The system of claim 24 further comprising a load control module for scaling the interface memory based on traffic.

35. The system of claim 24 further comprising a logging module for logging transactions in the first interface server.

36. A system of secure data exchange comprising:

means for receiving a user request from an external network through an external firewall in a first interface server;

means for comparing, on the first interface server, the user request with a set of permissible requests;

means for storing the user request in the first interface server;

means for checking for stored user requests exclusively from an internal server on an internal network through an internal firewall and sending the user request to the internal network only if the user request matches one of the permissible requests; and

means for processing the user request in the internal network.

37. The system of claim 36 further comprising means for authenticating user requests received from the external network.

38. A method of secure data exchange comprising:

receiving one or more requests from an external user in a portal in an external network to perform a data transaction with an internal network, wherein the requests are conditioned by an interface server in a neutral zone and temporarily stored in precisely defined form in an interface memory in the neutral zone, wherein the neutral zone is behind, in access direction, the external network; and

exclusively interrogating the interface memory from an internal server located in the internal network at a defined frequency,

wherein complete processing of the data transaction includes authenticating the user within the internal network, wherein the user is authenticated while the one or more requests are stored in the interface memory and the one or more requests are not processed within the internal network if the user is not authenticated,

wherein secure data exchange between the external and internal network is via a transaction interface in which the external user performs predetermined data transactions within the internal network, and wherein the transaction interface comprises said portal, said neutral zone, and said internal server.

39. The method of claim 38 wherein the following steps occur in sequence:

a request from the external user is read and acknowledged by the interface server;

an acknowledgement is sent to the external user;

the interface server checks the permissibility of the request by comparison with a set of predetermined permissible requests and the semantic correctness of the request, wherein the request is rejected if the request is in error and the request is further processed if the request is not in error, wherein further processing comprises;

placing the request in a queue in the interface memory;

querying the interface memory at a specified frequency from the internal server;

sending, in response to the query, the request to the internal network;

authenticating, on the internal network, the external user;

returning an authentication result to the interface server;

checking the authentication result on the interface server to determine if the authentication result and the external user request match; and

generating an output response to the external user if the authentication result and the external user request match.

40. The method of claim 38 wherein authenticating the user includes the following steps in sequence:

a user ID and a user password are separated, in the neutral zone, from a request;

upon request of the internal server, the user ID is sent to the internal network;

the user ID is encrypted in the internal network using a prestored password for the user ID in the internal network;

the encrypted user ID is delivered back into the neutral zone;

the encrypted user ID is decrypted in the neutral zone using the user password, said user password being stored temporarily in the neutral zone;

the decrypted user ID and a user ID entered by the user are compared;

wherein authenticity of the user is confirmed in the case of a match and denied otherwise, and wherein the user inquiry is further processed if confirmed and is not further processed if denied.

41. A computer system comprising modules containing software for controlling the computer system to perform a method for secure data exchange, wherein the computer system comprises a first interface server and an internal server, the method comprising:

receiving, through an external firewall, a user request from an external network in the first interface server;

comparing, on the first interface server, the user request with a set of permissible requests;

storing the user request in an interface memory coupled to the first interface server;

checking, through an internal firewall, the interface memory exclusively from the internal server on an internal network;

processing the user request in the internal server if the user request matches one of the permissible requests; and

not processing the user request in the internal server if it does not match one of the permissible requests.

42. The computer system of claim 41 wherein the permissible requests have a predefined form and the received user request is verified for compliance with the predefined form.

43. The computer system of claim 41 wherein communication between the internal server and the first interface server is unidirectional such that calls into the first interface server are only accepted from the internal server and calls into the internal server from the first interface server are not possible.

44. The computer system of claim 41 further comprising:

generating a processing result in the internal server;

sending the result to the first interface server; and

determining if the result corresponds to the user request.

45. The computer system of claim 41 further comprising verifying the semantics of the user request.

46. The computer system of claim 45 further comprising processing the user request in the internal server if the semantics are verified.

47. The computer system of claim 41 further comprising authenticating the user request and processing the user request if the user request has been authenticated.

48. The computer system of claim 41 wherein the internal server checks the interface memory at regular intervals.

49. The computer system of claim 41 wherein the interface memory is scaled based on traffic.