METHOD AND APPARATUS FOR RECOVERING SESSIONS

• US 20100332836A1
• Filed: 09/07/2010
• Published: 12/30/2010
• Est. Priority Date: 03/04/2008
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: Shen, Shuo
• Granted Patent: US 8,793,494 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066

Abstract

A method for recovering sessions includes storing, by a client, session information after a session is established between the server and the client. When the session needs to be recovered upon interruption, the client sends all state information before interruption of the session and the session information to the server, and the server recovers the session upon the received session information and all state information before interruption of the session. After a session is interrupted, the server does not need to store any session-related information, thus saving the resources of the server, and all information about the previous session can be recovered completely.

Claims

1. A method for recovering sessions, comprising:

when a session needs to be recovered upon interruption, sending, by a client, all state information before the interruption of the session and session information of the session to a server; and

recovering, by the server, the session upon the session information and all the state information before the interruption of the session.

2. The method according to claim 1, wherein before the session is interrupted, the method further comprises:

receiving, by the client, a first key encrypted and the session information encrypted from the server after the session is established between the server and the client, wherein the first key is shared by the client and the server, and the first key and the session information are encrypted through a local key of the server; and

storing the first key and the session information.

3. The method according to claim 2, wherein the step of the client sending all state information before interruption of the session to the server when the session needs to be recovered upon interruption comprises:

encrypting, by the client, all the state information before the interruption of the session with the first key, and

sending encrypted state information, the encrypted first key, and the encrypted session information received from the server, to the server.

4. The method according to claim 1, wherein the step of the client sending all state information before interruption of the session to the server when the session needs to be recovered upon interruption comprises:

encrypting, by the client, all state information before interruption of the session with a first key shared with the server, and sending the encrypted state information to the server.

5. The method according to any one of claim 2, wherein:

the first key is a session key or a traffic encryption (TE) key.

6. The method according to any one of claim 2, further comprising:

receiving, by the client, a user identity (ID), address information, authentication information, session-related information, or security-related information, or any combination thereof, from the server after the session is established between the server and the client.

7. The method according to claim 6, wherein:

the security-related information comprises a validity period, a number of valid use times, or a timestamp of the first key, or any combination thereof.

8. The method according to claim 2, wherein:

in a Secure Shell (SSH) protocol session, the client further receives a validity period of a packet A, a timestamp of delivering the packet A, a user identity (ID) of the client who obtains the packet A, a SSH session ID, or authorization information of the client, or any combination thereof, from the server.

9. The method according to claim 8, wherein:

the client further sends a timestamp of requesting to recover the session, the user ID of the client, an Internet Protocol (IP) address, the SSH session ID, or session services being requested to be recovered, or any combination thereof, to the server.

10. A method for recovering sessions, comprising:

encrypting, by a server, session information of a client to generate first encrypted information through a local key when a session is established between the server and the client, wherein the first encrypted information comprises the session information and a first key shared between the client and the server; and

sending the first encrypted information to the client;

receiving the first encrypted information and second encrypted information sent by the client when the session needs to be recovered upon interruption, wherein the second encrypted information is generated, by the client, through encrypting all state information before the interruption of the session with the first key;

decrypting the first encrypted information with the local key to obtain the first key and the session information; and

decrypting the second encrypted information with the first key to obtain the state information before the interruption of the session and recover the session.

11. The method according to claim 10, wherein:

the first encrypted information further comprises a user identity (ID), address information, authentication information, session-related information, or security-related information, or any combination thereof.

12. The method according to claim 11, wherein:

the security-related information comprises a validity period, a number of valid use times, or a timestamp of the first key, or any combination thereof.

13. The method according to claim 10, wherein:

in a Secure Shell (SSH) protocol session, the first encrypted information further comprises a validity period of a packet A, a timestamp of delivering the packet A, a user identity (ID) of the client who obtains the packet A, a SSH session ID, or authorization information of the client, or any combination thereof.

14. The method according to claim 13, wherein:

the second encrypted information further comprises a timestamp of requesting to recover the session, the user ID of the client, an Internet Protocol (IP) address, the SSH session ID, or session services being requested to be recovered, or any combination thereof.

15. The method according to any one of claim 10, wherein:

the first key is a session key or a traffic encryption (TE) key.

16. An apparatus for recovering sessions, comprising:

a first encrypting unit, configured to;

encrypt session information of a session with a first key to generate first encrypted information when the session is established between the apparatus and a client, wherein the first encrypted information comprises a second key shared by the apparatus and the client, the first key is privately owned by the apparatus, and the client is unaware of the first key;

a first sending unit, configured to send the first encrypted information to the client;

a first receiving unit, configured to receive second encrypted information and the first encrypted information when the session between the apparatus and the client needs to be recovered upon interruption, wherein the second encrypted information is generated by encrypting all state information before interruption of the session with the second key;

a first decrypting unit, configured to decrypt the first encrypted information received by the first receiving unit through the first key and obtain the second key; and

a second decrypting unit, configured to decrypt the second encrypted information with the second key to obtain all state information before interruption of the session and recover the session.

17. The apparatus of claim 16, wherein:

the first key is a session key or a traffic encryption (TE) key, and the second key is a session key or a TE key.