Zone-Based Topic Mediator for API Invocation Across Firewall Boundaries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing API service mediation technologies struggle to invoke target API service endpoints effectively due to constraints, requirements, and regulations, such as firewall rules and security requirements, which prevents direct invocation across network boundaries.
Innovation Solution
A distributed mediator system using zone-based topics within a publish/subscribe messaging infrastructure, where workers are selected to perform tasks across multiple zones, enabling flexible deployment and invocation of API service endpoints while adhering to security and privacy requirements, and allowing for asynchronous or synchronous invocation models.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a mediator is deployed on the public Internet to invoke target API service endpoints, then the mediator can be reached by target client entities, but the mediator cannot reach the server inside the secure intranet subnet due to enterprise firewall rules
Solution Approach 1:
The patent introduces a zone-based topic messaging system as an intermediary that bridges different network zones. The messaging infrastructure enables communication between the public Internet zone and the secure intranet zone without requiring direct connections across firewall boundaries, thus resolving the accessibility problem while maintaining security constraints
Solution Approach 2:
The system segments the network into distinct zones (public Internet zone, secure intranet zone, and mediator zone) with zone-based topics that define communication boundaries. This segmentation allows each zone to maintain its security properties while enabling controlled interaction through the messaging infrastructure
2Object-affected harmful factors
If a mediator is deployed inside the secure intranet subnet, then the mediator can reach the server, but the mediator cannot be reached by target client entities due to enterprise firewall rules
Solution Approach 1:
The messaging infrastructure acts as an intermediary that decouples the mediator's location from its accessibility. The mediator can be deployed in the secure intranet zone while the messaging system provides a communication bridge that allows client entities on the public Internet to invoke services without direct network connectivity
Solution Approach 2:
The system adds a messaging dimension to network communication, where interactions are mediated through published and subscribed topics rather than direct network connections. This dimensional shift allows the mediator to reside in a secure zone while maintaining accessibility through the messaging layer
3Ease of operation
If a mediator is deployed on the intranet outside the secure subnet, then the mediator can be reached by target client entities, but the mediator cannot reach the server per enterprise security requirements
Solution Approach 1:
The zone-based messaging system provides a security-aware intermediary layer that enforces security constraints while enabling communication. The messaging infrastructure mediates between the mediator and the server, ensuring that security requirements are met while allowing the mediator to function accessible to client entities
4Device complexity
If direct invocation of API service endpoints is used, then the invocation is simple and direct, but the system cannot accommodate network firewall rules, enterprise security requirements, and data regulations
Solution Approach 1:
The messaging infrastructure serves as an intermediary layer that maintains the simplicity of direct invocation while adding the capability to accommodate security constraints. The zone-based topic system provides a standardized interface that works whether the mediator is in the public zone, intranet zone, or secure zone, thus maintaining versatility across different deployment scenarios
Data Source
AI summary
A method, computer program product, and computer system for performing an Application Programming Interface (API) service using zone-based topics within a publish/subscribe (pub/sub) messaging infrastructure. An API service request sent by a client entity is received and specifies an API service to be fulfilled. A selection of an API service endpoint configured to execute the API service is received. Messages are posted to respective pub/sub zone-based topics, resulting in selection of workers subscribed to the respective zone-based topics. Each zone-based topic includes tasks to be performed in a specified one or more zones. For each zone-based topic, the tasks of the zone-based topic are implemented by executing the worker selected for the zone-based topic. The tasks of the zone-based topics include invoking the API service endpoint for the requested API service and making a fulfillment result of the API service available to the client entity.