Method and apparatus for re-establishing communication between a client and a server

• US 20070136795A1
• Filed: 12/09/2005
• Published: 06/14/2007
• Est. Priority Date: 12/09/2005
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Youn, Paul
• Granted Patent: US 8,234,694 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords

Abstract

One embodiment of the present invention provides a system that re-establishes communication between a client and a server after an unexpected termination of communication. During operation, the system receives a request from the client at the server to re-establish communication between the client and the server, wherein the request includes a temporary credential. If the temporary credential is valid, the system temporarily re-establishes communication between the client and the server, until the client can be re-authenticated with a permanent credential.

Claims

1. A method for re-establishing communication between a client and a server after an unexpected termination of communication, the method comprising:

receiving a request from the client at the server to re-establish communication between the client and the server, wherein the request includes a temporary credential; and

if the temporary credential is valid, re-establishing communication between the client and the server temporarily, until the client can be re-authenticated with a permanent credential.

2. The method of claim 1, further comprising configuring the server by:

generating the permanent credential, which is used to determine whether the client is authorized to establish communication with the server;

creating a temporary credential profile template; and

securing access to the permanent credential so that the permanent credential is restricted to a subset of users.

3. The method of claim 2, wherein the temporary credential profile template can include:

a communication time-limit defining how long communication can last before requiring the client to use the permanent credential to authenticate with the server;

a usage time-limit defining how soon the temporary credential must be used after the unexpected termination of communication;

an expiration value defining how long a temporary credential profile is valid before a new temporary credential profile must be created;

an authentication-field defining what authentication-information must be provided by the client attempting to re-establish communication when using the temporary credential;

a format for an alert message alerting an administrator that the temporary credential has been used;

a format for an alert message alerting the administrator of the approaching communication time-limit;

a format for an alert message alerting the administrator of the impending expiration of an instance of the temporary credential profile; and

a capability limit for the client defining what capabilities are available to the client under the temporary credential.

4. The method of claim 3, wherein the authentication-field includes sub-fields which can include:

a user name;

a password;

a packet sequence number of the last packet received by the client from the server;

a packet sequence number of the last packet sent by the client to the server; and

an Internet Protocol address of the client.

5. The method of claim 1, further comprising initializing the server by:

creating an instance of a temporary credential profile from a temporary credential profile template, wherein the temporary credential profile provides instructions to the server to be executed in the event that the server receives the temporary credential from the client; and

configuring the instance of the temporary credential profile, wherein configuring the instance of the temporary credential profile involves specifying values for the fields of the temporary credential profile.

6. The method of claim 1, wherein the temporary credential can include:

a session key, wherein the session key is obtained from the server after the client is authenticated using a permanent credential;

or

any other authentication-indicator obtained from the server, wherein an authentication-indicator indicates that the client was previously authenticated using a permanent credential.

7. The method of claim 2, wherein securing access to the permanent credential may involve:

deleting the permanent credential;

supplying the permanent credential to a third-party authentication service;

encrypting the permanent credential; and

obfuscating the permanent credential.

8. The method of claim 2, wherein the temporary credential can only be used once and the permanent credential can be used more than once.

9. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for re-establishing communication between a client and a server after the unexpected termination of communication, the method comprising:

receiving a request from the client at the server to re-establish communication between the client and the server, wherein the request includes a temporary credential; and

if the temporary credential is valid, re-establishing communication between the client and the server temporarily, until the client can be re-authenticated with a permanent credential.

10. The computer-readable storage medium of claim 9, further comprising configuring the server by:

generating the permanent credential, which is used to determine whether the client is authorized to establish communication with the server;

creating a temporary credential profile template; and

securing access to the permanent credential so that the permanent credential is restricted to a subset of users.

11. The computer-readable storage medium of claim 10, wherein the temporary credential profile template can include:

a communication time-limit defining how long communication can last before requiring the client to use the permanent credential to authenticate with the server;

a usage time-limit defining how soon the temporary credential must be used after the unexpected termination of communication;

an expiration value defining how long a temporary credential profile is valid before a new temporary credential profile must be created;

an authentication-field defining what authentication-information must be provided by the client attempting to re-establish communication when using the temporary credential;

a format for an alert message alerting an administrator that the temporary credential has been used;

a format for an alert message alerting the administrator of the approaching communication time-limit;

a format for an alert message alerting the administrator of the impending expiration of an instance of the temporary credential profile; and

a capability limit for the client defining what capabilities are available to the client while the temporary credential is in use.

12. The computer-readable storage medium of claim 11, wherein the authentication-field includes sub-fields which can include:

a user name;

a password;

a packet sequence number of the last packet received by the client from the server;

a packet sequence number of the last packet sent by the client to the server; and

an Internet Protocol address of the client.

13. The computer-readable storage medium of claim 9, further comprising initializing the server by:

creating an instance of a temporary credential profile from a temporary credential profile template, wherein the temporary credential profile provides instructions to the server to be executed in the event that the server receives the temporary credential from the client; and

configuring the instance of the temporary credential profile, wherein configuring the instance of the temporary credential profile involves specifying values for the fields of the temporary credential profile.

14. The computer-readable storage medium of claim 9, wherein the temporary credential can include:

a session key, wherein the session key is obtained from the server after the client is authenticated using a permanent credential;

or

any other authentication-indicator obtained from the server, wherein an authentication-indicator indicates that the client was previously authenticated using a permanent credential.

15. The computer-readable storage medium of claim 10, wherein securing access to the permanent credential may involve:

deleting the permanent credential;

supplying the permanent credential to a third-party authentication service;

encrypting the permanent credential; and

obfuscating the permanent credential.

16. The computer-readable storage medium of claim 10, wherein the temporary credential can only be used once and the permanent credential can be used more than once.

17. An apparatus for re-establishing communication between a client and a server after termination of communication, comprising:

the client;

a receiving mechanism configured within the server to receive a request from the client at the server to re-establish communication between the client and the server, wherein the request includes a temporary credential;

a validating mechanism configured to validate the temporary credential; and

a communication mechanism configured to re-establish communication between the client and the server temporarily, until the client can be re-authenticated with a permanent credential.

18. The apparatus of claim 17, further comprising a server configuration mechanism configured to configure the server by:

generating the permanent credential, which is used to determine whether the client is authorized to establish communication with the server;

creating a temporary credential profile template; and

securing access to the permanent credential so that the permanent credential is restricted to a subset of users.

19. The apparatus of claim 17, further comprising a server initiation mechanism configured to initiate the server by:

creating an instance of a temporary credential profile from a temporary credential profile template, wherein the temporary credential profile provides instructions to the server to be executed in the event that the server receives the temporary credential from the client; and

configuring the instance of the temporary credential profile, wherein configuring the instance of the temporary credential profile involves specifying values for the fields of the temporary credential profile.

20. The apparatus of claim 18, wherein the server configuration mechanism is further configured to secure access to the permanent credential by:

deleting the permanent credential;

supplying the permanent credential to a third-party authentication service;

encrypting the permanent credential; and

obfuscating the permanent credential.