Skip to main content

Self-Service::Router application pattern::Runtime patterns

Overview

On this page, two categories of Runtime patterns are described:

In the Router application pattern, the router tier serves as an integration point for delivery channels in the presentation tier, allowing access to individual back-end applications. In this Runtime pattern, the functions of the router tier are performed by an integration server.

Generic runtime patterns

Router application pattern::Runtime pattern

Self-Service::Runtime pattern=Generic Application ServerIntegration ServerWeb Server RedirectorLightweight Directory Access ProtocollUserDomain Name ServerExisiting ApplicationsDirectory and Security ServicesPublic Key InfrastructureProtocol FirewallDomain Firewall
(Click a node to get a detailed explanation.)

The basic pattern uses a Web server redirector node in the DMZ to serve static HyperText Mark-up Language (HTML) pages to the client. Requests for dynamic data are forwarded to the application server in the internal network. Together, these two nodes provide the presentation tier, capable of handling multiple, diverse, presentation styles. Using a redirector allows you to place the bulk of the business logic behind the protection of both the protocol and domain firewalls.

In addition to presentation logic, primarily in the form of JavaServer Pages (JSPs), the application server contains some business logic. This is primarily in the form of the controlling servlets required to access the back-end applications. The application server builds a request based on user input and passes it to the integration server.

The integration server examines the request, determines the appropriate destination, and forwards it to the chosen back-end application, where the primary business logic resides. This may involve activities such as message transformation, protocol conversion, security management, and session concentration. The integration server may use a database to look up routing information, as a caching device, or for holding intermediary data.

Access to the application server resources is protected by the application server’s security features, while access to the integration server’s resources is protected by the integration server’s security features. User information that is needed for authentication and authorization by both servers is stored in the directory and security services node behind the domain firewall in the internal network.

This Runtime pattern does not differentiate between intranet and Internet implementations. However, you need to be aware of certain issues:

  • Bandwidth is usually greater in an intranet, allowing the use of more network-intensive solutions, such as thick clients.
  • Security might be less an issue in an intranet. However, protecting the network is still important and firewalls protecting resources from unauthorized access are still advisable.
  • Because of corporate rules you might expect certain browsers to be used, allowing you to exploit all available features and not code to the least common denominator.

This Runtime pattern offers the following benefits:

  • All sensitive persistent data is stored behind the DMZ.
  • Business logic can completely reside in the secure network.

Although this Runtime pattern has limited availability and failover capability, individual products offer features that could be folded into this design, allowing duplicate servers that can take over in the event of a server failure. Horizontal scalability is also not shown, but individual product offerings might offer workload management features for this design to allow duplicate servers for distributed workload. Vertical scalability can be achieved by adding memory or processors, or creating multiple servers on the Web application server and integration server.

In our financial services company example, data for each type of service (brokerage, mutual fund, banking, and credit card) is accessible through its own back-end application. As a first step to integrating their operations, the company uses a Router application pattern solution that provides access to each back end application. A banker processing a loan application can access the customer's credit card history before approving the loan. Read-only data at the router level provides a mapping between the user and the accounts held.

Runtime pattern: Variation 1

In this variation, the presentation logic has been split from the application logic and placed on a Web presentation server.

Router application pattern::Runtime pattern=Variation 1

Application topology 5 : runtime topology Web Presentation ServerApplication ServerIntegration ServerWeb Server RedirectorLightweight Directory Access ProtocollUserDomain Name ServerExisiting ApplicationsDirectory and Security ServicesPublic Key InfrastructureProtocol FirewallDomain Firewall
(Click a node to get a detailed explanation.)

The Web presentation server runs JSPs and servlets to provide the presentation logic for the application. The application server runs EJB logic and sends requests to the integration server. Requests are forwarded from the Web presentation server to the application server using IIOP.

Using a Web presentation server further delineates the line between presentation and application logic. It lends itself to scalability by allowing system resources to be spread across multiple machines and although not shown, can be extended to implement load balancing among application servers.

SOA profile

Router application pattern::[SOA]Runtime pattern

SOA Profile Public Key InfrastructureDomain Name ServerUserProtocol FirewallWeb Server RedirectorDomain FirewallApplication ServerDirectoryEnterprise Service BusExisiting ApplicationsService Registry
Design Last Updated: 12-16-2005
(Click a node to get a detailed explanation.)

In this pattern the ESB node has replaced the integration server node. It provides the message routing function, as well as protocol conversion, logging, transformation, or other tasks related to the proper routing of messages.

The ESB approach:

  • Minimizes the number of adapters required to link service consumers to service providers
  • Improves reuse
  • Addresses any technical and information model discrepancies amongst services
  • Provides a single configuration point for distributed deployment
  • Decouples service requesters from providers
  • Provides a common access point for service requesters
  • Provides centralized security for services

The ESB can span across multiple system/application tiers, and may extend beyond the enterprise boundary.

Next, review product mappings.

Close [x]

Public Key Infrastructure (PKI)

PKI is a system for verifying the authenticity of each party involved in an Internet transaction, protecting against fraud or sabotage, and for nonrepudiation purposes to help consumers and retailers protect themselves against denial of transactions. Trusted third-party organizations called certificate authorities issue digital certificates -- attachments to electronic messages -- that specify key components of the user's identity. During an Internet transaction, signed, encrypted messages are automatically routed to the certificate authority, where the certificates are verified before the transaction can proceed. PKI can be embedded in software applications, or offered as a service or a product. e-business leaders agree that PKIs are critical for transaction security and integrity, and the software industry is moving to adopt open standards for their use.

Close [x]

User Node

The user node is most frequently a personal computing device (PC) supporting a commercial browser, for example, Netscape Navigator and Internet Explorer. The browser is expected to support SSL and some level of DHTML. Increasingly, designers need to also consider that this node might be a pervasive computing device, such as a Personal Digital Assistant (PDA).

Close [x]

Domain Name Server (DNS) Node

The DNS Node assists in determining the physical network address associated with the symbolic address (URL) of the requested information. The Domain Name Server Node provides the technology platform to provide host to IP address mapping, that is, to allow for the translation of names (referred to as URLs) into IP addresses and vice versa.

Additional Resources

  • (in English) ESS

Close [x]

Protocol Firewall Node

A firewall is a hardware/software system that manages the flow of information between the Internet and an organization's private network. Firewalls can prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets, and can block some virus attacks -- as long as those viruses are coming from the Internet. A firewall can separate two or more parts of a local network to control data exchange between departments. Components of firewalls include filters or screens, each of which controls transmission of certain classes of traffic. Firewalls provide the first line of defense for protecting private information, but comprehensive security systems combine firewalls with encryption and other complementary services, such as content filtering and intrusion detection.

Firewalls control access from a less trusted network to a more trusted network. Traditional implementations of firewall services include:

  • Screening routers, (the Protocol Firewall)
  • Application gateways (The Domain Firewall)

A pair of Firewall Nodes provides increasing levels of protection at the expense of increasing computing resource requirements. The Protocol Firewall is typically implemented as an IP Router.

See Also

Additional Resources

  • (in English) ESS

Close [x]

Domain firewall node

A firewall is a hardware/software system that manages the flow of information between the Internet and an organization's private network. Firewalls can prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets, and can block some virus attacks -- as long as those viruses are coming from the Internet. A firewall can separate two or more parts of a local network to control data exchange between departments. Components of firewalls include filters or screens, each of which controls transmission of certain classes of traffic. Firewalls provide the first line of defense for protecting private information, but comprehensive security systems combine firewalls with encryption and other complementary services, such as content filtering and intrusion detection.

Firewalls control access from a less trusted network to a more trusted network. Traditional implementations of firewall services include:

  • Screening routers (the Protocol Firewall)
  • application gateways (The Domain Firewall)

A pair of Firewall Nodes provides increasing levels of protection at the expense of increasing computing resource requirements. The Domain Firewall is typically implemented as a dedicated server Node.

See Also

Additional Resources

  • (in English) ESS

Close [x]

Web Server Redirector Node

In order to separate the Web server from the application server, a so-called Web Server Redirector Node (or just redirector for short) is introduced. The Web server redirector is used in conjunction with a Web server. The Web server serves HTTP pages and the redirector forwards servlet and JSP requests to the application servers. The advantage of using a redirector is that you can move the application server behind the domain firewall into the secure network, where it is more protected than within the DMZ.

Close [x]

Directory and security services node

The directory and security services node supplies information on the location, capabilities, and attributes (including user ID/password pairs and certificates) of resources and users known to this Web application system. This node can supply information for various security services (authentication and authorization) and can also perform the actual security processing, for example, to verify certificates. The authentication in most current designs validates the access to the Web application server part of the Web server, but this node also authenticates for access to the database server.

See Also

Additional Resources

  • (in English) ESS

Close [x]

Database server node

This Node's function is to provide persistent data storage and retrieval in support of the user to-online buying transactional interaction.

Customer related data that is stored is relevant to the specific business interaction, for example, the shopping cart and shipping address information. Some sites are registering users and storing customer profile data such as address, clothing sizes, preferences, and gift wish lists that others can access when buying presents. Most sites today do not store credit card information on this server for security reasons.

Also stored here is the product and catalog information used to dynamically build HTML pages for presentation during the shopping process.

The mode of DB access is perhaps the most important factor determining the performance of this Web application, in all but the simplest cases. The recommended approach is to collapse the DB accesses into a single or very few calls. This can be achieved using coding and invoking Stored Procedure Calls on the database. Typically many commerce servers share only one database server in a high volume site, so the technology to implement this node must be able to scale vertically.

Close [x]

LDAP

Lightweight Directory Access Protocol (LDAP) refers to the protocol that is used to communicate from a calling program (running on a node such as a Commerce Server) and a Directory Node. Information is kept on the LDAP-based directory node about such topics as people and/or services.

For example, the directory could be used to store information needed to identify registered shoppers (referred to as authentication). It could also be used to store information about what functions those shoppers are allowed to perform after being identified (referred to as authorization).

Close [x]

Application server node

The application server node provides the infrastructure for application logic and can be part of a Web application server. It is capable of running both presentation and business logic but generally does not serve HTTP requests. When used with a Web server redirector, the application server node can run both presentation and business logic. In other situations, it can be used for business logic only.

Close [x]

Integration Server Node

The purpose of this node is to interface between any front end access channel, such as the web, a call center, or a client/server ("fat client") PC, and whatever back-end application system is needed (including applications from other companies). It will perform the following kinds of services:

  • Convert protocols from the front end to match whatever the back-end systems understand
  • Decompose a single message from the front end (such as a web server) into several back-end messages (or transactions), and then re-compose the replies
  • Navigate from the front end to whatever back-end system needs to be accessed
  • In more complex cases, control the process or unit of work for a number of back-end interactions based on a request from the front end

The intent is to relieve each front end from having to handle the complexity of interfacing with potentially multiple back-end systems, which may be in different companies. The front end (such as the web server should just need to send a message to the integration server and have it look after the interface.

A second purpose for locating these interface services on the Integration server concerns security. There is a firewall between the web server and the integration server and the web server need have no knowledge of all the back-end addresses. Many location do not want a server located in the DMZ to have access directly to sensitive data and systems. In this case the web server can only send messages to the integration server, nowhere else.

Close [x]

Existing Applications and Data Node

Existing applications are run and maintained on nodes, which are installed in the internal network. These applications provide for business logic that uses data maintained in the internal network. The number and topology of these existing application and data nodes is dependent on the particular configuration used by these legacy systems.

Close [x]

Web Presentation Server

The Web presentation server node provides services to enable a unified user interface. It is responsible for all presentation-related activity. In its simplest form, it serves HTML pages and runs servlets and JSPs. For more advanced patterns, it acts as a portal and provides the access integration services (single sign-on, for example). It interacts with the personalization server node to customize the presentation based on the individual user preferences or on the user role. The Web presentation server allows organizations and their users to standardize and configure the presentation of applications and data in the most efficient way, while enabling fine-grained access control.

Close [x]

Service Registry

The role of the Service Registry is to provide details of services that are available to perform business functions identified within a taxonomy. The Service Registry can be implemented as an open-standard UDDI registry. Catalogs, such as a UDDI registry, can achieve one of the primary goals of a Service Registry: to publish the availability of services and encourage their reuse across the development activity of an enterprise.

The vision of Web services defines an open-standard UDDI registry that enables the dynamic discovery and invocation of business services. However, although technologies mature toward that vision, more basic solutions are likely to be implemented in the near term.

This node is also known as a Business Service Directory.

Close [x]

ESB

The ESB is a key enabler for a SOA as it provides the capability to route and transport service requests from the service requester to the correct service provider. The true value of the ESB concept, however, is to enable the infrastructure for SOA in a way that reflects the needs of today’s enterprise: to provide suitable service levels and manageability, and to operate and integrate in a heterogeneous environment.

Furthermore the ESB needs to be centrally managed and administered and have the ability to be physically distributed.

Close [x]

Directory Node

Directory Services provides an integrated LDAP server that easily integrates with other LDAP servers to provide for the directory needs of an e-business solution.