Method and apparatus for a broker entity

• US 7,900,038 B2
• Filed: 04/29/2003
• Issued: 03/01/2011
• Est. Priority Date: 04/29/2003
• Status: Active Grant

• Current Assignee: Wells Fargo Bank NA (Wells Fargo & Company)
• Original Assignee: Wells Fargo Bank NA (Wells Fargo & Company)
• Inventors: Colbert, Pamela, Akinyemi, Julius, Suto, Lawrence B., Wanta, Rebecca
• Primary Examiner(s): Abrishamkar; Kaveh
• Application Number:
  US10/426,209
• Publication Number:
  US 20040220882A1
• Time in Patent Office: 2,863 Days
• Field of Search: None
• US Class Current: 713/151
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/288 Distributed intermediate devices, i.e. intermediate devices for interaction with other intermediate devices on the same level
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A method and apparatus for a broker entity is provided. A high-speed embedded firewall, a message-processing router, secure session protocol, transport management, and integrated intrusion detection is provided in a single-chip format.

Claims

1. A method for providing an end-to-end, open, and secure commerce transactional environment, comprising the steps of:

providing a first broker entity, the first broker entity implemented as an appliance using Application-Specific Integrated Circuit (ASIC) and Field Programmable Gate-Array (FPGA) technology, the appliance being insertable into a hardware device in a plug-and-play fashion, the first broker entity;

providing an external module API;

providing a secure execution engine;

providing a protocol handler that enables the first broker entity to communicate with other broker entities;

notifying the other broker entities that the first broker entity and services of the first broker entity have come online, the other broker entities being trusted by the first broker entity;

receiving a request from a first client, the first client subscribing to the first broker entity as a point-to-point or publish-and-subscribe configuration;

providing a message cache and routing table component, the message cache and routing table component keeping a table comprising data regarding the other broker entities, services offered by the other broker entities, and services offered by subscribers to the other broker entities, the message cache and routing table component holding onto the request until the request can be fulfilled by a given service that is currently not available, the services offered by the other broker entities being trusted by the first broker entity;

updating the table in real-time as the other broker entities come online or go offline and as the services offered by the other broker entities or the subscribers of the other broker entities become available or unavailable;

notifying the other broker entities that a third broker entity has gone down, the first broker entity subscribing directly to the third broker entity;

providing an XML and regular expression parser; and

providing an XML message API;

receiving notification that a second client has come online; and

routing the request to a second broker entity after the receiving notification that the second client has come online, a second client subscribing to the second broker entity, the second client offering the given service.

2. The method of claim 1, wherein said external module API and said XML message API are interface components to subscribing clients.

3. The method of claim 1, wherein said protocol handler allows communication with the other broker entities across a network, wherein said network is any of a virtual private network and the Internet.

4. The method of claim 1, wherein said protocol handler can negotiate and destroy secure sessions dynamically.

5. The method of claim 1, wherein said protocol handler is installed at different contact points within a network.

6. The method of claim 1, wherein said protocol handler allows setting and following a security policy that chooses acceptable protocol.

7. The method of claim 1, wherein said message cache and routing table component provides status of available devices.

8. The method of claim 1, wherein said message cache and routing table component provides current security level, services provided, services subscribed to, and indications of detected presence of the other broker entities.

9. The method of claim 1, wherein said XML and regular expression parser is embedded in hardware for performing character parsing in high speed.

10. The method of claim 1, wherein said external module API stores configuration information and data about outside systems.

11. The method of claim 1, wherein said XML message API provides an open, standardized API to systems of record and/or to any database.

12. The method of claim 11, wherein said XML message API provides message types and rules information.

13. The method of claim 1, further comprising the step of:

discovering other broker entities and setting up services to other broker entities using basic XML-based protocol.

14. The method of claim 1, further comprising the step of:

using Universal Description, Discovery and Integration (UDDI) specification for looking up and registering new services and connection rules as they become available online.

15. The method of claim 1, further comprising the step of:

flashing with new transport protocols and basic messaging protocols.

16. The method of claim 1, further comprising the step of:

allowing agreements to be configured on message exchanges, resulting in, but not limited to, configured messages.

17. The method of claim 16, wherein said configured messages comprise, but are not limited to, timeout values, latency period, round-trip times, and allowable return messages.

18. The method of claim 16, further comprising the step of:

configuring to perform alternate procedures when said agreements are violated.

19. The method of claim 1, further comprising the step of:

providing a Secure Sockets Layer/WTLS/Internet Protocol Security (SSL/WTLS/IPSEC) connection with the other broker entities.

20. The method of claim 1, further comprising the step of:

selectively encrypting/decrypting XML messages and verifying signatures on XML messages at tag level.

21. The method of claim 1, further comprising the step of:

using compact certificate technology, wherein the first broker entity has a transaction definition table to decode transaction certificates received from the other broker entities.

22. The method of claim 1, further comprising the step of:

providing a message dictionary data source and a corresponding API for custom-defined the processing and security rules.

23. The method of claim 1, wherein permissions and authentication processing is embedded in a hard real-time kernel.

24. The method of claim 1, further comprising the step of:

communicating with, but not limited to, MQ-Series and Common Object Request Broker Architecture (CORBA) and Enterprise JavaBeans (EJBs) via the Simple Object Access Protocol (SOAP) protocol.

25. The method of claim 1, further comprising the step of:

providing maintenance interface enabling code running onboard allowing updating and system level testing to be performed while in operation.