Hosting a server application on multiple network tiers

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for allocating server application logic across multiple tiers of a server system are described. In one aspect, a method includes hosting a server application on multiple servers. The servers include an application server deployed in a secure tier of an enterprise network and an edge server deployed in an edge tier of the enterprise network. A primary firewall isolates the secure tier from the edge tier and from a public network. A secondary firewall isolates the edge tier from the public network. The edge server is configured to receive requests for services provided by the server application, to perform a first subset of the services, and to relay a subset of the requests to the application server. The requests received by the edge server are sent from at least one client device through the public network and authenticated by the secondary firewall. The application server is configured to receive the relayed subset of requests and perform a second subset of the services in response to the relayed subset of requests. The relayed subset of requests received by the application server are authenticated by the primary firewall.

BACKGROUND

This specification relates to hosting a server application on an enterprise network. In a conventional enterprise network, origin servers execute code to provide server-side software functionality for client devices. Reverse proxy servers can broker traffic between the client devices and the origin servers. The reverse proxy servers intercept communication from the client devices and communicate with the origin servers on behalf of the client devices. The origin servers generate responses to the client requests and send the responses to the reverse proxy servers. The reverse proxy servers forward the responses to the client devices and cache the responses for later use. In some cases, the reverse proxy servers distribute the requests across nodes of an origin server cluster. The reverse proxy servers can be deployed in a DMZ of an enterprise network and communicate with client devices through a public network. The host servers can be deployed in the enterprise's internal network, which is isolated from the public network by the DMZ.

SUMMARY

This specification describes technologies relating to hosting a server application on multiple tiers of an enterprise network.

In general, one innovative aspect of the subject matter described in this specification can be embodied in methods that include the actions of hosting a server application on multiple server devices. The server devices include an application server device deployed in a secure tier of an enterprise network and an edge server device deployed in an edge tier of the enterprise network. A primary firewall isolates the secure tier from the edge tier and from a public network. A secondary firewall isolates the edge tier from the public network. The edge server is configured to receive requests for services provided by the server application, to perform a first subset of the services, and to relay a subset of the requests to the application server. The requests received by the edge server are sent from at least one client device through the public network and authenticated by the secondary firewall. The application server is configured to receive the relayed subset of requests and perform a second subset of the services in response to the relayed subset of requests. The relayed subset of requests received by the application server are authenticated by the primary firewall. Other embodiments of this aspect include corresponding systems, apparatus, and computer programs, configured to perform the actions of the methods, encoded on computer storage devices.

These and other embodiments can each optionally include one or more of the following features. The edge server supports multiple different transport protocols. The edge tier is transparent to the at least one client device. The edge server is configured to relay the subset of requests based on the edge server identifying that the application server is configured to perform the subset of requests. The edge server can be configured to perform the first subset of the services by storing a first configuration file in a memory of the edge server. The first configuration file identifies the first subset of the services as services that the edge server is configured to perform. The edge server stores application logic for performing both the first subset of the services and the second subset of the services. The application server can be configured to perform the second subset of the services by storing a second configuration file in a memory of the application server. The second configuration file identifies the second subset of the services as services that the application server is configured to perform. The application server stores application logic for performing both the first subset of the services and the second subset of the services. The edge server can be configured to perform the first subset of the services by programming server application logic stored on the edge server to perform only the first subset of services. The application server can be configured to perform the second subset of the services by programming server application logic stored on the application server to perform only the second subset of services. Latency tolerances can be identified for each of the first subset of services and for each of the second subset of services. The edge server can be configured to perform the first subset of the services based at least in part on the latency tolerances identified for the first subset of services. The application server can be configured to perform the second subset of the services based at least in part on the latency tolerances identified for the second subset of services. The latency tolerances identified for the second subset of services can include higher latency tolerances than the latency tolerances identified for the first subset of services. Levels of information security required for each the first subset of services and for each of the second subset of services can be identified. The edge server can be configured to perform the first subset of the services based at least in part on the levels of information security required for the first subset of services. The application server can be configured to perform the second subset of the services based at least in part on the levels of information security required for the second subset of services. The identified levels of information security required for the second subset of services can include higher levels of information security than the identified levels of information security required for the first subset of services. The edge tier can be included in a DMZ of the enterprise network, the secure tier can be included in an internal network of the enterprise, and the DMZ can isolate the internal network from the public network. The edge server is a first edge server device, the application server is a first application server device, and servers further include additional application servers deployed in the secure tier and additional edge servers deployed in the edge tier.

Particular embodiments of the subject matter described in this specification can be implemented so as to realize one or more of the following advantages. Functionality of a server-side application can be declaratively and/or dynamically partitioned across an edge network tier hosted within a network DMZ and a secure network tier hosted behind the DMZ. The secure network tier can be a higher security network tier than the edge network tier. For example, the edge network tier can be minimally secured to provide near real-time interactions between edge servers and clients, and the application or secure network tier can be maximally secured to ensure the integrity of functionality provided behind the DMZ. As such, web clients may establish a near real-time connection to the edge network tier, and the clients may also be granted seamless and transparent access to services running in either the edge network tier or the secure network tier under a consistent authentication state, with little or no impact on client code or configuration. This may allow security-insensitive server logic and near real-time data push with low latency requirements to execute at the edge network tier and sensitive server logic that has less stringent latency requirements to be executed on the secure network tier. In some implementations, a server portion of a rich internet application can be defined in a pluggable fashion that supports declarative partitioning, and the server portion of a rich internet application can be allocated across network tiers (e.g., the DMZ tier and the secure network tier) without having to re-code either the client portion or the server portion of the rich internet application. As such, the partitioning of services across network tiers can be accomplished without modifications to application logic.

DETAILED DESCRIPTION

FIG. 1shows an example enterprise data network system100. The data network system100includes a public network102and a private network106. A client device104communicates with the private network106through the public network102. The private network106includes an edge tier112where one or more edge servers110are deployed and a secure tier114where one or more application servers118are deployed. The secure tier114is isolated from the edge tier112and from the public network102by a primary firewall116. The edge tier112is isolated from the public network102by a secondary firewall108. The portion of the network system100between the primary firewall116and the secondary firewall108(including the edge tier112) may be referred to as a “DMZ” of the enterprise data network system100. The portion of the network system100behind the primary firewall116(including the secure tier114) includes an internal network of the enterprise data network system100. The edge server110and the application server118collaboratively host a server application. The services of the server application can be declaratively and/or dynamically partitioned between the application server118and the edge server110. As such, the application server118is configured to provide a first subset of the server application services, and the edge server110is configured to provide a second subset of the server application services. The server application can provide server-side functionality for a rich internet application running on the client device104.

The edge server110provides a configured set of service destinations to the client device104while also acting as a gateway to service destinations that only operate on the application server118. A service destination can process a client service request and/or push asynchronous messages and/or data to subscribed clients. The service destinations operating on the edge server110and the service destinations operating on the application server118can function collectively as a single server application. For example, the service destinations on the edge server110can have full access to the service destinations on the application server118. Also, the service destinations on the edge server110and the service destinations on the application server118have full access to any methods and/or attributes of data objects defined by either of the service destinations. As such, data passing between the service destinations may not require data export or other types of reformatting. In some cases, when a client device104initiates a session on the edge server110, configuration data can be pushed or pulled from the application server118to the edge server110. The configuration data sent to the edge server110can include an identification of the service destinations provided on the application server110. In some implementations, any one of the service destinations of a server application can run declaratively at either tier (i.e., the edge tier112, the secure tier114) with no impact on client application code or server application code. In some implementations, any of the service destinations of a server application can run at either tier via simple programmatic APIs (e.g., executed during server bootstrap) with no impact on client application code or server application code. As such, there is no need to recode the application in order to change and/or specify in which tier a service destination is executed.

The services of the server application can be partitioned between the edge tier112and the secure tier114. For example, declarative partitioning can be implemented by storing static configuration information in configuration files stored on the servers, by storing static configuration information in one or more databases accessible to the servers, and/or in another manner. The declarative configuration partitioning can be implemented with no changes to application code, allowing the same application code to be stored on both the edge server110and the application server118. As another example, programmatic partitioning of application functionality can be implemented by allowing service modules of the server application to be selectively instantiated and executed on the edge server110and/or the application server118. For example, a custom code plug-in module can be registered with both the edge server110and the application server118. The plug-in module can use server-side configuration application programming interfaces (APIs) to be used, for example at startup or at another time, to enable, disable, and/or customize individual service modules of a server application. Programmatic partitioning can allow more flexibility than static declarative configuration. In some implementations, when the server application is programmatically partitioned between the edge tier112and the application tier114, the edge server110can identify what services are available at the edge server110and the application server118can identify what services are available at the application server118without reference to configuration files or a configuration database.

In some implementations, a faster response may be provided to the client device104by executing the application code in the edge tier112rather than in the secure tier114. Executing application code in the secure tier114may provide a higher level of information security than executing application code in the edge tier112. As such the application services having less security constraints and more stringent network latency constraints can be executed in the DMZ, while the application services having stricter security constraints and less stringent network latency requirements can be executed in a more secure fashion behind the DMZ (in the secure tier114). For example, the application server118can be configured to perform all services that require a level of information security above some threshold security level. As another example, the edge server110can be configured to perform all services that have a latency tolerance below some threshold latency time. The application services provided in the DMZ and/or the application services provided in the internal network can include operations that allow a client to retrieve a value of one or more application variables, operations that allow a client to define a value of one or more application variables, operations that request a processing step to be performed by the server, combinations of these types of operations, and/or other types of operations.

A particular example includes a server application that provides financial services. One service provided by the example application includes a foreign exchange currency pair price feed. The foreign exchange currency pair price feed can include identification of exchange rates between one or more currency units. For example, the foreign exchange currency pair price feed may indicate an exchange rate between the US Dollar and the Euro and/or an exchange rate between the Euro and the Japanese Yen. The foreign exchange currency pair price feed may fluctuate over time and may be based at least partially on public and/or non-security sensitive data. As such, in some cases the foreign exchange currency pair price feed must be pushed to clients with minimum latency and does not have a strong security requirement. Another service provided by the example server application is trade placement fulfillment and confirmation. Trade placement fulfillment and confirmation services may have stronger security requirements (e.g., due to concerns about potential fraud, access to user-specific data, and the like) and tolerate slightly higher latency than the foreign exchange currency pair price feed. In this example, the foreign exchange currency pair price feed service can be provided in the edge tier112by an edge server110, while the trade placement service can be provided by the application server118. Such partitioning of services across multiple network tiers can provide the lower network latency needed for a first subset of services of a server application (e.g., foreign exchange currency pair price feed, and/or others) and the higher network security needed for a second subset of services of the server application (e.g., trade placement services, and/or others). A client device104can access both subsets of services in a seamless manner, without having to specify or request which network tier provides each services.

The client device104can be a personal computer, a laptop computer, a handheld mobile device, and/or another type of client device. The client device104includes a memory (e.g., a hard drive, a random access memory, and/or other types of memory) and a data processor. The client device can also include a display device (e.g., a monitor, a display screen, and/or another type of display device), removable data storage (e.g., magnetic disk, optical disk, flash memory, CD, DVD, and/or other types of removable data storage), one or more interface devices (e.g., a keyboard, a pointing device, a touchscreen, a printer, and/or other input-output devices), a communication interface (e.g., hardware for communicating over a wireless network, hardware for communicating over a wired network, and/or other types of communication interfaces), a data bus, and/or other features. The system100can include additional client devices (e.g., tens, hundreds, thousands, or more client devices).

The memory of the client device104stores one or more client applications, and the data processor of the client device104can execute the client applications. The client applications can include installed software applications, rich internet applications, and/or other types of applications. The client applications can include client applications designed to run on the Adobe Flash platform, the Adobe Flex platform, and/or another type of application platform. Such client applications can include SWF files and/or other file formats. The client applications can be written in an ActionScript language and/or another type of language. The client applications can include client applications that run in a web browser, on a virtual machine, in an operating system, and/or in a different type of runtime environment.

One or more of the client applications running on the client device104can be configured to communicate with a server application running on servers in the private network106. Such a client application may function based on interactions with a remote server, such as the application server118and/or the edge server110. As such, a client application running on the client device104can generate requests for services provided by a server application. The server applications in the private network106can interact with one or more client applications running on the Adobe Flash platform, the Adobe Flex platform, and/or another type of application platform. The server applications can be written in Java, C++, and/or another type of programming language. The server applications can include server applications that run on a virtual machine, in an operating system, and/or in a different type of runtime environment. The client device104can interact with the edge server110using one or more different communication protocols or connection transports. For example, the client device104can establish a connection with the edge server110using Real Time Messaging Protocol (RTMP), HyperText Transfer Protocol (HTTP) streaming, HTTP long polling, simple HTTP polling or piggybacking, basic HTTP request-response, and/or another type of connection. The requests generated by the client application can be sent through the public network102from the client device104to one or more of the devices deployed in the private network106.

The public network102can include an unsecured data communication network and/or a secured data network having a different and/or lower security level than the private network106. The public network102can include the Internet and/or another public data communication network. The public network102can include a lower security network tier of the enterprise network and/or a private network of a different enterprise network. The public network102is not automatically trusted by the private network106. As such, the private network106can authenticate and/or verify data received from the public network102. In the example shown inFIG. 1, all data received from the public network102must be verified and/or authenticated by the secondary firewall108before the data received from the public network102can be delivered to the edge server110.

The secondary firewall108can isolate all or part of the private network106from the public network102. For example, the secondary firewall108can delineate an outer boundary of an enterprise DMZ. The secondary firewall108can verify and/or authenticate all data communication traffic between the DMZ (including the edge tier112) and the public network102. For example, requests addressed to the application server118from the client device104can be received by the secondary firewall108. The secondary firewall108can either accept or reject the received requests based on rules implemented by the secondary firewall108. For example, the secondary firewall108can accept, reject, and/or quarantine data received from the public network102based on the source of the data, the content of the data, the type of data, a destination of the data, the size of the data, whether and/or how the data is encrypted, password authentication, and/or other factors. The secondary firewall108can be implemented using multiple different types of firewall protocols.

The edge server110is a server device that receives requests and/or messages from the client device104. The system100can include additional edge servers110deployed in the edge tier112. The edge servers110can operate independently and/or as a server cluster. An example edge server202is shown inFIG. 2A. The example edge server202includes a processor210, a memory220, and a communication interface230. The memory220stores edge server configuration files222, application components224, and other data226. The edge server202can also include a display device (e.g., a monitor, a display screen, and/or another type of display device), removable data storage (e.g., magnetic disk, optical disk, flash memory, CD, DVD, and/or other types of removable data storage), one or more interface devices (e.g., a keyboard, a pointing device, a touchscreen, a printer, and/or other input-output devices), a data bus, and/or other features.

The edge server202can use the processor210to perform a subset of the services of a server application, for example, by executing and/or interpreting application logic of one or more of the application components224. The edge server configuration can declaratively and/or dynamically partition the services of each server application between the edge server202and one or more application servers. The example edge server202shown inFIG. 2Aperforms only those services of each of a server application that are designated by the edge server configuration files222. For example, if a particular server application provides services A, B, and C, an edge server configuration file222may specify that the edge server202is only configured to perform services A and B. As such, the edge server202can be configured to perform a customized subset of the application services by customizing only the edge server configuration files222and without modifying the server application code. In some implementations, the edge server202does not include code for performing services that the edge server202is not configured to perform.

As shown inFIG. 1, the edge server110can function as a reverse proxy to the application server118. As such, the edge server110can control client access and/or data traffic to the application server118by receiving requests and/or messages addressed to the application server118from the client device104. The edge server110can respond to the requests received from the client device104by sending a response to the client device104. The edge server110can forward the requests received from the client device104to the application server118. The edge server110can determine whether the edge server110is configured to perform a requested service, for example, by consulting a configuration file stored on the edge server110. If the edge server110determines that it is configured to provide the requested service, the edge server110can perform the service by interpreting and/or executing server application logic stored on the edge server110. If the edge server110determines that it is not configured to provide the requested service, the edge server110can forward the request to the application server118. Forwarding a request to the application server118can include sending the received request or generating a new request based on the received request and sending the new request.

In the example shown inFIG. 1, the edge tier112is transparent to the client device104. For example, the client application running on the client device104may have no knowledge of the partitioning of services between the edge server110and the application server118. As such, the client application addresses all requests to an application server, and all responses received from the edge server110appear to the client application as though the responses were sent from an application server.

In the example shown inFIG. 1, the secure tier114only receives data from within the private network106, and all data sent to the secure tier114from the edge tier112must be verified and/or authenticated by the primary firewall116. Thus, in the example, requests and/or messages sent from the edge server110to the application server118must be verified and/or authenticated by the primary firewall116before they can be delivered to the application server118.

The primary firewall116can isolate the enterprise's internal network from all external systems and data traffic. For example, the primary firewall116can isolate the internal network from the DMZ. Devices in the internal network can communicate with the highest level of trust within the internal network, for example, by assuming that data received from any other device in the internal network is valid and authenticated. Devices in the internal network can communicate with devices outside of the internal network through the primary firewall116. In some implementations, devices in the internal network only accept data generated by known processes running in the DMZ.

The primary firewall116can verify and/or authenticate all data communication traffic between the DMZ (including the edge tier112) and the public network102. For example, requests addressed to the application server118from the edge server110can be receive by the primary firewall116. The primary firewall116can either accept or reject the received requests based on rules implemented by the primary firewall116. For example, the primary firewall116can accept, reject, and/or quarantine received data based on the source of the data, the content of the data, the type of data, a destination of the data, the size of the data, whether and/or how the data is encrypted, password authentication, and/or other factors. In some cases, the primary firewall116implements a higher level of data security than the secondary firewall108. The primary firewall116can be implemented using multiple different types of firewall protocols.

The application server118is a server device that communicates with the client device104through an edge server. The system100can include multiple application servers118deployed in the secure tier114. The application servers118can operate independently and/or as an application server cluster. An example application server252is shown inFIG. 2B. The example application server252includes a processor260, a memory270, and a communication interface280. The memory270stores application server configuration files272, application components274, and other data276. The application server252can also include a display device (e.g., a monitor, a display screen, and/or another type of display device), removable data storage (e.g., magnetic disk, optical disk, flash memory, CD, DVD, and/or other types of removable data storage), one or more interface devices (e.g., a keyboard, a pointing device, a touchscreen, a printer, and/or other input-output devices), a data bus, and/or other features.

The application server252can use the processor260to perform a subset of the services of a server application, for example, by executing and/or interpreting application logic of the application components274. The application server252is configured, according to the application server configuration files272, to perform a subset of the services provided by a server application. For example, if a particular server application provides services A, B, and C, an application server configuration file272may specify that the application server252is only configured to perform service C. The application server configuration file272may also specify that an edge server is configured to perform services A and B. As such, the application server252can be configured to perform a customized subset of the application services using only the application server configuration files272and without modifying the server application code.

One or more of the application components224stored on the edge server202and one or more of the application components274stored on the application server252can collectively provide all of the services of a given server application. For example, one of the application components224on the edge server202can provide a first subset of services of a given server application, and one or more of the application components274on the application server252can provide a second subset services of the given server application. The server application components274stored on the application server252may include code that is not included in the server application components224stored on the edge server202. For example, the server application components274may include code for secure services that require a level of security provided in the secure tier114but not in the edge tier112. Similarly, the server application components224stored on the edge server202may include code that is not included in the server application components274stored on the application server252. In some implementations, the application components224stored on the edge server202and the application components274stored on the application server252can be identical for a given server application, and the edge server configuration files222designate which of the components are available to be executed on the edge server202while the application server configuration files272designate which of the components are available to be executed on the application server252.

As shown inFIG. 1, the application server118receives requests for services from the edge server110and sends responses to the edge tier112. The application server118can determine whether the application server118is configured to perform a requested service, for example, by consulting a configuration file stored on the application server118. If the application server118determines that it is configured to provide the requested service, the application server118can perform the service by interpreting and/or executing server application logic stored on the application server118. In some implementations, the application server118may assume that it is configured to perform a requested service based on the edge server110forwarding the request to the application server118.

In some instances, the edge server110and the application server118are functionally equivalent but have different static configurations. The edge server configuration, discussed in more detail with respect toFIGS. 3A and 3B, can define a GatewayService data object that opens and manages gateway connections to the application server118on behalf of the client device104. The application server118configuration can define a GatewayEndpoint data object that serves as the network endpoint for the gateway connections that the edge server110opens on behalf of the client device104.

Edge servers110deployed in the edge tier112and/or application servers118deployed in the secure tier114can be clustered independently to scale out capacity horizontally at each tier. In some implementations, the GatewayService data object executing within an edge server110can connect to one application server118from a list of statically addressed application servers118in the secure tier114. When a gateway connection is successfully established between an edge server110and an application server118, a full view of the application server118functionality can be retrieved to the edge server110. The retrieved data can include information describing statically and dynamically configured service destinations that the application server118provides and/or the network addresses for all available cluster nodes in the secure tier114.

In some implementations, the edge server110can open a gateway connection to application servers118in a round-robin fashion, by a load balancing technique, and/or in another manner. For example, a LoadCalculator data object may be deployed in an application server118, and the edge server110can periodically query the LoadCalculator data object to determine the reported loads across the application server cluster. The gateway connections can be long-lived TCP socket connections, and such load consideration may be considered when the edge server110opens a new gateway connection on behalf of a new client device104. However, in some cases, data traffic for already-connected clients is not load balanced across servers. In such cases, a client device104may be “pinned” to a single application server118. “Pinning” a client device104to an application server118may help manage a subscription state for the client device104and/or help manage the potentially rapidly changing state of the queue of messages and data to push to the client. “Pinning” a client device104to an application server118may help avoid a cost associated with replicating a message queue in real-time and/or in a strongly consistent fashion across multiple nodes of a cluster.

The GatewayService data object defined by the edge server110can verify that a client device104is actively authenticated before opening a new gateway connection to an application server118on behalf of the client device104. After a client's authentication state from the edge tier112is synchronized to the secure tier114, the client's request and/or message is passed over the gateway connection for secure processing by the application server118. Any later change in the client's authentication state, such as a subsequent logout, can be synchronized across the edge tier112and the secure tier114. Authorization checks may be applied at both the edge server110and the application server118on a per-service and/or per-service destination basis. For some service types, authorization checks may be applied at even finer granularities, for example, at the level of a specific service operation.

A server-side session state can be maintained at both the edge server110and the application server118. In some implementations, the server-side session state is not automatically synchronized across tiers (for example, due to security concerns and/or other concerns). In some cases, security concerns dictate that any per-client data tracked at the application server118must not be unintentionally exposed at the edge tier112. In some cases, messages can be sent between the edge tier112and the secure tier114on behalf of a known client to synchronize some subset of a server-side session state. If the session state at either end of a gateway connection is invalidated, its mirror component can be invalidated and the remote client can be notified. Invalidating a session in such a manner can preserve the ordered processing provided by reliable messaging and allow the client device104to maintain a consistent cross-tier server-side session state.

Reliable messaging between a client and the partitioned application can ensure in-order, once-and-only-once delivery of request, reply and pushed messages in either direction between the client and server portions of the application. Synchronizing shut down of server session state across tiers and to the client may ensure a well-defined conclusion to any existing reliable message sequence between the client and server. Such synchronization may prevent out-of-order delivery and/or redelivery problems across reconnect attempts and reconnections between the client and the partitioned server application. In some implementations, reliable message exchange can be enforced at the logical connection level between a client and the server application, and individual service destinations can be tagged as reliable or not reliable. Such implementations may allow a single transport connection to serve as a channel for both reliable and unreliable interactions between the client and server.

In one aspect of operation, the client device104runs a rich internet application that interacts with a server application hosted on the edge server110and the application server118. The server application is partitioned between the DMZ (which includes the edge tier112) and the internal network (which includes the secure tier114). The edge server110and the application server118perform multiple different services of the server application in response to requests received from the client application. The services of the server application include two example services “S1” and “S2.” A request for service “S1” is sent from the client device104through the public network102and is received by the secondary firewall108. The secondary firewall108validates and/or authenticates the request. The edge server110receives the request for service “S1” from the secondary firewall108. The edge server110determines that the edge server110is configured to perform service “S1.” For example, the edge server110may access a configuration file that identifies service “S1” as a service to be provided by the edge server110. The edge server110performs service “S1” by executing and/or interpreting application code, and the result is sent back to the client device104through the secondary firewall108and through the public network102.

In the same aspect of operation, the client application running on the client device104sends a request for service “S2” of the server application. The request for service “S2” is sent from the client device104through the public network102, and the request is received by the secondary firewall108. The secondary firewall108validates and/or authenticates the request. The edge server110receives the request for service “S2” from the secondary firewall108. The edge server110determines that the edge server110is not configured to perform service “S2.” For example, the edge server110may determine that the application server118is configured to perform service “S2” by accessing application server configuration data pulled from the application server118. The edge server110relays the request for service “S2” through the primary firewall116to the application server118. The primary firewall116validates and/or authenticates the request. The application server118receives the request for service “S2” and performs service “S2” by executing and/or interpreting application code. The result is sent back to the client device104through the primary firewall116, through at least a portion of the edge tier12, through the secondary firewall108, and through at least a portion of the public network102.

FIG. 3Ashows operational aspects of an example data network system300that includes a first client device302a, a second client device302b, and an edge server304. Each of the client devices302a/302bcan be the client device104ofFIG. 1, and the edge server304can be the edge server110ofFIG. 1.FIG. 3Ashows the clients302aand302binteracting with service destinations hosted on the edge server304.

In the example shown, the first client302acommunicates over a Real Time Messaging Protocol (RTMP) connection with the RTMPEndpoint data object330on the edge server304. The edge server304maintains a FlexClient instance334representing a SWF application and an RTMPFlexSession data object332representing the connection between the client302aand the edge server304. The client302ahas subscribed to receive pushed messages, and the edge server304has created an EndpointQueue data object336that is scoped to the connection with the first client302a. The EndpointQueue data object336stores messages to push for any subscription the client302ahas established over its RTMP connection.

The second client302bcommunicates over a streaming Action Message Format (AMF) connection with the StreamingNIOAMFEndpoint data object340on the edge server304. The edge server304maintains a FlexClient instance344that represents a SWF application and a NIOHTTPFlexSession data object342representing the connection between the client302band the edge server304. The second client302bhas an EndpointQueue346indicating that it has subscribed to at least one service destination on the edge server304. In addition, the second client302ahas a server-side ReliableSequence348, indicating that it is interacting with some number of service destinations reliably.

FIG. 3Bshows additional operational aspects of the example data network system300ofFIG. 3A. As shown inFIG. 3B, the data network system300additionally includes a first application server306aand a second application server306b. Each of the application servers306a/306bcan be the application server118ofFIG. 1.

As shown inFIG. 3B, when the client302aand/or the client302bsends a message to a service destination that is hosted on an application server (e.g., the application server306aand/or the application server306b), a GatewayService data object338opens a gateway connection to the appropriate application server on behalf of the client. In some implementations, when a client interacts with an application server, the client has a dedicated gateway connection. In some implementations, an application is hosted by a cluster of application servers, and the GatewayService data object338can distribute a processing load across the cluster nodes.

The GatewayService data object338can send instructions to a GatewayEndpoint data object on an application server to request that the GatewayEndpoint data object create a FlexClient data object and an associated GatewayFlexSession instance. As shown inFIG. 3B, the GatewayService data object338has opened two gateway connections, one for the first client302aand one for the second client302b. The gateway connection for the first client302aterminates at the GatewayEndpoint data object350on the first application server306a, and the gateway connection for the second client302bterminates at the GatewayEndpoint data object356on the second application server306b. The clients302aand302bcan interact with service destinations running on the respective application servers306aand306bthrough the GatewayService data object338. The clients302aand302bcan also interact with service destinations running on the edge server304through the RTMPEndpoint330and the StreamingNIOAMFEndpoint340, respectively.

FIG. 4shows example operations and interactions in an example enterprise data network system400. The system400includes a client device402, an edge server404, an application server406, a first firewall408a, and a second firewall408b. The system400can include one or more of the elements of the system100ofFIG. 1. For example, the client device402can be the client device104ofFIG. 1, the firewall408acan be the secondary firewall108ofFIG. 1, the edge server404can be the edge server110ofFIG. 1, the firewall408bcan be the primary firewall116ofFIG. 1, and/or the application server406can be the application server118ofFIG. 1. Some example operations and interactions in the system400are shown inFIG. 4. The operations and interactions shown may be performed in the order shown and/or in a different order; additional and/or different operations and interactions may be also performed in the system400.

At410, a first request for a first service of a server application is sent from the client402to the edge server404. The first request is sent through a public data network and authenticated by the firewall408aprior to receipt by the edge server404. At412, the edge server404performs the first service in response to the first request. For example, the edge server404can execute and/or interpret server application code stored on the edge server404to perform the requested service. At414, the edge server sends the client402a response to the first request. The response to the first request includes an identification of a first result of performing the first service.

At416, a second request for a second service of the server application is sent from the client402to the edge server404. The second request is sent through the public data network and authenticated by the firewall408aprior to receipt by the edge server404. At418, the edge server404relays the second request to the application server406. The relayed second request is authenticated by the firewall408bprior to receipt by the application server406. At420, the application server406performs the second service in response to the relayed second request. For example, the edge server404can execute and/or interpret server application code stored on the application server406to perform the requested service. At422the application server406sends the edge server404a response to the relayed second request. In some implementations, the response to the relayed second request can be sent to a different edge server in an edge tier between the firewall408aand408b. At424, the response from the application server406is relayed to the client402from the edge server404or from another edge server in the edge tier.

A client and server are generally remote from each other and typically interact through a communication network. Examples of communication networks include a local area network (“LAN”) and a wide area network (“WAN”), an inter-network (e.g., the Internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks). The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other.

What is claimed is: