Skip to main content

Self-Service::Directly Integrated Single Channel application pattern::Runtime patterns

Overview

On this page, two categories of Runtime patterns are described:

The Directly Integrated Single Channel application pattern represents a starting point for delivering e-business applications. The Directly Integrated Single Channel application pattern extends the Stand-Alone Single Channel application pattern by providing connections to one or more back-end systems, but a single delivery channel is still assumed.

The next step is to choose Runtime patterns that most closely match the requirements of the application. A Runtime pattern uses nodes to group functional and operational components. The nodes are interconnected to solve a business problem. Each Application pattern leads to one or more underpinning Runtime patterns.

The Runtime pattern does not differentiate between intranet and Internet implementations. However, you should be aware of certain issues:

Generic DC runtime patterns

Basic Runtime pattern

Although this Runtime pattern was historically used as an entry-level footprint, the proliferation of hacker attacks has caused it now to be regarded as an anti-pattern. However for the moment we will keep it on the web site because it has been used in the IBM Redbook, IBM WebSphere V5 Edge of Network Patterns (SG24-6896), as the simplest base design to which various High Availability and High Performance nodes can be added.


Directly Integrated Single Channel application pattern: Runtime pattern

Directly Integrated Single Channel::Runtime pattern Public Key Infrastructure Domain Name Service User Protocol Firewall Web Application Server Domain Firewall Directory and Security Services Existing ApplicationsExisting ApplicationsExisting Applications
Design Last Updated: 11-5-2002
(Click a node to get a detailed explanation.)

Example
A discount brokerage firm wishes to establish a Web sales channel. They may select the Directly Integrated Single Channel application pattern because real-time integration with their back-end applications is critical. In implementing this application they could use the Runtime pattern shown above. The Web application server would host the presentation and some limited business logic. The majority of the business logic would continue to reside on existing applications and data sources. The Directory and Security Services node is used to implement features including authentication and authorization.

Runtime pattern: Variation 1

This variation to the basic Runtime pattern uses one Web server redirector containing the Web server and one application server, effectively splitting the function of a Web application server across two machines. In this case the application server resides in the internal network to provide it with more security. The application server node will run both presentation and business logic. The Web server remains in the DMZ and serves static pages. A Web server redirector is used to forward the requests from the Web server to the application server.


Directly Integrated Single Channel application pattern: Runtime pattern: Variation 1

Directly Integrated Single Channel::Runtime pattern=Variation 1 Public Key InfrastructureDomain Name ServiceUserProtocol FirewallWeb Server RedirectorDomain FirewallDirectory and Security ServicesExisting ApplicationsService RegistryApplication Server
Design Last Updated: 06-13-2006
(Click a node to get a detailed explanation.)

The nodes depicted with dotted lines provide important functionality, but are optional for the focus of the Runtime pattern.
The discount brokerage application described earlier can be deployed on this Runtime pattern variation to achieve a higher level of security. The discount brokerage developed complex investment tools within the Web application. These tools needed to be protected behind a firewall. This approach helps secure their highly sensitive business logic.

Runtime pattern: Other Variations

Other variations to the Directly Integrated Single Channel application pattern::Basic runtime pattern can be used to address the availability and performance requirements of your application.

As with the Stand-Alone Single Channel application pattern::Runtime pattern, the Non-Functional Requirements custom designs can be applied to the Directly Integrated Single Channel application pattern::Basic runtime.


SOA profile

Directly Integrated Single Channel::Runtime pattern=SOA Profile Public Key InfrastructureDomain Name ServiceUserProtocol FirewallWeb Server RedirectorDomain FirewallApplication ServerDirectoryEnterprise Service BusExisting ApplicationsService Registry
Design Last Updated: 07-12-2005
(Click a node to get a detailed explanation.)

In this SOA profile, the application server node becomes the service consumer with the back-end applications acting as service providers. The service consumer is connected to the service providers via a simple enterprise service bus. Due to the nature of the SOA approach, the consumer and provider could be reversed.

Implementing the SOA profile with an ESB adds extra capabilities to the runtime pattern, for example routing and decomposition capability. Because of this, the SOA profile for the Directly Integrated Single Channel runtime pattern can be applicable to multiple Self-Service application patterns. This highlights the fact that using SOA facilitates the future expansion of solution functionality without requiring major changes to the middleware structure.

Public Key Infrastructure (PKI)

PKI is a system for verifying the authenticity of each party involved in an Internet transaction, protecting against fraud or sabotage, and for nonrepudiation purposes to help consumers and retailers protect themselves against denial of transactions. Trusted third-party organizations called certificate authorities issue digital certificates -- attachments to electronic messages -- that specify key components of the user's identity. During an Internet transaction, signed, encrypted messages are automatically routed to the certificate authority, where the certificates are verified before the transaction can proceed. PKI can be embedded in software applications, or offered as a service or a product. e-business leaders agree that PKIs are critical for transaction security and integrity, and the software industry is moving to adopt open standards for their use.

Directory Node

Directory Services provides an integrated LDAP server that easily integrates with other LDAP servers to provide for the directory needs of an e-business solution.

Domain Name Server (DNS) Node

The DNS Node assists in determining the physical network address associated with the symbolic address (URL) of the requested information. The Domain Name Server Node provides the technology platform to provide host to IP address mapping, that is, to allow for the translation of names (referred to as URLs) into IP addresses and vice versa.

Additional Resources

  • (in English) ESS

User Node

The user node is most frequently a personal computing device (PC) supporting a commercial browser, for example, Netscape Navigator and Internet Explorer. The browser is expected to support SSL and some level of DHTML. Increasingly, designers need to also consider that this node might be a pervasive computing device, such as a Personal Digital Assistant (PDA).

Protocol Firewall Node

A firewall is a hardware/software system that manages the flow of information between the Internet and an organization's private network. Firewalls can prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets, and can block some virus attacks -- as long as those viruses are coming from the Internet. A firewall can separate two or more parts of a local network to control data exchange between departments. Components of firewalls include filters or screens, each of which controls transmission of certain classes of traffic. Firewalls provide the first line of defense for protecting private information, but comprehensive security systems combine firewalls with encryption and other complementary services, such as content filtering and intrusion detection.

Firewalls control access from a less trusted network to a more trusted network. Traditional implementations of firewall services include:

  • Screening routers, (the Protocol Firewall)
  • Application gateways (The Domain Firewall)

A pair of Firewall Nodes provides increasing levels of protection at the expense of increasing computing resource requirements. The Protocol Firewall is typically implemented as an IP Router.

See Also

Additional Resources

  • (in English) ESS

Domain firewall node

A firewall is a hardware/software system that manages the flow of information between the Internet and an organization's private network. Firewalls can prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets, and can block some virus attacks -- as long as those viruses are coming from the Internet. A firewall can separate two or more parts of a local network to control data exchange between departments. Components of firewalls include filters or screens, each of which controls transmission of certain classes of traffic. Firewalls provide the first line of defense for protecting private information, but comprehensive security systems combine firewalls with encryption and other complementary services, such as content filtering and intrusion detection.

Firewalls control access from a less trusted network to a more trusted network. Traditional implementations of firewall services include:

  • Screening routers (the Protocol Firewall)
  • application gateways (The Domain Firewall)

A pair of Firewall Nodes provides increasing levels of protection at the expense of increasing computing resource requirements. The Domain Firewall is typically implemented as a dedicated server Node.

See Also

Additional Resources

  • (in English) ESS

Web Application Server

A Web application server node is an application server that includes an HTTP server (also known as a Web server) and is typically designed for access by HTTP clients and to host both presentation and business logic.

The Web application server node is a functional extension of the informational (publishing-based) Web server. It provides the technology platform and contains the components to support access to both public and user specific information by users employing Web browser technology. For the latter, the node provides robust services to allow users to communicate with shared applications and databases. In this way, it acts as an interface to business functions, such as banking, lending, and HR systems.

The node can contain these data types:

  • HTML text pages, images, multimedia content to be downloaded to the client browser
  • JavaServer Pages
  • Application program libraries, such as Java applets for dynamic download to client Workstations

See Also

Additional Resources

  • (in English) ESS

Directory and security services node

The directory and security services node supplies information on the location, capabilities, and attributes (including user ID/password pairs and certificates) of resources and users known to this Web application system. This node can supply information for various security services (authentication and authorization) and can also perform the actual security processing, for example, to verify certificates. The authentication in most current designs validates the access to the Web application server part of the Web server, but this node also authenticates for access to the database server.

See Also

Additional Resources

  • (in English) ESS

Database server node

This Node's function is to provide persistent data storage and retrieval in support of the user to-online buying transactional interaction.

Customer related data that is stored is relevant to the specific business interaction, for example, the shopping cart and shipping address information. Some sites are registering users and storing customer profile data such as address, clothing sizes, preferences, and gift wish lists that others can access when buying presents. Most sites today do not store credit card information on this server for security reasons.

Also stored here is the product and catalog information used to dynamically build HTML pages for presentation during the shopping process.

The mode of DB access is perhaps the most important factor determining the performance of this Web application, in all but the simplest cases. The recommended approach is to collapse the DB accesses into a single or very few calls. This can be achieved using coding and invoking Stored Procedure Calls on the database. Typically many commerce servers share only one database server in a high volume site, so the technology to implement this node must be able to scale vertically.

Existing Applications and Data Node

Existing applications are run and maintained on nodes, which are installed in the internal network. These applications provide for business logic that uses data maintained in the internal network. The number and topology of these existing application and data nodes is dependent on the particular configuration used by these legacy systems.

Web Server Redirector Node

In order to separate the Web server from the application server, a so-called Web Server Redirector Node (or just redirector for short) is introduced. The Web server redirector is used in conjunction with a Web server. The Web server serves HTTP pages and the redirector forwards servlet and JSP requests to the application servers. The advantage of using a redirector is that you can move the application server behind the domain firewall into the secure network, where it is more protected than within the DMZ.

Service Registry

The role of the Service Registry is to provide details of services that are available to perform business functions identified within a taxonomy. The Service Registry can be implemented as an open-standard UDDI registry. Catalogs, such as a UDDI registry, can achieve one of the primary goals of a Service Registry: to publish the availability of services and encourage their reuse across the development activity of an enterprise.

The vision of Web services defines an open-standard UDDI registry that enables the dynamic discovery and invocation of business services. However, although technologies mature toward that vision, more basic solutions are likely to be implemented in the near term.

This node is also known as a Business Service Directory.

Application server node

The application server node provides the infrastructure for application logic and can be part of a Web application server. It is capable of running both presentation and business logic but generally does not serve HTTP requests. When used with a Web server redirector, the application server node can run both presentation and business logic. In other situations, it can be used for business logic only.

ESB

The ESB is a key enabler for a SOA as it provides the capability to route and transport service requests from the service requester to the correct service provider. The true value of the ESB concept, however, is to enable the infrastructure for SOA in a way that reflects the needs of today’s enterprise: to provide suitable service levels and manageability, and to operate and integrate in a heterogeneous environment.

Furthermore the ESB needs to be centrally managed and administered and have the ability to be physically distributed.