Transparent user and session management for web applications

• US 20060288212A1
• Filed: 08/25/2006
• Published: 12/21/2006
• Est. Priority Date: 03/20/2001
• Status: Abandoned Application

• Current Assignee: Gutenberg Printing LLC (Intellectual Ventures LLC)
• Original Assignee: Gutenberg Printing LLC (Intellectual Ventures LLC)
• Inventors: Chiang, Hiang-Swee
• Application Number:
  US11/510,055
• Publication Number:
  US 20060288212A1
• Time in Patent Office: Days
• US Class Current: 713/170
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A central server used to generate, for example, web application instances to remote users over a computer network, such as the Internet, is implemented with new programming techniques by which user and session management is made independent of the web application instance. The prior methods, by which a new user or session cookie is generated for each user request, is replaced by techniques wherein a single session cookie is provided to a user for all requests in a single user session. A user database is maintained by the central server which stores the session cookie and correlates it to a web application instance, identified by system variables stored in the database, rather than with application variables maintained by an application instance.

Claims

1. A method for providing session management with respect to client-server interactions over a computer network, comprising:

providing a server runtime environment;

maintaining a database for storing and accessing user and state information for web applications; and

employing said server runtime environment and database to map client requests to instances of a web application that relies on said server and database to provide user and session management functionality.

2. A method as recited in claim 1, wherein requests from a session are mapped to matching instances of the web application.

3. A method as recited in claim 2, wherein the mapping of requests from a session to matching instances of the web application comprises transparently mapping said requests.

4. A method as recited in claim 1, wherein requests from different sessions of a client are mapped to matching instances of the web application.

5. A method as recited in claim 4, wherein the mapping of requests from different sessions of a client to matching instances of the web application comprises transparently mapping said requests.

6. A method as recited in claim 1, wherein requests from different clients are mapped to different instances of the web application.

7. A method as recited in claim 6, wherein the mapping of requests from different clients to different instances of the web application comprises transparently mapping said requests.

8. A method as recited in claim 1, further comprising managing a first session comprising an interaction over the network between a client and a server, said interaction begining with a log-in request by the client and concluding with one of a log-out request by the client and a session time-out generated by the server.

9. A method as recited in claim 1, wherein said database comprises a record including information indicative of a user name, a user password corresponding to the user name, a number assigned to the user, and user and session management information corresponding to a web application instance.

10. A method as recited in claim 9, wherein the number comprises a randomly-generated number assigned to the user and transmitted with client requests.

11. A method as recited in claim 10, wherein the randomly-generated number is stored in a JLVSession cookie.

12. A method as recited in claim 1, further comprising receiving from a client a request without any client-session cookie, and returning to the client a web page with a sign-in form, the sign-in form including fields for submitting a first parameter for a usemame corresponding to the user, a second parameter for a password corresponding to the user, and a third parameter enabling the runtime environment to recognize that the user-submitted values for these parameters are in conjunction with a sign-in request.

13. A method as recited in claim 12, further comprising receiving the sign-in form back from the client, authenticating the user with reference to information in the database, and returning to the client a redirection response together with a cookie that includes a random number generated by the server, wherein the random number uniquely identifies the user and the session.

14. A method as recited in claim 13, further comprising receiving a subsequent request from the client, employing the database to identify the user from whom the request originated, retrieving a user object corresponding to the user, and passing the subsequent request to the user object.

15. A method as recited in claim 14, wherein the user object uses a URL within the request to identify a web application that is targeted, and creating an instance of the web application.

16. A method as recited in claim 1, wherein said web application lacks user and session management functionality and relies on said server and database to provide this functionality.

17. A method as recited in claim 16, wherein said session management functionality includes an algorithm for identifying consecutive requests made by a particular web browser.

18. A method as recited in claim 16, wherein said user management functionality includes an algorithm for identifying consecutive requests made by different web browsers but from the same user.

19. A computer readable medium comprising instructions for providing session management with respect to client-server interactions over a computer network, said instructions configured to cause a server computer to perform the following steps:

providing a server runtime environment;

maintaining a database for storing and accessing user and state information for web applications; and

employing said server runtime environment and database to map client requests to instances of a web application.

20. A computer readable medium as recited in claim 19, further comprising instructions for mapping requests from a session to matching instances of the web application.

21. A computer readable medium as recited in claim 20, wherein the mapping of requests from a session to matching instances of the web application comprises transparently mapping said requests.

22. A computer readable medium as recited in claim 19, further comprising instructions for mapping requests from different sessions of a client to matching instances of the web application.

23. A computer readable medium as recited in claim 19, wherein the mapping of requests from different sessions of a client to matching instances of the web application comprises transparently mapping said requests.

24. A computer readable medium as recited in claim 19, further comprising instructions for mapping requests from different clients to different instances of the web application.

25. A computer readable medium as recited in claim 24, wherein the mapping of requests from different clients to different instances of the web application comprises transparently mapping said requests.

26. A computer readable medium as recited in claim 19, further comprising instructions for managing a first session comprising an interaction over the network between a client and a server, said interaction begining with a log-in request by the client and concluding with one of a log-out request by the client and a session time-out generated by the server.

27. A computer readable medium as recited in claim 19, wherein said database comprises a record including information indicative of a user name, a user password corresponding to the user name, a number assigned to the user, and user and session management information corresponding to a web application instance.

28. A computer readable medium as recited in claim 27, wherein the number comprises a randomly-generated number assigned to the user and transmitted with client requests.

29. A computer readable medium as recited in claim 28, wherein the randomly-generated number is stored in a JLVSession cookie.

30. A computer readable medium as recited in claim 19, further comprising instructions for:

receiving from a client a request without any client-session cookie, and returning to the client a web page with a sign-in form, the sign-in form including fields for submitting a first parameter for a usemame corresponding to the user, a second parameter for a password corresponding to the user, and a third parameter enabling the runtime environment to recognize that the user-submitted values for these parameters are in conjunction with a sign-in request.

31. A computer readable medium as recited in claim 30, further comprising instructions for:

receiving the sign-in form back from the client, authenticating the user with reference to information in the database, and returning to the client a redirection response together with a cookie that includes a random number generated by the server, wherein the random number uniquely identifies the user and the session.

32. A computer readable medium as recited in claim 31, further comprising instructions for:

receiving a subsequent request from the client, employing the database to identify the user from whom the request originated, retrieving a user object corresponding to the user, and passing the subsequent request to the user object.

33. A computer readable medium as recited in claim 32, wherein the user object uses a URL within the request to identify a web application that is targeted, and creating an instance of the web application.

34. A computer readable medium as recited in claim 19, wherein said web application lacks user and session management functionality and relies on said server and database to provide this functionality.

35. A computer readable medium as recited in claim 34, wherein said session management functionality includes an algorithm for identifying consecutive requests made by a particular web browser.

36. A computer readable medium as recited in claim 34, wherein said user management functionality includes an algorithm for identifying consecutive requests made by different web browsers but from the same user.

37. A system comprising a server, a database, and a computer readable medium, wherein said computer readable medium comprises instructions for carrying out a method for providing session management with respect to client-server interactions over a computer network, said method comprising providing a server runtime environment, maintaining in said database user and state information for web applications, and employing said server runtime environment and database to map client requests to instances of a web application.

38. A system as recited in claim 37, wherein requests from a session are mapped to matching instances of the web application.

39. A system as recited in claim 38, wherein the mapping of requests from a session to matching instances of the web application comprises transparently mapping said requests.

40. A system as recited in claim 37, wherein requests from different sessions of a client are mapped to matching instances of the web application.

41. A system as recited in claim 40, wherein the mapping of requests from different sessions of a client to matching instances of the web application comprises transparently mapping said requests.

42. A system as recited in claim 37, wherein requests from different clients are mapped to different instances of the web application.

43. A system as recited in claim 42, wherein the mapping of requests from different clients to different instances of the web application comprises transparently mapping said requests.

44. A system as recited in claim 37, further comprising managing a first session comprising an interaction over the network between a client and a server, said interaction begining with a log-in request by the client and concluding with one of a log-out request by the client and a session time-out generated by the server.

45. A system as recited in claim 37, wherein said database comprises a record including information indicative of a user name, a user password corresponding to the user name, a number assigned to the user, and user and session management information corresponding to a web application instance.

46. A system as recited in claim 45, wherein the number comprises a randomly-generated number assigned to the user and transmitted with client requests.

47. A system as recited in claim 46, wherein the randomly-generated number is stored in a JLVSession cookie.

48. A system as recited in claim 37, further comprising receiving from a client a request without any client-session cookie, and returning to the client a web page with a sign-in form, the sign-in form including fields for submitting a first parameter for a usemame corresponding to the user, a second parameter for a password corresponding to the user, and a third parameter enabling the runtime environment to recognize that the user-submitted values for these parameters are in conjunction with a sign-in request.

49. A system as recited in claim 48, further comprising receiving the sign-in form back from the client, authenticating the user with reference to information in the database, and returning to the client a redirection response together with a cookie that includes a random number generated by the server, wherein the random number uniquely identifies the user and the session.

50. A system as recited in claim 49, further comprising receiving a subsequent request from the client, employing the database to identify the user from whom the request originated, retrieving a user object corresponding to the user, and passing the subsequent request to the user object.

51. A system as recited in claim 50, wherein the user object uses a URL within the request to identify a web application that is targeted, and creating an instance of the web application.

52. A system as recited in claim 37, wherein said web application lacks user and session management functionality and relies on said server and database to provide this functionality.

53. A system as recited in claim 52, wherein said session management functionality includes an algorithm for identifying consecutive requests made by a particular web browser.

54. A system as recited in claim 52, wherein said user management functionality includes an algorithm for identifying consecutive requests made by different web browsers but from the same user.

55. A system comprising a server, a database, and means for providing session management with respect to client-server interactions over a computer network, said means comprising means for providing a server runtime environment, means for maintaining in said database user and state information for web applications, and means for employing said server runtime environment and database to map client requests to instances of a web application.