Capture and resumption of network application sessions

• US 7,979,555 B2
• Filed: 02/27/2007
• Issued: 07/12/2011
• Est. Priority Date: 02/27/2007
• Status: Active Grant

• Current Assignee: ExtraHop Networks, Incorporated
• Original Assignee: ExtraHop Networks, Incorporated
• Inventors: Mukerji, Arindum, Rothstein, Jesse Abraham
• Primary Examiner(s): Chea; Philip J
• Assistant Examiner(s): Shepperd; Eric W
• Application Number:
  US11/679,356
• Publication Number:
  US 20080209045A1
• Time in Patent Office: 1,596 Days
• Field of Search: 709/227
• US Class Current: 709/227
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/142 Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms
• CPC Class Codes: H04L 67/145 avoiding end of session, e.g. keep-alive, heartbeats, resumption message or wake-up for inactive or interrupted session
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A system and method for capture and resumption of network application sessions in a network system. A transaction may be detected between a client and server that includes application session state information. The session state information may relate to a session between the client and the server. The Application session state information may be recorded in response to the detection of the transaction, and the application session state information may not be deleted according to session information expiration policies (e.g., of the client). User input may be received which requests to review the captured network application session. Correspondingly, a network request comprising captured credentials of the captured session may be generated and forwarded to the server. The network request may be usable to enable resumption of the captured network application session.

Claims

1. A method for capture and resumption of an application session in a network system, the method comprising:

detecting a transaction of the application session between a client and server, wherein the transaction includes session state information, wherein the session state information relates to the application session between the client and the server, and wherein, during the application session, content of the application session is provided from the server to the client;

recording the session state information of the application session in response to said detecting;

preventing termination of the application session after completion of the application session by the client;

providing information regarding the application session for presentation to a user;

receiving user input requesting review of the application session to view a portion of the content based on the provided information, wherein said receiving is performed at a point in time after completion of the application session by the client; and

generating a network request in response to said user input requesting review of the application session, wherein the network request comprises at least a portion of the session state information, wherein the at least a portion of the session state information comprises authentication credentials of the application session, wherein the network request is provided to the server, wherein said generating enables resumption of the application session;

wherein said detecting, said recording, said preventing, said providing, said receiving user input, and said generating are performed by a network monitoring device.

2. The method of claim 1,

wherein the session state information is not deleted according to session expiration policies.

3. The method of claim 1, further comprising:

preventing the server from removing the session state information according to expiration policies of the server.

4. The method of claim 1, wherein said preventing termination comprises actively maintaining the application session between the client and the server prior to said receiving user input requesting review of the application session.

5. The method of claim 1, wherein said preventing termination comprises preventing a logout action for the client.

6. The method of claim 1, wherein said preventing termination comprises periodically refreshing the application session.

7. The method of claim 6, wherein said periodically refreshing the application session is not performed by the client.

8. The method of claim 6, wherein said periodically refreshing the application session comprises one or more of replaying a prior request with authentication credentials or session state information.

9. The method of claim 6, wherein said periodically refreshing the application session comprises one or more of generating a new request comprising authentication credentials or session state information.

10. The method of claim 1, wherein said preventing termination comprises:

analyzing the transaction; and

determining if characteristics of the transaction indicate a request to terminate the application session.

11. The method of claim 1, wherein the session state information is stored in one or more cookies.

12. The method of claim 1, wherein the session state information is stored in a Uniform Resource Identifier (URI).

13. The method of claim 1, further comprising:

monitoring network traffic of a network session between a client and a server, wherein said monitoring comprises tracking network connections, wherein said detecting is performed in response to said monitoring.

14. The method of claim 1, wherein said preventing termination comprises blocking requests that invalidate or tear down session state information, wherein said blocking requests operates to ignore session expiration policies.

15. The method of claim 1, wherein said preventing termination comprises periodically requesting application resources from the server in order to prevent the application session from expiring.

16. The method of claim 1, wherein the session state information is not deleted according to session state expiration policies of the client.

17. The method of claim 1, wherein said receiving is performed at a point in time after the application session is discarded or considered to be expired by the client.

18. The method of claim 1, wherein the application session corresponds to a second user using the client to visit the content of the application session, and wherein the user input is received from a first user to review the content received by the second user.

19. The method of claim 18, wherein said receiving is performed at a point in time later than an expiration time indicated by session expiration policies of the application session for the second user.

20. The method of claim 1, wherein said providing the information regarding the application session comprises providing a graphical user interface for receiving the user input requesting review of the application session.

21. The method of claim 1, wherein the network monitoring device is within a local network of the client, wherein the client accesses the Internet via the local network.

22. The method of claim 21, wherein the network monitoring device is interposed between the client and the Internet.

23. A computer-accessible, non-transitory, memory medium comprising program instructions for capture and resumption of an application session in a network, wherein the program instructions are executable to:

monitor network traffic of the application session between a client and a server coupled to the network, wherein the application session uses an application protocol, wherein, during the application session, content of the application session is provided from the server to the client, and wherein said monitoring comprises tracking network connections;

detect a transaction of the network traffic that includes authentication credentials;

record the authentication credentials in response to said detecting;

prevent termination of the application session after completion of the application session by the client;

provide information regarding the application session for presentation to a user;

receive user input requesting to review the application session to view a portion of the content based on the information, wherein said receiving is performed at a point in time after completion of the application session by the client; and

generate a network request comprising the authentication credentials of the application session, wherein the network request is provided to the server, and wherein said generating enables resumption of the application session;

wherein the program instructions are executable by a network monitoring device to perform said detecting, said recording, said preventing, said providing, said receiving user input, and said generating.

24. The memory medium of claim 23, wherein, in providing information regarding the application session, the program instructions are further executable to provide a graphical user interface for receiving the user input requesting review of the application session.

25. A network monitoring device, comprising:

at least one port for coupling to a network;

a processor; and

a memory medium coupled to the processor, wherein the memory medium stores program instructions executable by the processor to;

detect a transaction between a client and a server that includes session state information, wherein the session state information relates to an application session between the client and the server, and wherein, during the application session, content of the application session is provided from the server to the client;

record the session state information in response to said detecting;

prevent termination of the application session after completion of the application session by the client;

provide information regarding the application session for presentation to a user;

receive user input requesting to review the application session to view a portion of the content based on the provided information, wherein said receiving is performed at a point in time after completion of the application session by the client; and

generate a network request comprising captured credentials of the session state information, wherein said generating enables resumption of the application session.

26. The network monitoring device of claim 25, wherein, in providing information regarding the application session, the program instructions are further executable to provide a graphical user interface for receiving the user input requesting review of the application session.

27. A method for capture and resumption of an application session in a network system, the method comprising:

detecting a transaction of the application session between a client and server, wherein the transaction includes session state information, wherein the session state information relates to the application session between the client and the server, and wherein,

during the application session, content of the application session is provided from the server to the client;

recording the session state information of the application session in response to said detecting;

actively maintaining the application session between the client and server, wherein said actively maintaining comprises preventing a logout action for the client, wherein said actively maintaining is performed after completion of the application session by the client;

providing information regarding the application session for presentation to a user;

receiving user input requesting review of the application session to view a portion of the content based on the provided information; and

generating a network request in response to said user input requesting review of the application session, wherein the network request comprises at least a portion of the session state information, wherein the at least a portion of the session state information comprises authentication credentials of the application session, wherein the network request is provided to the server, wherein said generating enables resumption of the application session;

wherein said detecting, said recording, said actively maintaining, said providing, said receiving user input, and said generating are performed by a network monitoring device.

28. A method for capture and resumption of an application session in a network system, the method comprising:

detecting a transaction of the application session between a client and server, wherein the transaction includes session state information, wherein the session state information relates to the application session between the client and the server, and wherein, during the application session, content of the application session is provided from the server to the client;

recording the session state information of the application session in response to said detecting, wherein the session state information comprises authentication credentials;

actively maintaining the application session between the client and server, wherein said actively maintaining the application session between the client and the server comprises periodically refreshing the application session, including replaying a prior request with authentication credentials or session state information, wherein said actively maintaining is performed after completion of the application session by the client;

providing information regarding the application session for presentation to a user;

receiving user input requesting review of the application session to view a portion of the content based on the information; and

generating a network request in response to said user input requesting review of the application session, wherein the network request comprises the authentication credentials of the application session, wherein the network request is provided to the server, wherein said generating enables resumption of the application session;

wherein said detecting, said recording, said actively maintaining, said providing, said receiving user input, and said generating are performed by a network monitoring device.