1. Field of the Invention
This invention relates to enhanced network services using a subnetwork of communicating processors.
2. Description of Related Art
A computer network having more than one possible message delivery path, such as for example a network of computer networks (an “internetwork”), generally comprises a set of processors which have the task of routing each message from its source to its destination. These processors (herein called “routers”, but sometimes called “bridges”, “brouters”, or other terms) generally interoperate using a common distributed routing technique. For example, (1) routers generally exchange information about routing conditions in the network, so as to globally inform all routers of conditions which are detected locally, (2) routers generally each route messages according to the same techniques using the same routing technique.
The collection of routers (herein called the “subnet” of routers) thus has access to a rich collection of distributed information about the status of the network needed for routing messages therein, including detailed and up-to-date information about the network topology, relative distance measures in the network, administrative policies in force in the network (such as, for example, network “firewalls” or routers which will route only a subset of messages), and other information. It would be advantageous to provide at least some of this distributed information to applications which might use it to provide enhanced services. Examples of such enhanced services, and how they would be provided, are described herein.
The router subnet also provides a powerful and available resource for distributing other information, not strictly required for the task of routing messages in the network, such as, for example, relative load at each host in the network. It would be advantageous to disseminate this information and provide at least some of it to applications which might use it to provide enhanced services. Examples of such enhanced services, and how they would be provided, are described herein.
Accordingly, it would be advantageous to provide a method and system for enhanced network services using a subnetwork of communicating processors.
The following U.S. Patent(s) or other documents may be pertinent:
The pertinence of the related art will also be apparent to those skilled in the art after perusal of this application.
The invention provides a method and system for providing enhanced services for a network, using a subnetwork of communicating processors. The enhanced services use information about the network which is available to the subnet of communicating processors (such as a set of routers), interoperating using a common distributed technique for disseminating that network information. In a first aspect of the invention, the router subnet collects network topology information and provides a service using that network topology information, responsive to requests from non-routers (such as host processors) coupled to the network. The network topology information comprises information about paths and routes, including bandwidth, connectivity, delay, traffic reservations, and administrative policies applicable to those paths and routes. Routers providing the enhanced service have the option of requiring authentication for service requests.
For a first example, the router subnet provides an enhanced distributed naming service which, in addition to translating server names into host addresses, also orders those host addresses by relative distance in the network, or by another criterion designated by the client. For a second example, the router subnet provides an enhanced message delivery service which, in addition to delivering a message to a plurality of destinations, assures that all destinations receive the message at substantially the same time.
In a second aspect of the invention, the router subnet collects information advertised by hosts coupled to the network, and disseminates that host information to substantially all routers, using the common distributed technique for disseminating network topology information. In a first preferred embodiment, the host information comprises information about server processes available at the originating host (such as what services are available and to which users those services are available). In a second preferred embodiment, the host information comprises information about client processes operating at the originating host (such as which users are operating those client processes and which services they desire).
For a first example, hosts advertise their relative load for dissemination by the router subnet, and the router subnet provides an enhanced distributed naming service which, in addition to translating server names into host addresses, also orders those host addresses by relative load (or by both relative distance and relative load). Similarly, hosts may also advertise other server information, such as cost for performing the service, delay in performing the service, or other administrative policies which would affect the choice of server.
For a second example, hosts advertise their logged-in users for dissemination by the router subnet, and the router subnet provides an enhanced message-delivery service which, in addition to receiving messages for delivery, also delivers those messages to the host where the destination user is logged-in. Similarly, hosts may also advertise other client information, such as willingness to pay for performing a designated service, which the router subnet may disseminate for responses by servers or by other clients.
In the following description, a preferred embodiment of the invention is described with regard to preferred process steps and data structures. However, those skilled in the art would recognize, after perusal of this application, that embodiments of the invention may be implemented using a set of general purpose computers operating under program control, and that modification of a set of general purpose computers to implement the process steps and data structures described herein would not require undue invention.
In an internetwork 100 to which a network 101 is coupled, a client process 102 on a client node 103 contacts a server process 104 on a server node 105, to obtain data or a service. For example, the data may comprise a file located at the server node 105; the service may comprise conducting a computation, providing data in response to search parameters, or even just providing the current time.
The verb “contacts” refers to communication between the client process 102 and the server process 104 using messages comprising message packets which are transmitted using the internetwork 100 between the client process 102 and the server process 104. Messages and message packets are transmitted using the internetwork 100 using a subnet 110 of routers 111. Each router 111 executes a routing technique which causes the routers 111 to collectively interoperate using a common distributed technique for routing messages and distributing information about the internetwork 100. This network information is stored at each router 111 in one or more network tables 112, and generally comprises information about paths and routes, such as bandwidth, connectivity, delay, traffic reservations, and administrative policies applicable to those paths and routes.
Particular routing techniques, such as IGRP, AppleTalk, and IPX, are known in the art of networking.
A method 150 is conducted in cooperation by various nodes and processes coupled to the internetwork 100. At a flow point 160 for the method 150, the client process 102 desires to contact a server process 104, the latter of which is coupled to the internetwork 100.
At a step 161, the client process 102 first contacts a name server 105, which preferably comprises a server process 104 executing on a server node 103 for which the client process 102 already has a network address, using a name-request message 121. In this example, the name server 105 is shown executing on a different node and coupled to the same network 101 as the client node 103, but there is no particular requirement that the name server 105 is in fact so disposed. For example, the name server 105 may be located at the same node as the client process 102, or may be coupled to a different network 101 on the internetwork 100, so long as the client process 102 has available to it a sufficient network address to transmit the name-request message 121 to the name server 105.
In a preferred embodiment, the name server 105 comprises a DNS name server operating according to the DNS protocol.
The name-request message 121 asks the name server 105 to translate an identifier for the service provided into a network address for a server process 104 providing that service. For example, the identifier may comprise a host name for a node coupled to the internetwork 100, such as “sanjose.cisco.com”, and the name server 105 may translate that host name into an IP address for that node, such as “3.141.59.26”.
At a step 162, the name server 105 receives the name-request message 121, parses the name-request message 121 to determine the name to be translated, looks up the name in a table it maintains for translating names into network addresses, and transmits a name-response message 122 comprising one or more network addresses to the client process 102 at the client node 103.
In general, the name to be translated may specify a service which is provided by more than one server process 104 or by more than one server node 105, so that the name server 105 has more than one network address to provide in the name-response message 122. In a preferred embodiment, the name server 105 provides all such network addresses in the name-response message 122. Order is not critical at this flow point of the method 150.
At a step 163, the client process 102 receives the name-response message 122 and parses the name-response message 122 to determine the network addresses provided by the name server 105. The client process 102 then contacts a router 111 using an order-request message 123.
The order-request message 123 asks the router 111 to order a set of addresses by their relative distance on the internetwork 100. Preferably, the client process 102 packages the addresses from the name-response message 122 into the order-request message 123.
At a step 164, the router 111 receives the order-request message 123, parses the order-request message 123 to determine the set of addresses, looks up each address in its network tables 112 to determine a relative distance for that network address, orders the network addresses by relative distance, and transmits an order-response message 124 comprising the network addresses ordered relative distance.
The relative distance for each network address may differ at different times, so the order provided by the router 111 in the order-response message 124 may also differ in response to order-request messages 123 transmitted at different times.
In a preferred embodiment, the relative distance for each network address is computed in response to the expected time delay in delivering a message from the client node 103 to the server node 105. It is expected that this expected time delay will be nearly the same as the expected time delay from the name server 105. In alternative embodiments described below in which the name server 105 orders the addresses in response to relative distance information from the router 111, the ordering may turn out to differ from an ordering for the client node 103, but this is not expected to be important unless the name server 105 is at a substantial relative distance from the client node 103.
In alternative embodiments, the relative distance for each network address may also be computed in response to other information available to the router 111 in its network tables 112, including for example (1) an expected bandwidth of a path from the client node 103 to the server node 105, (2) any traffic reservations on paths between the client node 103 to the server node 105, or (3) any administrative policies applicable to those paths between the client node 103 to the server node 105. For example, if a required path to one of the server nodes 105 is known to the router 111 to be heavily trafficked between the hours of 9:00 a.m. and 5:00 p.m., that server node 105 may be assigned a substantially higher relative distance responsive to that information.
Although in a preferred embodiment, the name-request message 121 and the order-request message 123 are both preferably transmitted by the client process 102, in alternative embodiments, alternative arrangements are possible which would obtain the same information for the client process 102. Such alternative arrangements would be clear to those skilled in the art after perusing this application, and are within the scope and spirit of the invention. In a first alternative embodiment, the name server 105 may obtain an ordering of network addresses from the router 111, and may order the network addresses in the name-response message 122. To do so, the name server 105 may transmit an order-request message 123 to the router 111 and use the results it receives in the order-response message 124. In a second alternative embodiment, the name server 105 may be located at the router 111, and may order the network addresses in the name-response message 122 in response to direct access to the network tables 112.
In a preferred embodiment, the network address for one or more particular server nodes 105 may be restricted to those client processes 102 with sufficient authorization. In such a case, the name server 105 would require that the client process 102 is authenticated, to determine that the name-request message 121 really comes from the client process 102 and not someone else, and that the client process 102 has sufficient permissions, in particular, that the name server 105 has been informed that the client process 102 is authorized to receive that information. A preferred authentication process is described below with reference to FIG. 4.
In a preferred embodiment, the relative distance or other ordering information may also be restricted to those client processes 102 with sufficient authorization. In such a case, the router 111 would require that the client process 102 is authenticated, to determine that the name-request message 121 really comes from the client process 102 and not someone else, and that the client process 102 has sufficient permissions, in particular, that the router 111 has been informed that the client process 102 is authorized to receive that information.
In some cases, the router 111 may have insufficient information to respond to the order-request message 123 on its own. In such a case, the router 111 may forward the order-request message 123 (or another message with similar information) to a second router 111. The second router 111 may also find that it must forward the order-request message 123 or other message, until one or more routers are reached which, individually or collectively, do have sufficient information to respond to the original order-request message 123.
At a step 165, the client process 102 selects a first one of the network addresses, preferably the network address with the smallest relative distance, and contacts the server process 104 on the server node 105 with that network address. In the case that the client process 102 is unable to contact the server process 104 at the first network address, the client process 102 selects another, preferably the network address with the next smallest relative distance, and contacts the server process 104 on the server node 105 with that network address. The client process 102 repeats this step until one of the server processes 104 is contacted or the set of network addresses is exhausted.
A first example enhanced network service is automated distribution of resources such as services. Some services are readily distributed by providing more than one service provider, each of which can fully provide substantially the same service. For example, a service providing a collection of data may be duplicated by copying the data to multiple sites; a service providing a program to be executed may be duplicated by copying the program to multiple sites, and providing resources for executing the program at each of those sites.
In this example enhanced service, a resource to be automatically distributed is embodied in server processes 104 at a plurality of server nodes 105. For example, the resource may comprise one of the following:
Other and further possibilities will readily occur to those skilled in the art after perusal of this application; such other and further possibilities would not require invention or undue experiment, and are within the scope and spirit of the invention.
The name servers 105 which translate the service name into network addresses are given the network addresses for the plurality of server nodes 105 at which the server processes 104 may be found. This information is distributed to the name servers 105 using a name server protocol such as the DNS protocol. Name server protocols are known in the art of networking, and so are not discussed in detail herein.
Duplicating the server process 104 and distributing multiple network addresses for the service to the name servers 105 has the following effects: When the name-request message 121 is transmitted at the step 161 from the client process 102 to the name server 105, the name server 105 obtains a plurality of network addresses for server processes 104 at a plurality of server nodes 105. When the order-request message 123 is transmitted at the step 163 from the client process 102 to the router 111, the router 111 orders the plurality of network addresses for server processes 104 at a plurality of server nodes 105 by their relative distance from the client node 103. When the client process 102 contacts a server process 104 using a network address from the order-response message 124, the server process 104 which is chosen is the one at the server node 105 with the smallest relative distance from the client node 103.
Thus, when the client process 102 initiates the method 150 to contact one of the server processes 104, it will automatically be assigned to the relatively nearest server process 104; when multiple client process 102 attempt to contact one of the server processes 104, they will automatically be distributed among the set of server processes 104 which may be chosen.
A second example enhanced network service is synchronized distribution of messages to recipients, such as (1) assuring that a designated message is delivered to a recipient node on the internetwork 100 at a designated time, or (2) assuring that a designated message is delivered to multiple recipients at the same time.
In this example enhanced service, a message is labeled with a set of designated destination nodes and a designated time for delivery to those destination nodes. For example, the message may comprise one of the following:
In a preferred embodiment, each one of the routers 111 maintains an indicator of the current time, synchronized across all routers 111 so that any pair of routers 111 will have the same value for the “current time”, preferably within an error margin of less than about 0.5 milliseconds. This indicator may be recorded in the network tables 112 or in another register within each router 111. The routers 111 may maintain this indicator by means of a network time protocol, or by some other technique. Network time protocols, which are preferred, are known in the art of networking.
A method 250 is conducted in cooperation by the client process 102 and various routers 111 on the internetwork 100. At a flow point 260 for the method 250, the client process 102 desires to send a message 200 for receipt at a destination node 201 at a designated time.
At a step 261, the client process 102 contacts one of the routers 111 using a timed message 210. Since all messages on the internetwork 100, other than those limited to the local network 101, are transmitted using one or more routers 111, the client process 102 need only transmit the timed message 210 to the destination node 201 as if it were to transmit any other message to the destination node 201, and the timed message 210 will be received by one of the routers 111 along a path to the destination node 201. The timed message 210 comprises an ordinary message for delivery to, plus a header designating the desired time for receipt at, the destination node 201.
At a step 262, one of the routers 111 along a path to the destination node 201 receives the timed message 210 and parses it to determine the destination node 201, and determines if it would be one of the routers 111 to effect final delivery of the message to the destination node 201. If there is a single destination node 201, there will be only one such router 111; if there are multiple destination nodes 201, there may be more than one such router 111. If this router 111 would not effect final delivery, the method 250 continues with the step 263; if this router 111 would effect final delivery, the method 250 continues with the step 264.
At a step 263 (the router 111 would not effect final delivery), the router 111 forwards the timed message 210 to the next router 111 in the path to the destination node 201, just like any other message. In a preferred embodiment, if the desired time for receipt is very soon, the router 111 may reply to the client process 102 with an error message, indicating that delivery at the designated time is impossible, unlikely, or merely not guaranteed. In alternative embodiments, if the desired time for receipt is very soon, the router 111 may give priority to the timed message 210 over other messages.
At a step 264 (the router 111 would effect final delivery), the router 111 holds the timed message 210 until the designated time for delivery to the destination node 201, and at that time, delivers the message just like any other message. In a preferred embodiment, if the current time is past the desired time for receipt, the router 111 may reply to the client process 102 with an error message, indicating that delivery at the designated time did not occur, and may either discard the message or deliver it late. In alternative embodiments, if the desired time for receipt is very soon, the router 111 may give priority to the timed message 210 over other messages.
In a preferred embodiment, the capability to send a timed message 210 may be restricted to those client processes 102 with sufficient authorization. In such a case, the first router 111 to receive and parse a timed message 210 would require that the client process 102 is authenticated, to determine that the timed message 210 really comes from the client process 102 and not someone else, and that the client process 102 has sufficient permissions, i.e., that the router 111 has been informed that the client process 102 is authorized to send timed messages 210.
In a preferred embodiment, the method 150 is supplemented by using information “advertised” by the server processes 104. At a flow point 170 for the supplemented method 150, one of the server processes 104 desires to disseminate server advertising information to the subnet 110 of routers 111 for use with an enhanced network service.
The server advertising information comprises any information provided by one of the server processes 104 for dissemination to the subnet 110 of routers 111. For example, server advertising information may comprise the following:
At a step 171, one of the server processes 104 sends a server-info message 131 to one of the routers 111.
The routing technique is supplemented by providing that each one of the routers 111 disseminates information from the server-info message 131 to all routers 111 in the subnet 110. Each router 111 which receives the server-info message 131 performs the steps 172, 173, and 174. As a result, each router 111 eventually receives the information to be disseminated in the server-info message 131 and stores that information in its network tables 112.
At a step 172, the router 111 receives the server-info message 131 and parses the server-info message 131 to determine the information to be disseminated.
At a step 173, the router 111 stores the information to be disseminated in its network tables 112.
At a step 174, the router 111 forwards the information to be disseminated to a set of neighboring routers 111 in the subnet 110.
In the supplemented method 150, the step 164 is supplemented to determine the order for the network addresses responsive to the server advertising information. Thus for example, at the step 164 the router 111 orders the network addresses responsive to relative load on the server node 105, or responsive to both relative distance to the server node 105 and relative load on the server node 105.
In other enhanced network services, the routers 111 may route messages to server processes 104 responsive to the server advertising information. For a first example, the server advertising information may comprise a list of persons who are currently logged in at the server node 105, and the routers 111 may receive and route a person-to-person message naming a designated person to the server node 105 at which that designated person is logged in. For a second example, the server advertising information may comprise a set of administrative policies regarding traffic the server node 105 desires not to retransmit, and the routers 111 may receive and route such messages away from such server nodes 105.
A method 350 is conducted in cooperation by various client processes 102, client nodes 103, server processes 104, and server nodes 105 and coupled to the internetwork 100. At a flow point 360 for the method 350, the client process 102 desires to disseminate client advertising information to the subnet 110 of routers 111 for use with an enhanced network service.
The client advertising information comprises any information provided by one of the client processes 102 for dissemination to the subnet 110 of routers 111. For example, client advertising information may comprise the following:
At a step 361, one of the client processes 102 sends a client-info message 301 to one of the routers 111, similar to the step 171.
The routing technique is supplemented by providing that each one of the routers 111 disseminates information from the client-info message 301 to all routers 111 in the subnet 110. Each router 111 which receives the client-info message 301 performs the steps 362, 363, and 364. As a result, each router 111 eventually receives the information to be disseminated in the client-info message 301 and stores that information in its network tables 112.
At a step 362, the router 111 receives the client-info message 301 and parses the client-info message 301 to determine the information to be disseminated, similar to the step 172.
At a step 363, the router 111 stores the information to be disseminated in its network tables 112, similar to the step 173.
At a step 364, the router 111 forwards the information to be disseminated to a set of neighboring routers 111 in the subnet 110, similar to the step 174.
At a flow point 370 for the method 350, the server process 102 desires to disseminate server advertising information to the subnet 110 of routers 111 for use with an enhanced network service.
The routing technique is also supplemented by providing that each one of the routers 111 disseminates information from the server-info message 131 to all routers 111 in the subnet 110, similar to the supplemented method 150. Each router 111 which receives the server-info message 131 performs the steps 372, 373, and 374. As a result, each router 111 eventually receives the information to be disseminated in the server-info message 131 and stores that information in its network tables 112.
At a step 372, the router 111 receives the server-info message 131 and parses the server-info message 131 to determine the information to be disseminated, similar to the step 172.
At a step 373, the router 111 stores the information to be disseminated in its network tables 112, similar to the step 173.
At a step 374, the router 111 forwards the information to be disseminated to a set of neighboring routers 111 in the subnet 110, similar to the step 174.
At a flow point 380, one of the routers 111 receives both client advertising information and server advertising information.
At a step 381, the router 111 matches the client advertising information against the server advertising information.
The nature of this step 381 depends on the nature of the client advertising information and the server advertising information. For example, if the client advertising information indicates the desire to obtain a named service X for a price Y or less, and the server advertising information indicates the ability to provide the named service X for a price Y or more, the router 111 obtains a match. Other situations in which the router 111 might obtain a match include the following:
At a step 382, the router 111 transmits a client-match message 302 to the client process 102, and a server-match message 303 to the server process 104, indicating the nature of the match.
At a step 383, the client process 102 and the server process 104 communicate about the matched information.
The ART protocol described herein comprises four types of packets: (1) an ART-request packet, indicating a request for a service to be performed at the remote site, (2) an ART-reply packet, indicating a response to the ART-request packet, (3) an ART-auth-challenge packet, indicating a challenge to the recipient to show that the recipient is authorized to make the request, and (4) an ART-auth-response packet, indicating a response to the authorization challenge.
A single transaction comprises the sequence (1) ART-request, (2) ART-reply. If authentication is performed, a single transaction comprises the sequence (1) ART-request, (2) ART-auth-challenge, (3) ART-auth-response, (4) ART-reply.
All four types of packet comprise a fixed length packet header 400 and variable length packet data 410. The packet header 400 comprises a version number 401, a packet type value 402, a reply port value 403, and a transaction identifier 404.
The version number 401 comprises one octet (eight-bit byte) specifying the version of the remote procedure call protocol.
The packet type value 402 comprises one octet specifying the type of operation the packet is for. In a preferred embodiment, a request packet has the value 1; a reply packet has the value 2; an authentication challenge packet has the value 3; an authentication response packet has the value 4.
The reply port value 403 comprises two octets specifying a 16-bit value of the port at which the client process 102 expects to receive further ART protocol packets. The client sets this value with its first ART-request packet; thereafter the client and server copy this value to all packets for a single ART transaction.
The transaction identifier 404 comprises four octets specifying a 32-bit unsigned integer identifier for a single transaction. The client sets this value with its first ART-request packet for each transaction; thereafter the client and server copy this value to all packets for a single ART transaction. In a preferred embodiment, the client chooses a random nonzero value for its first ART transaction and increments this value by one for each subsequent ART transaction; zero is a valid value which may occur by overflow.
For the ART-request packet, the variable length packet data 410 comprises one or more requests. Each request comprises a mode/type field 411, a length value 412, and a data field 413.
The mode/type field 411 comprises two octets specifying a one-bit authentication bit and a 15-bit request type.
The length value 412 comprises two octets specifying a 16-bit count of the number of octets in the data field 413.
The data field 413 comprises the actual data for the request. Its interpretation may vary depending on the type of request.
For the ART-auth-challenge packet, the variable length packet data 410 comprises one or more challenges, one for each request in the ART-request packet requiring authorization. Each challenge comprises the mode/type field 411, the length value 412, and the data field 413, formatted like those for requests in the ART-request packet.
The server copies the mode/type field 411 from the mode/type field 411 for the ART-request packet.
The data field 413 comprises a randomly chosen challenge value.
For the ART-auth-response packet, the variable length packet data 410 comprises one response for each challenge in the ART-auth-challenge packet. Each response comprises the mode/type field 411, the length value 412, and the data field 413, formatted like those in the ART-request packet.
The client copies the mode/type field 411 from the mode/type field 411 for the ART-auth-challenge packet.
The data field 413 comprises the response value appropriate to the corresponding challenge value.
For the ART-reply packet, the variable length packet data 410 comprises one reply for each request in the ART-request packet. Each reply comprises the mode/type field 411, the length value 412, and the data field 413, formatted like those in the ART-request packet, and a result field 414.
The server copies the mode/type field 411 from the mode/type field 411 for the ART-request packet.
The result field 414 comprises two octets specifying a 16-bit value indicating the success or failure of the corresponding request. If the request is successful, the value will be zero. If the request is not successful, the value will be non-zero, and particular nonzero values may (at the server's option) indicate the type of failure.
The ART protocol 450 is conducted in cooperation by the client process 102 and the server process 104. At a flow point 460 for the method 450, the client process 102 desires to initiate one or more ART requests.
At a step 461, the client process 102 constructs an ART-request packet 470 for transmission to the server process 104, and transmits the ART-request packet 470 to the server process 104. The ART-request packet 470 comprises one or more requests, as described above. The client process 102 sets a timer to protect against the possibility that the packet will be lost. A preferred timer value is 30 seconds. If no reply is received, the client process 102 retries the request, up to five times. ART requests are therefore preferably idempotent.
At a step 462, the server process 104 receives the ART-request packet 470 and parses the ART-request packet 470 to determine each of the requests. If authentication is required for one or more of the requests, the protocol 450 continues with the step 463. If authentication is not required for any of the requests, the protocol 450 continues with the step 465. It is possible that authentication will be required for some but not all of the requests in a single ART-request packet 470.
At a step 463, the server process 104 constructs an ART-auth-challenge packet 471 for transmission to the client process 102, and transmits the ART-auth-challenge packet 471 to the client process 102. The server process 104 sets a timer to protect against the possibility that the packet will be lost. A preferred timer value is 30 seconds. If no response to the challenge is received, the server process 104 need not retry the challenge.
At a step 464, the client process 102 receives the ART-auth-challenge packet 471 from the server process 104, parses the ART-auth-challenge packet 471 to determine the challenge data, determines the appropriate authorization response, constructs an ART-auth-response packet 472 for transmission to the server process 104, and transmits the ART-auth-response packet 472 to the server process 104. The client process 104 sets a timer to protect against the possibility that the packet will be lost. A preferred timer value is 30 seconds. If no reply to the original request is received, the client process 104 retries the original request, up to file times.
A preferred embodiment uses the shared secret model of authentication, as described in RFC-1344, hereby incorporated by reference as if fully set forth herein. The server process 104 generates a random challenge value for each request requiring authentication; the client process 102 and server process 104 each compute a hash function applied to the concatenation of the challenge value and the shared secret. A preferred embodiment uses the MD5 hash function, as described in RFC-1321, hereby incorporated by reference as if fully set forth herein. The client process 102 transmits the computed value as the response value to the server process 104, which matches the response value against its own computed value. Authentication succeeds if the response value matches the server's own computed value.
Those skilled in the art will recognize, after perusal of this application, that other and further types of authentication may be used instead or in addition.
At a step 465, the server process 104 receives the ART-auth-response packet 472 from the client process 102, parses the ART-auth-response packet 472 to determine the response data, and determines whether the authorization challenge was passed by the response. If the client process 102 passed the authorization challenge, the server process 104 performs the request, and the protocol continues with the step 466. If the client process 102 failed to pass the authorization challenge, the server process 104 generates an failed-authorization error, and the protocol continues with the step 466.
At a step 466, the server process 104 constructs an ART-reply packet 473 for transmission to the client process 102, and transmits the ART-reply packet 473 to the client process 102.
At a step 467, the client process 102 receives the ART-reply packet 473 from the server process 104 and parses the ART-reply packet 473 to determine the reply for each request. The client process 102 matches the transaction identifier for the ART-reply packet 473 to a list of outstanding requests; if there is no match, the client process 102 discards the ART-reply packet 473.
Alternative Embodiments
Although preferred embodiments are disclosed herein, many variations are possible which remain within the concept, scope, and spirit of the invention, and these variations would become clear to those skilled in the art after perusal of this application.
This application is a continuation of application Ser. No. 09/738,435, filed Dec. 14, 2000, now U.S. Pat. No. 6,640,243 which is a continuation of application Ser. No. 08/582,073, filed Jan. 2, 1996, now U.S. Pat. No. 6,182,224, which claims the benefit of U.S. Provisional Application No. 60/004,568, filed Sep. 29, 1995, wherein the disclosure of each application is hereby incorporated by reference.
Number | Name | Date | Kind |
---|---|---|---|
4131767 | Weinstein | Dec 1978 | A |
4161719 | Parikh et al. | Jul 1979 | A |
4316284 | Howson | Feb 1982 | A |
4397020 | Howson | Aug 1983 | A |
4419728 | Larson | Dec 1983 | A |
4424565 | Larson | Jan 1984 | A |
4437087 | Petr | Mar 1984 | A |
4438511 | Baran | Mar 1984 | A |
4439763 | Limb | Mar 1984 | A |
4445213 | Baugh et al. | Apr 1984 | A |
4446555 | Devault et al. | May 1984 | A |
4456957 | Scheiltz | Jun 1984 | A |
4464658 | Thelen | Aug 1984 | A |
4499576 | Fraser | Feb 1985 | A |
4506358 | Montgomery | Mar 1985 | A |
4507760 | Fraser | Mar 1985 | A |
4532626 | Flores et al. | Jul 1985 | A |
4644532 | George et al. | Feb 1987 | A |
4646287 | Larson et al. | Feb 1987 | A |
4677423 | Benvenuuto et al. | Jun 1987 | A |
4679189 | Olsen et al. | Jul 1987 | A |
4679227 | Hughes-Hartogs | Jul 1987 | A |
4723267 | Jones et al. | Feb 1988 | A |
4731816 | Hughes-Hartogs | Mar 1988 | A |
4750136 | Arpin et al. | Jun 1988 | A |
4757495 | Decker et al. | Jul 1988 | A |
4763191 | Gordon et al. | Aug 1988 | A |
4769810 | Eckberg, Jr. et al. | Sep 1988 | A |
4769811 | Eckberg, Jr. et al. | Sep 1988 | A |
4771425 | Baran et al. | Sep 1988 | A |
4819228 | Baran et al. | Apr 1989 | A |
4827411 | Arrowood et al. | May 1989 | A |
4833706 | Hughes-Hartogs | May 1989 | A |
4835737 | Herrig et al. | May 1989 | A |
4879551 | Georgiou et al. | Nov 1989 | A |
4893306 | Chao et al. | Jan 1990 | A |
4903261 | Baran et al. | Feb 1990 | A |
4922486 | Lidinsky et al. | May 1990 | A |
4933937 | Konishi | Jun 1990 | A |
4960310 | Cushing | Oct 1990 | A |
4962497 | Ferenc et al. | Oct 1990 | A |
4962532 | Kasiraj et al. | Oct 1990 | A |
4965767 | Kinoshita et al. | Oct 1990 | A |
4965772 | Daniel et al. | Oct 1990 | A |
4970678 | Sladowski et al. | Nov 1990 | A |
4980897 | Decker et al. | Dec 1990 | A |
4991169 | Davis et al. | Feb 1991 | A |
5003595 | Collins et al. | Mar 1991 | A |
5014265 | Hahne et al. | May 1991 | A |
5020058 | Holden et al. | May 1991 | A |
5033076 | Jones et al. | Jul 1991 | A |
5034919 | Sassai et al. | Jul 1991 | A |
5054034 | Hughes-Hartogs | Oct 1991 | A |
5059925 | Weisbloom | Oct 1991 | A |
5072449 | Enns et al. | Dec 1991 | A |
5088032 | Bosak | Feb 1992 | A |
5095480 | Fenner | Mar 1992 | A |
RE33900 | Howson | Apr 1992 | E |
5115431 | Williams et al. | May 1992 | A |
5128945 | Enns et al. | Jul 1992 | A |
5136580 | Videlock et al. | Aug 1992 | A |
5166930 | Braff et al. | Nov 1992 | A |
5199049 | Wilson | Mar 1993 | A |
5206886 | Bingham | Apr 1993 | A |
5208811 | Kashio et al. | May 1993 | A |
5212686 | Joy et al. | May 1993 | A |
5224099 | Corbalis et al. | Jun 1993 | A |
5226120 | Brown et al. | Jul 1993 | A |
5228062 | Bingham | Jul 1993 | A |
5229994 | Balzano et al. | Jul 1993 | A |
5237564 | Lespagnol et al. | Aug 1993 | A |
5241682 | Bryant et al. | Aug 1993 | A |
5243342 | Kattemalalavadi et al. | Sep 1993 | A |
5243596 | Port et al. | Sep 1993 | A |
5247516 | Bernstein et al. | Sep 1993 | A |
5249178 | Kurano et al. | Sep 1993 | A |
5253251 | Aramaki | Oct 1993 | A |
5255291 | Holden et al. | Oct 1993 | A |
5260933 | Rouse | Nov 1993 | A |
5260978 | Fleisher et al. | Nov 1993 | A |
5268592 | Bellamy et al. | Dec 1993 | A |
5268900 | Hluchyi et al. | Dec 1993 | A |
5271004 | Proctor et al. | Dec 1993 | A |
5274631 | Bhardwaj | Dec 1993 | A |
5274635 | Rahman et al. | Dec 1993 | A |
5274643 | Fisk | Dec 1993 | A |
5280470 | Buhrke et al. | Jan 1994 | A |
5280480 | Pitt et al. | Jan 1994 | A |
5280500 | Mazzola et al. | Jan 1994 | A |
5283783 | Nguyen et al. | Feb 1994 | A |
5287103 | Kasprzyk et al. | Feb 1994 | A |
5287453 | Roberts | Feb 1994 | A |
5291482 | McHarg et al. | Mar 1994 | A |
5305311 | Lyles | Apr 1994 | A |
5307343 | Bostica et al. | Apr 1994 | A |
5311509 | Heddes et al. | May 1994 | A |
5313454 | Bustini et al. | May 1994 | A |
5313582 | Hendal et al. | May 1994 | A |
5317562 | Nardin et al. | May 1994 | A |
5319644 | Liang | Jun 1994 | A |
5327421 | Hiller et al. | Jul 1994 | A |
5331637 | Francis et al. | Jul 1994 | A |
5345445 | Hiller et al. | Sep 1994 | A |
5345446 | Hiller et al. | Sep 1994 | A |
5359592 | Corbalis et al. | Oct 1994 | A |
5361250 | Nguyen et al. | Nov 1994 | A |
5361256 | Doeringer et al. | Nov 1994 | A |
5361259 | Hunt et al. | Nov 1994 | A |
5365524 | Hiller et al. | Nov 1994 | A |
5367517 | Cidon et al. | Nov 1994 | A |
5371852 | Attanasio et al. | Dec 1994 | A |
5386567 | Lien et al. | Jan 1995 | A |
5390170 | Sawant et al. | Feb 1995 | A |
5390175 | Hiller et al. | Feb 1995 | A |
5394394 | Crowther et al. | Feb 1995 | A |
5394402 | Ross | Feb 1995 | A |
5400325 | Chatwani et al. | Mar 1995 | A |
5408469 | Opher et al. | Apr 1995 | A |
5416842 | Aziz | May 1995 | A |
5422880 | Heitkamp et al. | Jun 1995 | A |
5422882 | Hiller et al. | Jun 1995 | A |
5423002 | Hart | Jun 1995 | A |
5426636 | Hiller et al. | Jun 1995 | A |
5428607 | Hiller et al. | Jun 1995 | A |
5430715 | Corbalis et al. | Jul 1995 | A |
5442457 | Najafi | Aug 1995 | A |
5442630 | Gagliardi et al. | Aug 1995 | A |
5452297 | Hiller et al. | Sep 1995 | A |
5473599 | Li et al. | Dec 1995 | A |
5473607 | Hausman et al. | Dec 1995 | A |
5477541 | White et al. | Dec 1995 | A |
5485455 | Dobbins et al. | Jan 1996 | A |
5490140 | Abensour et al. | Feb 1996 | A |
5490258 | Fenner | Feb 1996 | A |
5491687 | Christensen et al. | Feb 1996 | A |
5491804 | Heath et al. | Feb 1996 | A |
5497368 | Reijnierse et al. | Mar 1996 | A |
5504747 | Sweasey | Apr 1996 | A |
5509006 | Wilford et al. | Apr 1996 | A |
5513314 | Kandasamy et al. | Apr 1996 | A |
5517494 | Green | May 1996 | A |
5519704 | Farinacci et al. | May 1996 | A |
5526489 | Nilakantan et al. | Jun 1996 | A |
5530963 | Moore et al. | Jun 1996 | A |
5535195 | Lee | Jul 1996 | A |
5539734 | Burwell et al. | Jul 1996 | A |
5555244 | Gupta et al. | Sep 1996 | A |
5561669 | Lenney et al. | Oct 1996 | A |
5568612 | Barrett et al. | Oct 1996 | A |
5583862 | Callon | Dec 1996 | A |
5592470 | Rudrapatna et al. | Jan 1997 | A |
5598532 | Liron | Jan 1997 | A |
5598581 | Daines et al. | Jan 1997 | A |
5600798 | Cherukuri et al. | Feb 1997 | A |
5602770 | Ohira | Feb 1997 | A |
5604868 | Komine et al. | Feb 1997 | A |
5608726 | Virgile | Mar 1997 | A |
5617417 | Saithe et al. | Apr 1997 | A |
5617421 | Chin et al. | Apr 1997 | A |
5630125 | Zellweger | May 1997 | A |
5631908 | Saxe | May 1997 | A |
5632021 | Jennings et al. | May 1997 | A |
5634010 | Ciscon et al. | May 1997 | A |
5638359 | Peltola et al. | Jun 1997 | A |
5644718 | Belove et al. | Jul 1997 | A |
5659684 | Giovannoni et al. | Aug 1997 | A |
5666353 | Klausmeier et al. | Sep 1997 | A |
5673265 | Gupta et al. | Sep 1997 | A |
5678006 | Valizadeh et al. | Oct 1997 | A |
5684797 | Aznar et al. | Nov 1997 | A |
5687324 | Green et al. | Nov 1997 | A |
5689506 | Chiussi et al. | Nov 1997 | A |
5694390 | Yamato et al. | Dec 1997 | A |
5724351 | Chao et al. | Mar 1998 | A |
5740097 | Satch | Apr 1998 | A |
5748186 | Raman | May 1998 | A |
5748617 | McLain, Jr. | May 1998 | A |
5754547 | Nakazawa | May 1998 | A |
5835710 | Nagami et al. | Nov 1998 | A |
5838912 | Poon et al. | Nov 1998 | A |
5841874 | Kemple et al. | Nov 1998 | A |
5854903 | Morrison et al. | Dec 1998 | A |
5898686 | Virgile | Apr 1999 | A |
5937162 | Funk et al. | Aug 1999 | A |
6029195 | Herz | Feb 2000 | A |
Number | Date | Country |
---|---|---|
0 384 758 | Feb 1990 | EP |
0 431 751 | Nov 1990 | EP |
0567 217 | Oct 1993 | EP |
WO 9307569 | Apr 1993 | WO |
WO 9307692 | Apr 1993 | WO |
WO 9401828 | Jan 1994 | WO |
WO 9520850 | Aug 1995 | WO |
Number | Date | Country | |
---|---|---|---|
60004568 | Sep 1995 | US |
Number | Date | Country | |
---|---|---|---|
Parent | 09738435 | Dec 2000 | US |
Child | 10665838 | US | |
Parent | 08582073 | Jan 1996 | US |
Child | 09738435 | US |