Multi-tiered protection platform

• US 9,992,163 B2
• Filed: 12/14/2015
• Issued: 06/05/2018
• Est. Priority Date: 12/14/2015
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Cismas, Sorin N., Kurian, Manu
• Primary Examiner(s): SHEHNI, GHAZAL B
• Application Number:
  US14/968,334
• Publication Number:
  US 20170171152A1
• Time in Patent Office: 904 Days
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A multi-tier platform provides security at a perimeter of a computer system, where an intermediate layer interacts between a web layer and an application layer. A data request that is associated with a data set is received at the web layer and passed to the intermediate layer. The intermediate layer determines the authoritative source for the data set and whether the data set has a static or dynamic value. If the value is static, the intermediate layer accesses the value stored at the intermediate layer. However, if the value is dynamic, the intermediate layer queries the source registered to the data set, obtains the value from the authoritative source, and returns the dynamic value via the web layer, where the registered source may be internal or external to the computer system. Consequently, the intermediate layer may function as an aggregate layer that supports both database and messaging services.

Claims

1. An apparatus for supporting an intermediate layer comprising:

a processing device;

a memory device;

a storage subsystem;

a first communication interface configured to communicate with a first application and a second application, wherein the first application and the second application are associated with an application layer;

a second communication interface interconnected with a web layer;

an intermediate layer module stored in the memory device, executable by the processor, wherein the intermediate layer module supports an intermediate layer that interacts between the web layer and the application layer, the intermediate layer module configured to cause the processor to;

when a first data request is received for a first data set, access a first value for the first data set from the storage subsystem, wherein the first data set is registered to the first application and wherein the first value was published to the intermediate layer module by the first application previous to the first data request;

send the first value via the second communication interface to the web layer in response to the first data request;

when a second data request is received for a second data set, obtain a dynamic data indicator for the second data set from the storage subsystem, wherein the second data set is registered to the second application;

in response to the dynamic data indicator, obtain a second value for the second data set via the first communication interface from the second application;

send the second value via the second communication interface to the web layer in response to the second data request;

receive an updated value for the first data set via the first communication interface from the first application and replace the first value with the updated value in the storage subsystem;

when a third data request is received for the first data set, access the updated value for the first data set from the storage subsystem; and

send the updated value via the second communication interface to the web layer in response to the first data request.

2. The apparatus of claim 1, wherein the intermediate layer module is further configured to cause the processor to:

when a fourth data request is received for a third data set, access a third value for the third data set from the storage subsystem, wherein the third data set is registered to an external source and wherein the third value was published to the intermediate layer module by the external source previous to the fourth data request; and

send the third value via the second communication interface to the web layer in response to the fourth data request.

3. The apparatus of claim 1, wherein the apparatus comprises a third communication interface and wherein the intermediate layer module is further configured to cause the processor to:

receive a first configuration message via the third communication interface between the apparatus and an administrative system;

register the first data set to the first application based on the first configuration message; and

assign the first value to the first data set.

4. The apparatus of claim 3, wherein the intermediate layer module is further configured to cause the processor to:

receive a second configuration message via the third communication interface;

register the second data set to the second application based on the second configuration message; and

assign the dynamic data indicator to the second data set.

5. The apparatus of claim 1, wherein the intermediate layer module is further configured to cause the processor to:

update a value for a stored data set from a source only when the source is registered, wherein the stored data set is stored in the storage subsystem.

6. The apparatus of claim 1, wherein the intermediate layer module is further configured to cause the processor to:

when the first data set is related to a fourth data set, obtain a fourth value for the fourth data set; and

send the first value and the fourth value via the second communication interface to the web layer in response to the first data request.

7. The apparatus of claim 1, wherein the intermediate layer module is further configured to cause the processor to:

when a time to access the first data set is past an expiration time limit, query the first application for updated information.

8. The apparatus of claim 1, wherein the intermediate layer module is further configured to cause the processor to:

when the updated value for the first data set is received by a third application, reject the updated value, wherein the first data set is not registered to the third application.

9. The apparatus of claim 1, wherein the storage subsystem replaces the first value with the updated value of the first data set directly from the first application to the storage subsystem via the first communication interface.

10. One or more non-transitory computer-readable media for supporting an intermediate layer that interacts between a web layer and an application layer and having computer-executable instructions stored thereon, the computer-readable media comprising:

a first set of codes for causing a computing device to access a first value for a first data set from a storage subsystem when a first data request is received for the first data set, wherein the first data set is registered to a first application and wherein the first value was published to the intermediate layer by the first application previous to the first data request;

a second set of codes for causing the computing device to send the first value to the web layer in response to the first data request;

a third set of codes for causing the computing device to obtain a dynamic data indicator for a second data set when a second data request is received for the second data set, wherein the second data set is registered to a second application;

a fourth set of codes for causing the computing device to obtain a second value for the second data set from the second application in response to the obtaining the dynamic data indicator;

a fifth set of codes for causing the computing device to send the second value to the web layer in response to the second data request;

a sixth set of codes for causing the computing device to receive an updated value for the first data set from the first application and replace the first value with the updated value in the storage subsystem;

a seventh set of codes for causing the computing device to access the updated value for the first data set from the storage subsystem when a third data request is received for the first data set; and

an eighth set of codes for causing the computing device to send the updated value via the second communication interface to the web layer in response to the third data request.

11. The computer-readable media of claim 10, further comprising:

a ninth set of codes for causing the computing device to access a third value for a third data set from the storage subsystem when a fourth data request is received for the third data set, wherein the third data set is registered to an external source and wherein the third value was published to the intermediate layer module by the external source previous to the fourth data request; and

a tenth set of codes for causing the computing device to send the third value to the web layer in response to the fourth data request.

12. A method for supporting an intermediate layer that interacts between a web layer and an application layer, the method comprising:

when a first data request is received for a first data set, accessing a first value for the first data set from a storage subsystem, wherein the first data set is registered to a first application and wherein the first value was published to the intermediate layer module by the first application previous to the first data request, wherein the first application and a second application function within the application layer;

sending the first value to the web layer in response to the first data request;

when a second data request is received for a second data set, obtaining a dynamic data indicator for the second data set from the storage subsystem, wherein the second data set is registered to the second application;

in response to the obtaining the dynamic data indicator;

obtaining a second value for the second data set from the second application;

sending the second value to the web layer in response to the second data request;

receiving an updated value of the first data set from the first application via the application layer and replace the first value with the updated value in the storage subsystem;

when a third data request is received for a first data set, accessing the updated value for the first data set from the storage subsystem; and

sending the updated value to the web layer in response to the third data request.

13. The method of claim 12, further comprising:

when a fourth data request is received for a third data set, accessing a third value for the third data set from the storage subsystem, wherein the third data set is registered to an external source and wherein the third value was published to the intermediate layer module by the external source previous to the fourth data request; and

sending the third value to the web layer in response to the fourth data request.

14. A system for supporting a multi-tier protection platform, the system comprising:

a web layer module;

an application layer module, wherein a first application and a second application function at an application layer;

an intermediate layer module configured to interact between the web layer module and the application layer module, wherein the intermediate layer module is stored in a memory device and is configured, when executed by a processor, to cause the processor to;

when a first data request is received for a first data set, access a first value for the first data set from a storage subsystem, wherein the first data set is registered to the first application and wherein the first value was published to the intermediate layer module by the first application previous to the first data request;

send the first value to the web layer module in response to the first data request;

when a second data request is received for a second data set, obtain a dynamic data indicator for the second data set from the storage subsystem, wherein the second data set is registered to the second application;

in response to the obtaining the dynamic data indicator;

obtain a second value for the second data set from the second application via the application layer module;

send the second value to the web layer module in response to the second data request;

receive an updated value for the first data set from the first application via the application layer module and replace the first value with the updated value in the storage subsystem;

when a third data request is received for the first data set, access the updated value for the first data set from the storage subsystem; and

send the updated value to the web layer module in response to the first data request.

15. The system of claim 14, wherein the intermediate layer module further causes the processor to:

when a fourth data request is received for a third data set, access a third value for the third data set from the storage subsystem, wherein the third data set is registered to an external source and wherein the third value was published to the intermediate layer module by the external source previous to the fourth data request; and

send the third value to the web layer module in response to the fourth data request.

16. The system of claim 14, further comprising an administrative module configured to interact with the intermediate layer module to register the first data set to the first application and the second data set to the second application.