Scalable proxy clusters

• US 10,701,037 B2
• Filed: 05/25/2016
• Issued: 06/30/2020
• Est. Priority Date: 05/27/2015
• Status: Active Grant

• Current Assignee: Ping Identity Corporation
• Original Assignee: Ping Identity Corporation
• Inventors: Subbarayan, Udayakumar, Harguindeguy, Bernard, Gopalakrishnan, Anoop Krishnan, Poonthiruthi, Abdu Raheem
• Primary Examiner(s): Tran, Jimmy H
• Application Number:
  US15/164,512
• Publication Number:
  US 20160352588A1
• Time in Patent Office: 1,497 Days
• CPC Class Codes: G06F 9/546 Message passing systems or structures, e.g. queues
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 45/46 Cluster building
• CPC Class Codes: H04L 45/56 Routing software
• CPC Class Codes: H04L 45/58 Association of routers
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1014 based on the content of a request
• CPC Class Codes: H04L 67/1068 Discovery involving direct consultation or announcement among potential requesting and potential source peers
• CPC Class Codes: H04L 67/1095 : Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/12 : specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/145 : avoiding end of session, e.g. keep-alive, heartbeats, resumption message or wake-up for inactive or interrupted session
• CPC Class Codes: H04L 67/56 : Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/60 : Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: H04L 69/16 : Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]
• CPC Class Codes: H04L 69/40 : for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

The invention enables high-availability, high-scale, high security and disaster recovery for API computing, including in terms of capture of data traffic passing through proxies, routing communications between clients and servers, and load balancing and/or forwarding functions. The invention inter alia provides (i) a scalable cluster of proxies configured to route communications between clients and servers, without any single point of failure, (ii) proxy nodes configured for implementing the scalable cluster (iii) efficient methods of configuring the proxy cluster, (iv) natural resiliency of clusters and/or proxy nodes within a cluster, (v) methods for scaling of clusters, (vi) configurability of clusters to span multiple servers, multiple racks and multiple datacenters, thereby ensuring high availability and disaster recovery (vii) switching between proxies or between servers without loss of session.

Claims

1. A proxy node configured for implementation within a proxy cluster comprising a plurality of proxy nodes, the proxy node comprising:

a proxy router configured to;

obtain, after receiving an Application Programming Interface (API) request from a client device, information descriptive of an API associated with the API request;

select a server that hosts the API from a plurality of servers based on (1) the information descriptive of the API and (2) data states indicative of characteristics of the plurality of servers;

transmit the API request to the API hosted on the server; and

in response to receiving a response to the API request from the server, transmit the response to the client device; and

a synchronization controller configured to respond to a synchronization event by synchronizing data states of the proxy node with data states of each remaining proxy node from the plurality of proxy nodes, the data states of the proxy node and the data states of each remaining proxy node from the plurality of proxy nodes including the data states indicative of the characteristics of the plurality of servers.

2. The proxy node as claimed in claim 1, wherein the data states of the proxy node and the data states of each remaining proxy node from the plurality of proxy nodes further include data states indicative of one or more of:

information of sessions between client devices and the plurality of servers,

security data associated with the sessions,

configuration data for routing messages between the client devices and the plurality of servers, or

characteristics of the plurality of proxy nodes.

3. The proxy node as claimed in claim 1, wherein the data states indicative of characteristics of the plurality of servers include data states indicative of APIs hosted on the plurality of servers.

4. The proxy node as claimed in claim 1, wherein the proxy router is configured to have routing functionality identical to routing functionality of each remaining proxy node from the plurality of proxy nodes.

5. The proxy node as claimed in claim 1, wherein:

said proxy node is configured to learn independent of an administrator one or more functional capabilities from the remaining proxy nodes from the plurality of proxy nodes; and

said learning is based on the synchronizing the one or more data states of the proxy node with each remaining proxy node from the plurality of proxy nodes.

6. The proxy node as claimed in claim 1, wherein the information descriptive of the API includes metadata associated with the API.

7. The proxy node as claimed in claim 1, wherein the data states of the proxy node being synchronized with the data states of each remaining node from the plurality of proxy nodes include metadata associated with the API.

8. The proxy node as claimed in claim 1, wherein the proxy router is further configured to determine that the API request conforms to one or more Layer 7 protocols,

the proxy router configured to select the server and transmit the API request to the API after determining that the API request conforms to the one or more Layer 7 protocols.

9. The proxy node as claimed in claim 1, wherein the proxy router is further configured to determine that the API request meets a set of predefined criteria,

the proxy router configured to transmit the API request to the API in response to determining that the API request meets the set of predefined criteria.

10. The proxy node as claimed in claim 1, wherein the proxy node is a first proxy node located on a first cloud network and at least one remaining proxy node from the plurality of proxy nodes is located on a second cloud network different from the first cloud network.

11. The proxy node as claimed in claim 1, wherein the proxy node is configured to support a plurality of messaging protocols including at least one of:

Hyper Text Transfer Protocol (HTTP), Hyper Text Transfer Protocol Secure (HTTPS), WebSocket, secure WebSocket, Message Queuing Telemetry Transport (MQTT), secure MQTT, or Constrained Application Protocol (CoAP).

12. A proxy node configured for implementation within a proxy cluster comprising a plurality of proxy nodes, the proxy node including:

a proxy router configured to;

receive an Application Programming Interface (API) request from a client device routed to the proxy node based on routing policies stored within a Domain Name System (DNS) server, the API request associated with an API;

select a server that hosts the API from a plurality of servers based on (1) information descriptive of the API and (2) data states indicative of characteristics of the plurality of servers; and

transmit the API request to the API hosted on the server; and

a synchronization controller configured to synchronize data states of the proxy node with data states of each remaining proxy node from the plurality of proxy nodes such that the plurality of proxy nodes has common routing functionality.

13. The proxy node as claimed in claim 12, wherein the data states of the proxy node and the data states of each remaining proxy node from the plurality of proxy nodes include the data states indicative of the characteristics of the plurality of servers and data states indicative of one or more of:

information of sessions between client devices and the plurality of servers,

security data associated with the sessions,

configuration data for routing messages between the client devices and the plurality of servers, or

characteristics of the plurality of proxy nodes.

14. A method of adding a proxy node to a proxy cluster to be included in a plurality of proxy nodes on a network, the method comprising:

connecting the proxy node to the network;

in response to connecting the proxy node to the network, synchronizing, via at least one processor of the proxy node, data states of the proxy node with data states of each remaining proxy node from the plurality of proxy nodes such that the proxy node is configured to implement one or more routing policies identical to the remaining proxy nodes from the plurality of proxy nodes;

receiving, at the at least one processor, an Application Programming Interface (API) request from a client device, the API request associated with an API;

selecting, via the at least one processor, a server that hosts the API from a plurality of servers based on (1) information descriptive of the API and (2) data states indicative of characteristics of the plurality of servers;

transmitting, via the at least one processor, the API request to the API hosted on the server; and

receiving, at the at least one processor, a response to the API request from the server.

15. The method as claimed in claim 14, wherein the data states of the proxy node and the data states of each remaining proxy node from the plurality of proxy nodes include the data states indicative of the characteristics of the plurality of servers and data states indicative of one or more of:

characteristics of the plurality of servers,

information of sessions between client devices and the plurality of servers,

security data associated with the sessions,

configuration data for routing messages between the client devices and the plurality of servers, and

characteristics of the plurality of proxy nodes.