Methods and apparatus for processing markup language messages in a network

• US 7,774,831 B2
• Filed: 12/22/2003
• Issued: 08/10/2010
• Est. Priority Date: 12/24/2002
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Wenocur, Jonathan H., Dolph, Cyrus Abda V, Matsakis, Nicholas D., Nelson, Jan-Christian, Salz, Richard E., Kuznetsov, Eugene, Ballou, Kenneth R.
• Primary Examiner(s): CERVETTI, DAVID GARCIA
• Application Number:
  US10/745,326
• Publication Number:
  US 20060265689A1
• Time in Patent Office: 2,423 Days
• Field of Search: 713/153, 726/11, 726/12, 726/13, 726/14
• US Class Current: 726/12
• CPC Class Codes: G06F 2209/547 Messaging middleware
• CPC Class Codes: G06F 9/546 Message passing systems or structures, e.g. queues

Abstract

A markup language processing device processes markup language messages by receiving a message containing portions of tagged data formatted in a markup language and applying a transform selection rule set to at least one tagged rule selection data portion in the message to select at least one markup language transformation to apply to the tagged pre-transform data portion within the message. The markup language processing device applies the selected markup language transformation to transform the tagged pre-transform data portion to a tagged post-transform data portion according to a transformation function and then conditionally forwards the message. The markup language processing device operates on behalf of a computerized device that is not required to process the message due to operation of the at least one markup language transformation within the markup language processing device. The markup language processing device can process XML message for security and other purposes thus offloading such processing requirement from server computer systems.

Claims

1. In a markup language processing device, a computer-implemented method in which a computer system performs security processing operations on markup language messages on behalf of a recipient computerized device that is to receive the markup language messages, the method comprising:

receiving a message from a client computerized device including portions of tagged data formatted in a markup language;

applying a transform selection rule set to at least one tagged rule selection data portion in the message to select at least one markup language transformation to apply to at least one tagged pre-transform data portion within the message;

applying the selected at least one markup language transformation to the at least one tagged pre-transform data portion to transform the at least one tagged pre-transform data portion in the message to at least one tagged post-transform data portion in the message according to at least one transformation function associated with the at least one markup language transformation; and

conditionally forwarding the message back to the client computerized device including the at least one tagged post-transform data portion to the recipient computerized device such that the recipient computerized device is not required to process the message due to operation of the at least one markup language transformation within the markup language processing device.

2. The method of claim 1 wherein applying a transform selection rule set to tagged rule selection data portions in the message to select at least one markup language transformation to apply to tagged pre-transform data portions within the message comprises:

identifying an application layer protocol portion of the message;

obtaining tagged application layer protocol data within the application layer protocol portion of the message; and

matching at least a portion of the tagged application layer protocol data from the message to a rule set database to identify an applicable rule set that defines an ordered sequence of transformations to be applied to the tagged pre-transform data portions in the message.

3. The method of claim 2:

wherein identifying an application transport layer protocol portion of the message comprises identifying a hypertext transport protocol portion of the message;

wherein obtaining tagged application transport layer protocol data within the message comprises obtaining a uniform resource locator within with hypertext transport protocol portion of the message; and

wherein matching at least a portion of the tagged application transport layer protocol data from the message to a rule set database to identify an applicable rule set comprises;

matching a portion of the uniform resource locator within with hypertext transport protocol portion of the message to uniform resource locator rule definitions in the rule set database to select an applicable rule set to transform the tagged pre-transform data portions in the message according to the sequence of transformations defined in the selected applicable rule set having an associated matching uniform resource locator rule definition.

4. The method of claim 3 wherein applying a transform selection rule set to tagged rule selection data portions in the message further comprises:

identifying at least one network layer protocol portion of the message;

and wherein matching a portion of the uniform resource locator within with hypertext transport protocol portion of the message to uniform resource locator rule definitions in the rule set database further comprises;

matching the at least one network layer protocol portion of the message in combination with the uniform resource locator within with hypertext transport protocol portion of the message to select the applicable rule set.

5. The method of claim 4 wherein:

the network layer protocol portion of the message is at least one of;

i) an Internet Protocol address associated with the message;

ii) a port number upon which the message was received; and

wherein the portion of the uniform resource locator within with hypertext transport protocol portion of the message that is matched to uniform resource locator rule definitions is a domain identification of an Internet domain to which the message is directed.

6. The method of claim 2 wherein applying the selected at least one markup language transformation to the tagged pre-transform data portions to transform the tagged pre-transform data portions in the message to tagged post-transform data portions in the message according to at least one transformation function associated with the at least one markup language transformation comprises:

configuring a message parser with a set of search tags associated with a transformation in the sequence of transformations to be applied to the tagged pre-transform data portions in the message, each search tag capable of being matched to a tagged data portion of the message that is to be transformed according to a transformation function of the transformation in the sequence of transformations;

using the parser, parsing the message to identify, within the message, at least one start search tag of the set of search tags that indicates a start of tagged pre-transform data in the message;

in response to identifying a start search tag, applying the at least one transformation function to pre-transform message data in the message, beginning at the start of the tagged pre-transform data in the message and continuing until the parser identifies an end search tag in the message that indicates the end of the tagged pre-transform data in the message, application of the transformation function producing post-transform data; and

integrating the post transform data into a transformed message to replace the tagged pre-transform data originally received in the message.

7. The method of claim 6 wherein parsing the message to identify at least one start transformation tag, applying the at least one transformation function, and integrating the tagged post transform data into the received portions of the message are performed asynchronously in real-time as the message arrives at the markup language processing device such that transformation of pre-transform data according to a transformation function of a transformation in the sequence of transformations commences prior to completely receiving the message.

8. The method of claim 6 wherein the rule set defining a sequence of transformations to be applied to the tagged pre-transform data portions in the message defines application of a plurality of transformations to the message in a sequence, each transformation in the sequence operable to match a specific tagged portion of data in the message and each transformation in the sequence having a transformation function that performs a specific data processing task on a the specific tagged portion of data in the message.

9. The method of claim 8 comprising:

repeating the operations of identifying a start search tag, applying the at least one transformation function to pre-transform message data in the message from the start search tag to the end search tag, and integrating the post transform data into the message for each start search tag encountered when parsing the message, such that application of the plurality of transformations is performed to transform each portion of the message delineated by the start and end search tags according to the transformation associated with those search tags.

10. The method of claim 9 wherein the sequence of transformations specified in the rule set identifies a first transformation and a second transformation and wherein post-transform message data that is output from the operation of applying the first transformation function to pre-transform message data in the message is used as input to an operation of applying the second transformation, such that the first and second transformation are applied in a sequential manner.

11. The method of claim 6 wherein the transformation functions specified by transformations in the sequence of transformations defined by the rule set that are to be applied to tagged message data include functions to perform cryptographic operations on a tagged portion of message data by the markup language processing device performing the transformation on behalf of the recipient computerized device.

12. The method of claim 11 wherein the cryptographic operations include at least one of:

decryption of the tagged portion of message data;

encryption of the tagged portion of message data;

authentication of the tagged portion of message data;

signature generation on the tagged portion of message data;

signature verification on the tagged message data;

certificate lookup for the tagged portion of message data;

certificate generation for the tagged portion of message data; and

application of a secure communications protocol between the markup language processing device and a device that originated the message in response to detecting the tagged portion of message data.

13. The method of claim 6 wherein the transformation functions specified by transformations in the sequence of transformations defined by the rule set that are to be applied to tagged message data include functions to perform security operations on a tagged portion of message data by the markup language processing device performing the transformation on behalf of the recipient computerized device.

14. The method of claim 13 wherein the security operations include at least one of:

application of access control policy to the tagged portion of message data to determine portions of the message that are to be allowed to be received by the recipient computerized device;

filtering of the tagged portion of data from the message prior to forwarding the message to the recipient computerized device, the transformation function operating to filter the tagged portion of the data based on at least one of content, payload size, and other tagged data received within the message;

verifying acceptability of the tagged portion of data in the message prior to forwarding the message to the recipient computerized device;

identification of a non-allowed tagged portion of data in the message and in response not forwarding the message to the recipient computerized device;

identification of a missing tagged portion of data in the message and in response not forwarding the message to the recipient computerized device;

identification of a non-allowed tagged portion of data in the message and in response not forwarding the message to the recipient computerized device and providing a rejection of the message to an originating computerized device that transferred the message to the markup language processing device;

identification of the originating computerized device that transferred the message to the markup language processing device based on the tagged portion of data in the message;

application of virus detection to the tagged portion of the message;

application of schema validation to the tagged portion of the message; and

detection of a denial of service attempt by the originating computerized device that transferred the message for receipt by the recipient computerized device.

15. The method of claim 6 wherein the transformation functions specified by transformations in the sequence of transformations defined by the rule set that are to be applied to tagged message data include functions to perform network transfer operations on the message data by the markup language processing device performing the transformation on behalf of the recipient computerized device.

16. The method of claim 15 wherein the network transfer operations include at least one of:

application of a network routing operation to the message based on the tagged portion of data in the message; and

application of a combination of a filtering operation on the tagged portion of data and a network routing operation on a filter version of the message based on the tagged portion of data in the message;

application of a combination of a filtering operation on the tagged portion of data, a cryptographic operation on the tagged portion of data and a network routing operation on the message based on the tagged portion of data in the message; and

activation of a network service in relation to the recipient computerized device and the originating computerized device that transferred the message for receipt by the recipient computerized device based on the tagged portion of data in the message.

17. The method of claim 6 wherein the transformation functions specified by transformations in the sequence of transformations defined by the rule set that are to be applied to tagged message data include functions to perform metadata transformation operations within the message data by the markup language processing device such that the message forwarded to the recipient computerized device contains metadata that is different than metadata within the message received, the metadata transformations including modification of data values within at least one of:

hypertext transport protocol data (HTTP);

secure sockets layer data (SSL); and

transmission control protocol data (TCP/IP).

18. The method of claim 1 wherein:

receiving a message comprises accepting a first connection from an originating computerized device that transfers the message to the markup language device over the first connection for intended receipt by the recipient computerized device; and

wherein conditionally forwarding the message comprises establishing a second connection from the markup language device to the recipient computerized device in order to forward the message containing the tagged post-transform data portions after application of the selected at least one markup language transformation to the tagged pre-transform data portions of the message received over the first connection;

such that the markup language processing device operates in a proxy processing mode between the originating computerized device and the recipient computerized device.

19. The method of claim 1, wherein

the markup language processing device operates in a loopback processing mode to receive and process the message on behalf of the client computerized device and return the message containing the at least one post-transform data portion to the client computerized device.

20. The method of claim 19 wherein the message is formatted in an extensible markup language and wherein receiving a message and conditionally forwarding the message comprise:

operating a web services interface protocol to exchange the extensible markup language message with the client computer device.

21. The method of claim 1 wherein the markup language processing device operates in a co-processor mode and wherein the method comprises:

installing a proprietary communications protocol library within the markup language processing device to allow the markup language device to communicate in the proprietary communications protocol; and

wherein receiving a message and conditionally forwarding the message comprise;

operating a proprietary communications protocol accessed within the installed proprietary communications protocol library to allow the markup language processing device to receive and conditionally forward the message according to the proprietary communications protocol, such that the markup language processing device operates in a co-processor processing mode.

22. The method of claim 1 wherein:

the message is formatted in an extensible markup language;

the at least one markup language transformation is an extensible markup language stylesheet defined in an extensible stylesheet transformation language; and

wherein the method comprises;

performing the operations of applying a transform selection rule set and applying the selected at least one markup language transformation to asynchronously invoke application of extensible markup language stylesheet to tagged data portions of the message as the message arrives at the markup language processing device.

23. The method of claim 1 comprising:

defining a plurality of transform primitives, each transform primitive operable to perform a specific data processing task on data extracted from a tagged data portion of the message;

defining the at least one markup language transformation as a plurality of markup language data transformations in a markup language transformation language, each markup language data transformation operable to match a tagged portion of data in the message and to specify application of at least one of the transform primitives of the plurality of transform primitives to the tagged portion of data in the message to accomplish the transformation function associated with that markup language transformation;

compiling, into executable machine code, the plurality of markup language data transformations in combination with the plurality of transform primitives to produce a markup language message transformation process operable to;

i) identify, using code generated from the plurality of markup language data transformations, a start tag associated with the at least one tagged pre-transform data portion in the message that matches one of the plurality of markup language data transformations; and

ii) in response to identifying the start tag, applying at least one of the transform primitives specified by the matching markup language data transformation to the pre-transform tagged portion of data to transform the tagged portion of data according to the specific data processing task of that transform primitive into the post-transform data portion in the message.

24. The method of claim 23 wherein compiling the plurality of markup language data transformations in combination with the plurality of transform primitives comprises:

compiling a rule set definition defining the transform selection rule set in conjunction with the plurality of markup language data transformations and the plurality of transform primitives to produce the markup language message transformation process; and

wherein the method comprises executing the markup language message transformation process to perform the operations of applying a transform selection rule set and applying the selected at least one markup language transformation.

25. The method of claim 24 comprising:

prior to applying the selected at least one markup language transformation, determining if the at least one markup language transformation defined in the markup language transformation language has been modified since a most recent operation of the markup language message transformation process; and

if the at least one markup language transformation has been modified, performing a compiling operation on the at least one markup language transformation to produce a current version of the markup language message transformation process that takes into account any changes resulting from the modification to the at least one markup language transformation.

26. The method of claim 1 wherein applying the selected at least one markup language transformation comprises:

applying a first transformation to a first tagged pre-transform data portion of the message to produce the at least one tagged post-transform data portion that is an extensible markup language style sheet dynamically generated based on the tagged pre-transform data; and

applying a dynamically generated extensible markup language style sheet to a second tagged pre-transform data portion of the message to produce the at least one tagged post-transform data portion that replaces the second tagged pre-transform data in the message.

27. The method of claim 1 further comprising:

defining a plurality of security primitives, each security primitive operable to perform a specific data security processing task;

defining a plurality of data transformations in a transformation language, each data transformation operable to match a tagged portion of data in a document and to specify application of at least one of the security primitives to the tagged portion of data;

processing the plurality of data transformations in combination with the plurality of security primitives to produce markup language processing code operable to;

i) identify, using code generated from the plurality of data transformations, a tag associated with the tagged portion of data in a document that matches one of the plurality of data transformations; and

ii) in response to identifying a tag that matches one of the plurality of data transformation, applying at least one of the security primitives specified by the matching data transformation to the tagged portion of data to transform the tagged portion of data according to the specific data security processing task of that security primitive.

28. A markup language processing device comprising:

at least one communications interface;

a markup processor coupled to the at least one communications interface, the markup processor encoded with a computer-implemented markup language transformation process in which a computer system performs operations that when executed, causes the markup processor to perform security processing operations on markup language messages comprising;

receiving, via the communications interface, a message from a client computerized device including portions of tagged data formatted in a markup language;

applying a transform selection rule set to at least one tagged rule selection data portion in the message to select at least one markup language transformation to apply to at least one tagged pre-transform data portion within the message;

applying the selected at least one markup language transformation to the at least one tagged pre-transform data portion to transform the at least one tagged pre-transform data portion in the message to at least one tagged post-transform data portion in the message according to at least one transformation function associated with the at least one markup language transformation; and

conditionally forwarding, via the communications interface, the message back to the client computerized device including the at least one tagged post-transform data portion to the recipient computerized device such that the recipient computerized device is not required to process the message due to operation of the at least one markup language transformation within the markup language processing device.

29. A computer-readable storage medium having computer readable code thereon that, when executed on a markup processor, provides a markup language transformation process that performs security processing operations on markup language messages, the medium including instructions in which a computer system performs operations comprising:

receiving, via a communications interface, a message from a client computerized device including portions of tagged data formatted in a markup language;

applying a transform selection rule set to at least one tagged rule selection data portion in the message to select at least one markup language transformation to apply to at least one tagged pre-transform data portion within the message;

applying the selected at least one markup language transformation to the at least one tagged pre-transform data portion to transform the at least one tagged pre-transform data portion in the message to at least one tagged post-transform data portion in the message according to at least one transformation function associated with the at least one markup language transformation; and

conditionally forwarding, via the communications interface, the message back to the client computerized device including the at least one tagged post-transform data portion to the recipient computerized device such that the recipient computerized device is not required to process the message due to operation of the at least one markup language transformation within the markup language processing device.