A Browser is the process, running on a user device, that provides 'thin client' function to the user.

In a system environment where the Web tier employs multiple different vendor application servers, a separate security server must be used to implement Single Sign-On . The external security server provides an authentication proxy that intercepts requests to map or transform user credentials into the appropriate credential format for that specific application server.

PKI is a system for verifying the authenticity of each party involved in an Internet transaction, protecting against fraud or sabotage, and for nonrepudiation purposes to help consumers and retailers protect themselves against denial of transactions. Trusted third-party organizations called certificate authorities issue digital certificates -- attachments to electronic messages -- that specify key components of the user's identity. During an Internet transaction, signed, encrypted messages are automatically routed to the certificate authority, where the certificates are verified before the transaction can proceed. PKI can be embedded in software applications, or offered as a service or a product. e-business leaders agree that PKIs are critical for transaction security and integrity, and the software industry is moving to adopt open standards for their use.

The domain name server (DNS) node assists in determining the physical network address associated with the symbolic address (Web address) of the requested information. The DNS on the node diagram is that of the Internet service provider (ISP), although DNS is implemented on the accessed site also.

A firewall is a hardware/software system that manages the flow of information between the Internet and an organization's private network. Firewalls can prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets, and can block some virus attacks -- as long as those viruses are coming from the Internet. A firewall can separate two or more parts of a local network to control data exchange between departments. Components of firewalls include filters or screens, each of which controls transmission of certain classes of traffic. Firewalls provide the first line of defense for protecting private information, but comprehensive security systems combine firewalls with encryption and other complementary services, such as content filtering and intrusion detection.

Firewalls control access from a less trusted network to a more trusted network. Traditional implementations of firewall services include:

• Screening routers, (the Protocol Firewall)
• Application gateways (The Domain Firewall)

A pair of Firewall Nodes provides increasing levels of protection at the expense of increasing computing resource requirements. The Protocol Firewall is typically implemented as an IP Router.

See Also

• Domain Firewall Node

Additional Resources

• (in English) ESS

A firewall is a hardware/software system that manages the flow of information between the Internet and an organization's private network. Firewalls can prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets, and can block some virus attacks -- as long as those viruses are coming from the Internet. A firewall can separate two or more parts of a local network to control data exchange between departments. Components of firewalls include filters or screens, each of which controls transmission of certain classes of traffic. Firewalls provide the first line of defense for protecting private information, but comprehensive security systems combine firewalls with encryption and other complementary services, such as content filtering and intrusion detection.

Firewalls control access from a less trusted network to a more trusted network. Traditional implementations of firewall services include:

• Screening routers (the Protocol Firewall)
• application gateways (The Domain Firewall)

A pair of Firewall Nodes provides increasing levels of protection at the expense of increasing computing resource requirements. The Domain Firewall is typically implemented as a dedicated server Node.

See Also

• Protocol Firewall Node

Additional Resources

• (in English) ESS

The application server node provides the infrastructure for application logic and can be part of a Web application server. It is capable of running both presentation and business logic but generally does not serve HTTP requests. When used with a Web server redirector, the application server node can run both presentation and business logic. In other situations, it can be used for business logic only.

This node serves the information from the portal via alternative protocols to wireless devices.

A process that supports the use and management of Web pages and other Internet-related material.

Doing business is a series of Collaboration processes. It requires interaction between employees, vendors, suppliers and business partners. While e-mail is one example of an indispensable communication tool used by companies around the world, a number of other collaborative applications are increasingly coming into play. These applications enable local workgroups, or even geographically dispersed teams, to work together using real-time information sharing and distribution across the Internet. The applications include e-mail, group calendaring and scheduling, shared document libraries, discussion databases, newsgroups, and so forth.

The personalization server node works with the presentation server node to customize the presentation with data that matches a user’s interest. The personalization server identifies the type or class of the user based on information available about the user. Based on this classification, data taken from a content datastore either in the Personalization tier or from back-end sources is selected for presentation to the user. It provides the mapping function of user classification to content data.

The personalization server contains the rules that determine what types of user’s can have access to certain type of information. These are also referred to as access control rules and are directly related to business rules and processes. This is referred to as the Personalized Delivery::Prescriptive runtime pattern. The personalization server also allows the user to design the content and the layout of the content that they see by explicitly choosing from a selection of options. This is referred to as the Personalized Delivery::Participatory runtime pattern. You can use either or both of these patterns for the Portal composite pattern.

The directory and security services node supplies information on the location, capabilities, and attributes (including user ID/password pairs and certificates) of resources and users known to this Web application system. This node can supply information for various security services (authentication and authorization) and can also perform the actual security processing, for example, to verify certificates. The authentication in most current designs validates the access to the Web application server part of the Web server, but this node also authenticates for access to the database server.

See Also

• Database server

Additional Resources

• (in English) ESS

A Data Server/Services node is a generic data storage node that provides managed, persistent storage of any type of data and a means to directly access and manipulate that data. The data may be stored in files and accessed through file I/O routines or may be stored in a database with more structured and managed access methods.

This Node's function is to provide persistent data storage and retrieval in support of the user to-online buying transactional interaction.

Customer related data that is stored is relevant to the specific business interaction, for example, the shopping cart and shipping address information. Some sites are registering users and storing customer profile data such as address, clothing sizes, preferences, and gift wish lists that others can access when buying presents. Most sites today do not store credit card information on this server for security reasons.

Also stored here is the product and catalog information used to dynamically build HTML pages for presentation during the shopping process.

The mode of DB access is perhaps the most important factor determining the performance of this Web application, in all but the simplest cases. The recommended approach is to collapse the DB accesses into a single or very few calls. This can be achieved using coding and invoking Stored Procedure Calls on the database. Typically many commerce servers share only one database server in a high volume site, so the technology to implement this node must be able to scale vertically.

The Commerce Server Node includes both the functions of a Transactional Web Server and the Application Logic of the Online Buying front end. In particular, it often contains the following components

• Online Buying application
• Transactional Web Server functions
• Connections to the Database Server node
• Connections to the back end order processing systems

Online Buying Application functions are the components that interact with the shopper to allow browsing of the product catalog, adding product to the shopping basket, checking out (submitting the order), prompting for payment, etc... They are often provided with the assistance of packaged vendor software.

Transactional Web Server functions provide the technology platform and contain the components to support access to both public and user specific information by users employing Web browser technology. The web server function provides robust services to allow users to communicate with shared applications and data bases. In this way it acts as an interface to business functions.

Data that may be contained on the Node include the static page content to be displayed to the shopper:

• HTML text pages, images, multimedia content to be downloaded to the client browser
• Java Server Pages
• Application Program Library, e.g. Java Applets for dynamic download to Client Workstation (most shopping sites make only very limited if any use of Java applets when supporting the public consumer, due to the lack of control over the level of Java support on the browser )

The Load Balancer (or Network Dispatcher) provides horizontal scalability by dispatching http connections among several, identically configured Web Servers.

The Load Balancer component distributes interactive traffic across a number of hosts using dynamically updated rules for load balancing, while providing a single system image to the client system. It is used to achieve scalability through use of multiple servers, and high availability through being able to dynamically vary the algorithms by which a host is selected if one host fails or becomes overloaded.

The Load Balancer may be required to concurrently provide local or remote load balancing function for:

• Web server requests
• Mail servers
• Firewall / authentication hosts (i.e. not just IP address filtering)

The Load Balancer uses TCP/IP addressing standards to provide a single IP address for users to access. IP aliasing allows the ND to forward a message to a host and have it appear as if it had come direct from the client. The host therefore replies directly to the client.

The Load Balancer selects a host to process each incoming message on the basis of user-defined rules and dynamically updated information about the status of each eligible host. It uses agents to maintain awareness of the health and loading of each eligible back-end host within a defined cluster, and forwards each incoming request to one of these hosts on the basis of either existing persistent connections or the displaceable capacity (loading) of the target host application or server.

The main benefits of using a Load Balancer are

• Enhanced service scalability, as servers can be replicated to accommodate increasing workload
• Enhanced service availability, as traffic can be routed to alternative servers if one server fails
• Enhanced manageability, as an individual server can be taken out of service for maintenance without interrupting the service to users.

Additional Resources

• (in English) ESS