Patent Application
20120151204
None.
This invention was not developed in conjunction with any Federally sponsored contract.
Not applicable.
U.S. patent application Ser. No. 12/485,653, filed by Jason D. LaVoie et al., on Jun. 16, 2009, entitled “METHOD AND SYSTEM FOR CONTENT-BASED ROUTING OF NETWORK TRAFFIC”, our docket number CAM920090007US1, is hereby incorporated by reference in its entirety, including figures.
The invention generally relates to technologies for associating users of remote computer systems with a plurality of server systems while efficiently making user-specific data available to the server system.
There are several general architectures of servers in networks which provide services to users of remote terminals, devices, and web browsers. A fundamental requirement for such arrangements is for user-specific data, such as a user's account information, to be made available to a particular application server computer selected from a group of application servers in the network. One such approach is to replicate all user data to all applications servers. A drawback of this approach is the cost and size of the data storage footprint, the inability to scale the solution well, and the complexity of managing such an environment.
A alternative to this approach is to manually break a networked computing environment into clusters, where the client device is directly configured to connect with a particular cluster. This is an adequate solution for certain environments such as on closed networks with thick clusters. However, this approach does not lend itself to the more advanced model of cloud or thin-client computing. Management of the clusters becomes costly.
Another approach has been to have database servers act as “backend” databases, where all database servers are networked to all application servers so that the user-specific data does not have to be replicated, it is simply accessed from the selected application server over the network. This latter solution avoids replication, but is notably more complex to configure, maintain, and significantly more expensive in many realizations.
Content-based routers, or so-called layer-seven routers, provide a split connection proxy to direct user computers to particular application servers in a network by terminating a Transmission Control Protocol/Internet Protocol (TCP/IP) connection between the user computer and the content-based router, and establishing a new TCP/IP connection between the content-based router and the selected back-end server, typically routing hyper text transfer protocol (HTTP) page requests to the selected application server and responses from the server back to the user computer. As such, content-based routers can be viewed as specialized layer-seven routers, where the term “layer-seven” generally refers to the Open Systems Interconnection (OSI) seven-layer model promulgated in International Standards Organization (ISO) standard number 7498, which is described in more detail in the following paragraphs under “Open Systems Interconnection Models”.
Reverse proxies and content-based routers can distribute (“spray”) connections and sessions using many different methods to a plurality of back-end application servers, but generally speaking, once a connection is established between a user computer and an application server, the user computer is affinitized to a specific application server. This has the aforementioned drawback in that when the user-specific application data is stored directly on the application servers (versus being stored by a back-end database), the user-specific data must be replicated to every server or must be replicated to each server as needed.
In another patent application filed Jun. 16, 2009, now U.S. Ser. No. 12/485,653, a method for real-time look-ups to route users to specific back-end servers has been described in order to solve this issue. However, there remains a limitation of increased delay for the look-ups, as well as increased cost by deploying more servers.
Efficient routing for a client-server session or connection is provided in an application layer of multi-layered systems interconnect stack by caching a plurality of application-specific information at an intermediary network point; using the application specific information to route messages for an application connection; and indexing the application-specific information with a key provided by the application. Optionally, a second key may be used to retrieve the application-specific information if the first key is not provided in an application connection request, where the second key is optionally opaque to the application program. The intermediary network point may be an edge of network Internet Protocol (IP) switch, and the application layer in which the routing is performed may be layer seven of the Open Systems Interconnection model.
The description set forth herein is illustrated by the several drawings.
In
The inventors of the present invention have recognized a problem not previously recognized or addressed by those ordinarily skilled in the art. In particular, the inventors have recognized that delay for routing look-up operations in reverse proxies and content-based routers are unnecessarily long, and that the cost of server deployment is unnecessarily high due to the approaches described in the background of the invention.
To address this problem in the art using a different approach than those previously taken, the inventors have built a layer-seven routing table in an Internet Protocol (IP) switch. After a look-up operation is performed on behalf of a new user (at the beginning of a new session), the routing information is stored in the IP switch. Subsequent requests from that user are routed appropriately according to the routing information stored in the IP switch, rather than having to look it up again from another source or server.
For large hosting environments using co-located application and data, users are directed to a specific set of servers. This is done via a look-up on the inbound request, such as is described in the related patent application, which is incorporated by reference to the present patent application. There is a cost associated with performing a look-up on every new request, especially with long running user sessions. The new method employs caching the routing state at the IP switch.
While those ordinarily skilled in the art will readily recognize that caching, in general, is not new, several technical hurdles had to be overcome for the inventors' approach to be operational, the solutions to which were not readily apparent or obvious. In particular:
These three solutions form the core of embodiments according to the invention, with the secondary cookie being somewhat optional, albeit omission of the secondary cookie in the absence of a replacement failure recovery mechanism being ill advised in many situations.
The present invention will be described with reference to one or more exemplary embodiments which are compliant with the Open Systems Interconnection (OSI) model promulgated by the International Organization for Standardization (ISO). This well-known interconnection model provides seven layers of functions, where the functions within a layer are conceptually similar to each other: Layer one is the Physical Layer, layer two is the Data Link Layer (including the Wide Area Network (WAN) Protocol and Local Area Network (LAN) protocols), layer three is the Network Layer, layer four is the Transport layer; layer five is the Session Layer; layer six is the Presentation Layer; and layer seven is the Application Layer.
For purposes of illustrating the invention, the following example embodiments will be provided relative to this seven-layer model. It will be understood by those ordinarily skilled in the art, however, the present invention may be realized in conjunction or compliant with other communications protocol stacks and models.
Further, the reader is cautioned to distinguish between client-server “sessions”, which are the set of communications between a client device and a server computer for the duration of transaction or interaction between the two, and the session layer of the OSI model. These are distinctly different uses of the term “session”.
The related patent application operates in a client-server environment, the router performing a look-up to determine which backend server to go to among a plurality of servers. However, in the related patent application, instead of replicating all user-specific data to all M application servers in the network, data storage is minimized by only copying the user-specific data to N application servers, where N<M. So, according to this related patent application, the routing method is enhanced to select an application server from the subset of servers which already have the particular user's data stored on it.
The present invention goes beyond the well-known method of caching at the router. The present invention provides a performance enhancement to the system and method disclosed in the related patent application by taking that modified routing information—e.g. the routing to the N subset of servers according to the user-specific data storage location—and storing (caching) it in the router. Then, the present invention provides a method to use that information in routing decisions for each subsequent Transmission Control Protocol/Internet Protocol (TCP/IP) connection. Normally, routers only have context for the length of each TCP/IP connection, and do not retain context across different TCP/IP connections. So, the present invention provides a mechanism to address that limitation of standard (unimproved) routers. To accomplish this, a cookie is created for each application layer or HTTP session, which is then utilized during subsequent interactions between the same user device and the applications server to index into the cached routing information.
Further, to enhance the reliability of this new routing method, a secondary cookie is also provided to the user device during session initialization. This was provided in new method in order to recover context of a previously-established session, such as when the context is lost by the browser device or by the router device, in order to avoid re-initializing a session (e.g. re-authenticating, creating a new primary cookie, etc.). Web browsers are especially susceptible to losing cookies, whether by software error or by normal operation of various protection products such as anti-phishing and anti-spyware products. These types of security products often delete or quarantine cookies that they determine to be suspect, which can hamper normal, non-malicious operation of web-based applications. The secondary cookie of the present invention is useful in dealing with this likely problem during operation of embodiments of the invention.
According to one available embodiment of the invention, only one computer, for example the authentication server, is encrypting and decrypting the secondary cookie. So, rather than have to use more complex encryption schemes such as Public Key Infrastructure (PKI) or browser encryption methods, this embodiment of the invention may use any encryption/decryption scheme which is deemed suitable by the system designer and installer and supported by the authentication server. In a variation embodiment, the enhanced router may also be provided with the decryption process to decrypt the secondary cookie.
Turning to
Responsive to receipt (101) of a “GET” HTTP command, it is determined (102) if context already exists for this client-server session or connection. If so, then the process has already been completed, and it ends. If not, then it is determined (103) if a session cookie is already present.
If a session cookie is already present, then it is locally decrypted (104), and the session table is searched to see if a corresponding entry is already present (105). If the entry is found, then it is used to direct the GET request to the appropriate back-end server (106).
However, if no session table entry is found corresponding to the decrypted session cookie, then the session context may have been lost, so a check is made (107) to determine if a secondary cookie is present. If it is, then it is passed to an authentication server for decryption (to recover the session context), preferably using an HTTP request and response. Next, the session table is updated (109), and a new session cookie is created (110) to correspond to the updated entry in the session table. Then, the entry in the session table is used to direct the GET request to the appropriate back-end server (106).
If no secondary cookie is found (107), then a request (111) is made for new authentication, preferably using Security Assertion Markup Language (SAML) to an Identity Provider of assertions (IdP), and receiving the new assertion (112). This is forwarded (113) to the authentication server, and if valid (114), a secondary cookie is created (115). If the assertion is not valid (114), then the process to obtain a new assertion (111-114) is repeated.
The logical process of
Turning to
In subsequence 250, a browser (201) attempts to do something with a server (e.g. makes an application server request), such as sending GET, POST HEAD, and OPTIONS HTTP commands. This is received by an HTTP Reverse Proxy Server (203), but in this example, the session is new, and there are no cookies or SAML established yet for this user or browser (201). So, in subsequence 251, authentication is performed by an authentication server or service, the reverse proxy server (203), an the authentication server (204).
In subsequence 252, the session table, which is cached by the IP router, is updated to contain an appropriate entry for redirection, and in subsequence 253, access to a particular application server (206) from provided by routing messages between the browser (201) and the application server (206) using the session entry for routing in the session table which is cached at the IP rouer.
In
In
In
Regarding computers for executing the logical processes set forth herein, it will be readily recognized by those skilled in the art that a variety of computers are suitable and will become suitable as memory, processing, and communications capacities of computers and portable devices increases. In such embodiments, the operative invention includes the combination of the programmable computing platform and the programs together. In other embodiments, some or all of the logical processes may be committed to dedicated or specialized electronic circuitry, such as Application Specific Integrated Circuits or programmable logic devices.
The present invention may be realized for many different processors used in many different computing platforms.
Many such computing platforms, but not all, allow for the addition of or installation of application programs (801) which provide specific logical functionality and which allow the computing platform to be specialized in certain manners to perform certain jobs, thus rendering the computing platform into a specialized machine. In some “closed” architectures, this functionality is provided by the manufacturer and may not be modifiable by the end-user.
The “hardware” portion of a computing platform typically includes one or more processors (804) accompanied by, sometimes, specialized co-processors or accelerators, such as graphics accelerators, and by suitable computer readable memory devices (RAM, ROM, disk drives, removable memory cards, etc.). Depending on the computing platform, one or more network interfaces (805) may be provided, as well as specialty interfaces for specific applications. If the computing platform is intended to interact with human users, it is provided with one or more user interface devices (807), such as display(s), keyboards, pointing devices, speakers, etc. And, each computing platform requires one or more power supplies (battery, AC mains, solar, etc.).
The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises” and/or “comprising,” when used in this specification, specify the presence of stated features, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, steps, operations, elements, components, and/or groups thereof, unless specifically stated otherwise.
The corresponding structures, materials, acts, and equivalents of all means or step plus function elements in the claims below are intended to include any structure, material, or act for performing the function in combination with other claimed elements as specifically claimed. The description of the present invention has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the invention. The embodiment was chosen and described in order to best explain the principles of the invention and the practical application, and to enable others of ordinary skill in the art to understand the invention for various embodiments with various modifications as are suited to the particular use contemplated.
It should also be recognized by those skilled in the art that certain embodiments utilizing a microprocessor executing a logical process may also be realized through customized electronic circuitry performing the same logical process(es).
It will be readily recognized by those skilled in the art that the foregoing example embodiments do not define the extent or scope of the present invention, but instead are provided as illustrations of how to make and use at least one embodiment of the invention. The following claims define the extent and scope of at least one invention disclosed herein.
