Non-intrusive multiplexed transaction persistency in secure commerce environments

• US 7,177,945 B2
• Filed: 08/03/2001
• Issued: 02/13/2007
• Est. Priority Date: 08/04/2000
• Status: Expired due to Term

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Avaya Technology Corporation Miami Lakes FLA US
• Inventors: Jaswa, Vijay, Chu, Albert Bonyao, Hong, Jack
• Primary Examiner(s): Wiley; David
• Assistant Examiner(s): SHIN, KYUNG H
• Application Number:
  US09/921,832
• Publication Number:
  US 20020073232A1
• Time in Patent Office: 2,020 Days
• Field of Search: 709/238, 709/226, 709200-253, 713/201, 370/389
• US Class Current: 709/238
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 45/566 Routing instructions carried by the data packet, e.g. active networks
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 61/301 Name conversion
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/10015 Access to distributed or replicated servers, e.g. using brokers
• CPC Class Codes: H04L 67/1006 with static server selection, e.g. the same server being selected for a specific client
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/1012 based on compliance of requirements or conditions with available server resources
• CPC Class Codes: H04L 67/1014 based on the content of a request
• CPC Class Codes: H04L 67/1017 based on a round robin mechanism
• CPC Class Codes: H04L 67/1023 based on a hash applied to IP addresses or costs
• CPC Class Codes: H04L 67/1027 Persistence of sessions during load balancing
• CPC Class Codes: H04L 67/288 Distributed intermediate devices, i.e. intermediate devices for interaction with other intermediate devices on the same level
• CPC Class Codes: H04L 67/2895 : Intermediate processing functionally located close to the data provider application, e.g. reverse proxies
• CPC Class Codes: H04L 67/34 : involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/561 : Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/563 : Data redirection of data network streams
• CPC Class Codes: H04L 67/564 : Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 67/568 : Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 67/5681 : Pre-fetching or pre-delivering data based on network characteristics
• CPC Class Codes: H04L 67/5682 : Policies or rules for updating, deleting or replacing the stored data
• CPC Class Codes: H04L 67/63 : Routing a service request depending on the request content or context
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 : Network security protocols

Abstract

The present invention is directed to a network switch that determines when specific content is hot and directs flow to one or more cache servers. The architecture of the present invention includes a decryption processor for authenticating clients and decrypting and encrypting transaction requests before the transaction requests are routed by the switch.

Claims

1. An arrangement for serving information requests, comprising:

a plurality of informational servers connected to a communications network, all of the informational servers having a common address on the communications network and serving a set of information to clients, each of the informational servers being configured to receive a transaction request associated with an individual transaction and to provide a response to each transaction request; and

a content director connecting the informational servers to the communications network and distributing transaction requests among the informational servers comprising;

a flow switch that parses plain text transaction requests to locate selected packet payload fields, selects, based on the plain text packet payload fields, an appropriate informational server to service each transaction request, and thereafter forwards at least portions of the parsed transaction requests to a selected one of the informational servers; and

a cryptographic module that decrypts, prior to parsing and informational server selection by the flow switch, cipher text transaction requests and provides plain text transaction requests to the flow switch, wherein, prior to decryption, the cipher text transaction requests have not been routed by another flow switch.

2. The arrangement of claim 1, wherein, first and second encrypted transaction requests are received from different clients having a common electronic address and served substantially simultaneously by different informational servers, wherein at least some of the responses include a cookie and a tag, wherein the cookie is generated by the previously selected informational server, wherein the tag is generated by the content director, identifies uniquely a corresponding informational server previously selected to service transaction requests from the client, and is independent of an electronic address associated with the corresponding informational server, and wherein the flow switch uses the tag in the parsed plain text equivalent of each transaction request to select an appropriate informational server to service each of the first and second transaction requests.

3. The arrangement of claim 1, wherein the content director further comprises:

a cache that stores a plurality of objects corresponding to transaction requests associated with the plurality of informational servers, the objects comprising a hot table identifying, in each entry, information frequently requested from the informational servers, the hot table including, for each entry in the table identifying corresponding information, a hit counter indicating a number of transaction requests, received over a determined time interval, requesting the corresponding information; and

a cache processor that accesses the plurality of objects in response to communications received from the flow switch.

4. The arrangement of claim 3, wherein each in the table further has a corresponding timestamp indicating when the respective entry was last updated, and a tag identifying a corresponding informational server providing the corresponding information.

5. The arrangement of claim 3, wherein the content director further comprises:

a digest generator that generates, when the hit counter for an entry indicates at least a threshold transaction request receipt frequency, a digest value pointing to the location in the table where the corresponding entry is stored; and

a digest store that stores the digests corresponding to frequently requested content.

6. The arrangement of claim 5, wherein the digest store includes a digest value for each frequently requested entry.

7. The arrangement of claim 3, wherein, when the hit counter for an entry indicates at least a threshold transaction request receipt frequency, the information corresponding to the entry is served by a cache informational server and not an origin informational server.

8. The arrangement of claim 3, wherein, when the hit counter for an entry falls below a threshold transaction request receipt frequency, the information corresponding to the entry is served by an origin informational server and not a cache informational server.

9. The arrangement of claim 5, wherein the digest value is determined according to the following equation:

L=h(K), where 0≦

L≦

M for all keys K, where K is at least a portion of an electronic address associated with corresponding information, h is the hash function, L is the location of K in the table, and M is the size of the table.

10. The arrangement of claim 2, wherein the tag is independent of an electronic address associated with the corresponding informational server and further comprising:

at least one traffic manager located between the content director and one or more clients to effect load balancing across a plurality of content directors.

11. The arrangement of claim 1, wherein the content director includes a current connection table listing active connections between servers and clients, the current connection table comprising, for a selected electronic address, a session identifier identifying a session with a client, a persistency timestamp indicating when a last transaction request was received from a client for the selected electronic address, and cookie name and value.

12. The arrangement of claim 1, wherein the flow switch is operable to tag a transaction response, the tag identifying an informational server generating the transaction response.

13. The arrangement of claim 12, wherein at least some of the responses include a cookie, wherein the cookie is generated by the informational server previously assigned by the flow switch to service transaction requests from the client, and wherein the cookie is different from the tag.

14. The arrangement of claim 13, wherein the tag is concatenated to the cookie.

15. The arrangement of claim 13, wherein, during a first time interval, the flow switch is in a tagging mode in which the switch generates and appends tags to transaction responses and, during a second different time interval, the switch operates in a digesting mode in which digests are generated, information hotness is monitored, and transaction requests are routed to informational servers based on requested information hotness and/or cookie and wherein, during the first time interval, the flow switch does not operate in the digesting mode and, during the second time interval, the flow switch does not operate in the tagging mode.

16. In an arrangement comprising a plurality of informational servers connected to a communications network, all of the informational servers having a common address on the communications network and serving a set of information to clients, each of the informational servers being configured to receive a transaction request associated with an individual transaction and to generate a corresponding response to the transaction request, at least one of the request and response including a packet payload tag identifying uniquely the responding informational server and being an identifier other than an electronic address, and to provide a response to each transaction request, a method for serving transaction requests from clients, comprising:

a cryptographic module decrypting a cipher text transaction request to provide a plain text transaction request to a first flow switch, the plain text transaction requests comprising the payload tag;

the first flow switch parsing the plain text transaction request to locate one or more selected fields including the payload tag;

the first flow switch, based on the one or more selected fields, selecting an appropriate informational server to service the transaction request; and

the first flow switch thereafter forwarding at least portions of the plain text transaction request to a selected one of the informational servers, wherein the cipher text transaction request is decrypted prior to the parsing and selecting steps.

17. The method of claim 16, wherein an invariant corresponds to an electronic address and further comprising:

receiving first and second encrypted transaction requests from different clients having a common electronic address, the requests being served substantially simultaneously by different informational servers, wherein at least some of the responses include a cookie and payload tag, wherein the cookie was generated by the informational server previously assigned by the first flow switch to service transaction requests from the client and the packet payload tag identifies the previously assigned informational server, wherein the payload tag is an identifier other than an electronic address associated with the respective serving informational server, and wherein the first flow switch uses at least one of the cookie and tag in the parsed plain text equivalent of each transaction request to select an appropriate informational server to service each of the first and second transaction requests.

18. The method of claim 16, wherein an invariant corresponds to an electronic address and further comprising:

maintaining a hot invariant table identifying information frequently requested from the informational servers, the hot invariant table including, for each invariant identifying corresponding information, a hit counter indicating a number of transaction requests, received over a determined time interval, requesting the corresponding information; and

accessing the table to select an informational server to service a transaction request for frequently requested information.

19. The method of claim 18, wherein each invariant in the table further has a corresponding timestamp indicating when the respective entry was last updated, and the payload tag identifying a corresponding informational server providing the corresponding information.

20. The method of claim 18, further comprising:

generating, when the hit counter for an invariant indicates at least a threshold transaction request receipt frequency, a digest value pointing to the location in the table where the corresponding entry is stored.

21. The method of claim 20, wherein a digest value is generated for each frequently requested invariant.

22. The method of claim 18, further comprising:

when the hit counter for an invariant indicates at least a threshold transaction request receipt frequency, directing a transaction request for information associated with the invariant to a cache informational server.

23. The method of claim 22, further comprising:

when the hit counter for an invariant falls below a threshold transaction request receipt frequency, directing a transaction request for information associated with the invariant to an origin informational server.

24. The method of claim 18, wherein the digest value is determined according to the following equation:

L=h(K), where 0≦

L≦

M for all keys K, where K is at least a portion of the invariant, h is the hash function, L is the location of K in the table, and M is the size of the table.

25. The method of claim 16, wherein at least one traffic manager is located between the content director and one or more clients to effect load balancing across a plurality of content directors.

26. The method of claim 16, further comprising:

maintaining a current connection table listing active connections between servers and clients, the current connection table comprising, for a selected invariant, a session identifier identifying a session with a client, a persistency timestamp indicating when a last transaction request was received from a client for the selected invariant, and cookie name and value, wherein, prior to the decrypting step, the cipher text transaction request has not been directed to a flow switch other than the first flow switch.

27. The method of claim 16, further comprising:

during a first time interval, the first flow switch tagging a transaction response, the packet payload tag identifying an informational server generating the transaction response.

28. The method of claim 27, wherein at least some of the responses include a cookie, wherein the cookie is generated by the informational server previously assigned by the first flow switch to service transaction requests from the client, and wherein the cookie is different from the packet payload tag.

29. The method of claim 28, wherein the packet payload tag is concatenated to the cookie.

30. The method of claim 27, further comprising:

during a second different time interval, generating a digest value for frequently requested information, the digest value indicating a location where an object associated with the frequently requested information is stored;

monitoring the frequency of transaction requests for information; and

directing transaction requests to informational servers based on the frequency of request of information and/or a cookie included in at least some of the transaction requests, wherein, during the first time interval, the flow switch does not operate in the digesting mode and, during the second time interval, the flow switch does not operate in the tagging mode.

31. A computer readable medium comprising instructions to perform the steps of claim 16.

32. An arrangement for serving information requests, comprising:

a plurality of informational servers connected to a communications network, all of the informational servers having a common address on the communications network and serving a set of information to clients, each of the informational servers being configured to receive a transaction request associated with an individual transaction, to generate a corresponding cookie identifying uniquely the generating informational server, and to provide a response to each transaction request; and

a content director connecting the informational servers to the communications network and distributing transaction requests among the informational servers comprising;

first flow switching means for (a) parsing plain text transaction requests to locate selected fields including a generated tag, the tag being shorter than the cookie, uniquely identifying an informational server, and being an identifier other than an electronic address, (b) selecting, based at least in part on the generated tag, an appropriate informational server to service each transaction request, and (c) thereafter forwarding at least portions of the parsed transaction requests to a selected one of the informational servers;

decrypting means for decrypting, prior to parsing and informational server selection by the first flow switching means, cipher text transaction requests and providing plain text transaction requests to the first flow switching means, wherein, prior to the decrypting function, the cipher text transaction request has not been directed to a flow switching means other than the first flow switching means.

33. The arrangement of claim 32, wherein, first and second encrypted transaction requests are received from different clients having a common electronic address and served substantially simultaneously by different informational servers, wherein at least some of the responses include a cookie and a generated tag, wherein the cookie is generated by the informational server previously assigned by the first flow switching means to service transaction requests from the client, wherein the generated tag is independent of an electronic address associated with the informational server generating the tag and cookie content, and wherein the first flow switching means uses at least one of the cookie and tag in the parsed plain text equivalent of each transaction request to select an appropriate informational server to service each of the first and second transaction requests and wherein the generated tag is in the packet payload.

34. The arrangement of claim 32, wherein an invariant corresponds to an electronic address and wherein the content director further comprises:

a cache that stores a plurality of objects corresponding to transaction requests associated with the plurality of informational servers, the objects comprising a hot invariant table identifying information frequently requested from the informational servers, the hot invariant table including, for each invariant identifying corresponding information, a hit counter indicating a number of transaction requests, received over a determined time interval, requesting the corresponding information; and

a cache processor that accesses the plurality of objects in response to communications received from the first flow switching means.

35. The arrangement of claim 34, wherein the content director further comprises:

a digest generator that generates, when the hit counter for an invariant indicates at least a threshold transaction request receipt frequency, a digest value pointing to the location in the table where the corresponding entry is stored; and

a digest store that stores the digests corresponding to frequently requested content.

36. The arrangement of claim 33, wherein an invariant corresponds to an electronic address, wherein, when the hit counter for an invariant indicates at least a threshold transaction request receipt frequency, the information corresponding to the invariant is served by a cache informational server and not an origin informational server and wherein, when the hit counter for an invariant falls below a threshold transaction request receipt frequency, the information corresponding to the invariant is served by an origin informational server and not a cache informational server.

37. The arrangement of claim 35, wherein the digest value is determined according to the following equation:

L=h(K), where 0≦

L≦

M for all keys K, where K is at least a portion of the invariant, h is the hash function, L is the location of K in the table, and M is the size of the table.

38. The arrangement of claim 32, wherein the first flow switching means is operable to tag a transaction response, the tag identifying an informational server generating the transaction response, wherein at least some of the responses include a cookie, wherein the cookie is generated by the informational server previously assigned by the first flow switching means to service transaction requests from the client, wherein the cookie is different from the tag, and wherein the tag is concatenated to the cookie.