Method and an apparatus to validate a web session in a proxy server

• US 20080288648A1
• Filed: 05/18/2007
• Published: 11/20/2008
• Est. Priority Date: 05/18/2007
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Schneider, James Paul
• Granted Patent: US 8,452,882 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54

Abstract

Some embodiments of a method and an apparatus to validate a web session in a proxy server have been presented. In one embodiment, service of predetermined content is offloaded from an application server to a proxy server communicatively coupled between the application server and a client. Using the proxy server, access to the predetermined content by the client may be controlled.

Claims

1. A method comprising:

offloading service of predetermined content from an application server to a proxy server communicatively coupled between the application server and a client; and

using the proxy server to control access to the predetermined content by the client.

2. The method of claim 1, wherein using the proxy server to control access to the predetermined content by the client comprises:

using the proxy server to compute a message authentication code based on one or more previously obtained access control tokens in an access request from the client; and

using the proxy server to compare the message authentication code computed against a previously obtained message authentication code within the access request.

3. The method of claim 1, wherein using the proxy server to control access to the predetermined content by the client comprises:

using the proxy server to check an access control token within an access request from the client to determine if the client is authorized to access the predetermined content.

4. The method of claim 1, further comprising:

serving the predetermined content to the client if a message authentication code within an access request from the client is validated and an access permission token within the access request indicates that the client has been authorized to access the predetermined content.

5. The method of claim 1, further comprising:

denying the client access to the predetermined content if a message authentication code within an access request from the client is invalid.

6. The method of claim 1, further comprising:

denying the client access to the predetermined content if an access permission token within an access request from the client indicates that the client is not authorized to access the predetermined content.

7. The method of claim 1, wherein the predetermined content comprises static content.

8. The method of claim 1, wherein using the proxy server to control access to the predetermined content by the client comprises:

checking a timestamp in an access request from the client.

9. The method of claim 1, further comprising:

using the proxy server to issue updated message authentication code and access control tokens to the client.

10. A proxy server comprising:

a first network interface to communicatively couple to a client to receive an access request to access predetermined content; and

an authentication module to authenticate the client based on information in the access request, wherein the client has previously obtained the information from an application server.

11. The apparatus of claim 10, further comprising:

a second network interface to communicatively couple to the application server.

12. The apparatus of claim 10, wherein the authentication module comprises a message authentication code computation module to compute a message authentication code based on one or more access control tokens in the access request from the client and to compare the message authentication code computed against a previously obtained message authentication code within the access request.

13. The apparatus of claim 10, wherein the authentication module is operable to check an access control token within the access request from the client to determine if the client is authorized to access the predetermined content.

14. The apparatus of claim 10, wherein the authentication module is operable to serve the predetermined content to the client if a message authentication code within the access request from the client is validated and an access control token within the access request indicates that the client has been authorized to access the predetermined content.

15. The apparatus of claim 10, wherein the authentication module is operable to deny the client access to the predetermined content if a message authentication code within the access request from the client is invalid.

16. The apparatus of claim 10, wherein the authentication module is operable to deny the client access to the predetermined content if an access permission token within the access request from the client indicates that the client is not authorized to access the predetermined content.

17. A system comprising the proxy server of claim 10, further comprising the application server and a backend server coupled to the application server.

18. A system comprising the proxy server of claim 10, further comprising the application server and a backend server coupled to the application server, wherein the backend server comprises a database server.

19. A system comprising the proxy server of claim 10, wherein the predetermined content comprises static content, and the system further comprises:

a repository coupled to the proxy server, to store the static content.

20. A machine-readable medium that provides instructions that, if executed by a processor, will cause the processor to perform operations comprising:

offloading service of predetermined content from an application server to a proxy server communicatively coupled between the application server and a client; and

using the proxy server to control access to the predetermined content by the client.

21. The machine-readable medium of claim 20, wherein using the proxy server to control access to the predetermined content by the client comprises:

using the proxy server to compute a message authentication code based on one or more previously obtained access control tokens in an access request from the client; and

using the proxy server to compare the message authentication code computed against a previously obtained message authentication code within the access request.

22. The machine-readable medium of claim 20, wherein using the proxy server to control access to the predetermined content by the client comprises:

using the proxy server to check an access control token within an access request from the client to determine if the client is authorized to access the predetermined content.

23. The machine-readable medium of claim 20, wherein the operations further comprise:

serving the predetermined content to the client if a message authentication code within an access request from the client is validated and an access permission token within the access request indicates that the client has been authorized to access the predetermined content.

24. The machine-readable medium of claim 20, wherein the operations further comprise:

denying the client access to the predetermined content if a message authentication code within an access request from the client is invalid.

25. The machine-readable medium of claim 20, wherein the operations further comprise:

denying the client access to the predetermined content if an access permission token within an access request from the client indicates that the client is not authorized to access the predetermined content.

26. The machine-readable medium of claim 20, wherein the predetermined content comprises static content.

27. The machine-readable medium of claim 20, wherein using the proxy server to control access to the predetermined content by the client comprises:

checking a timestamp in an access request from the client.

28. The machine-readable medium of claim 20, wherein the operations further comprise:

using the proxy server to issue updated message authentication code and access control tokens to the client.