Virtual folders for tracking HTTP sessions

• US 8,065,390 B2
• Filed: 12/28/2010
• Issued: 11/22/2011
• Est. Priority Date: 11/17/2004
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Cheng, Chunqing
• Primary Examiner(s): JEAN, FRANTZ B
• Application Number:
  US12/979,502
• Publication Number:
  US 20110093603A1
• Time in Patent Office: 329 Days
• Field of Search: 709/217, 709/223, 709/227, 709/228, 715/811, 725/109, 725/111
• US Class Current: 709/217
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066

Abstract

Requests from a client to a network device are authenticated based on a session ID obtained by the network device. Requests may be authenticated by obtaining a session ID value when a session is initiated and transmitting a document to the client that embeds the session ID in such a manner that additional requests to the network device based on the document include the session ID in the request. The additional requests are authenticated based on a determination of whether the session ID is included in the additional requests.

Claims

1. A method comprising:

receiving, by a network device, a request to initiate a session between the network device and a client device;

obtaining, by the network device and in response to receiving the request, a session identifier (ID), where the session ID uniquely identifies the session to the network device;

associating, by the network device, the session ID with a hyper-text markup language (HTML) page, where the HTML page enables the client device to manage the network device, and where associating the session ID with the HTML page causes the session ID to be returned to the network device with another request sent by the client device during the session;

transmitting, by the network device, the HTML page to the client device;

receiving, by the network device and during the session, the other request and at least one additional request from the client device; and

determining, by the network device, the other request to be associated with the session and the additional request not to be associated with the session based on the session ID.

2. The method of claim 1, where obtaining the session ID further comprises:

generating a plurality of random numbers; and

converting the generated plurality of random numbers into the session ID.

3. The method of claim 2, where converting the generated plurality of random numbers further comprises:

hashing the generated plurality of random numbers to obtain the session ID, where the session ID comprises a fixed length.

4. The method of claim 1, where obtaining the session ID further comprises:

selecting the session ID from a list of available session IDs.

5. The method of claim 1, where, prior to transmitting the HTML page, the method further comprises:

embedding a hidden field within a form of the HTML page to cause the session ID to be returned to network device with the other request.

6. The method of claim 1, where the HTML page includes a link that includes the session ID, and

where the identifying the other request includes:

extracting the session ID from the link.

7. The method of claim 1, where, the HTML page includes at least one HTML anchor, the method further comprises:

including, prior to transmitting the HTML page, the session ID, in the HTML page, as a query string associated with the at least one HTML anchor.

8. A network device comprising:

a communication interface to enable the network device to communicate with a client device via a network; and

a processor to;

receive, from the client device, a request for a session to manage the network device,

generate a session ID to uniquely identify the session to the network device,

transmit, to the client device, a user interface for managing the network device, where the user interface causes other requests based on the user interface to include the session ID, and

identify the other requests, from different requests received from the client device, as being associated with the session based on the other session ID being included in the other request.

9. The network device of claim 8, where the processor is further to:

receive, from the client device and during the session, a second request, the second request based on the user interface,

extract the session ID from the second request, and

identify the session based on the extracted session ID.

10. The network device of claim 9, where the processor is further to:

store the session ID in a table.

11. The network device of claim 10, where the processor is further to:

store source/destination information associated with the request in the table,

determine source/destination information associated with the second request,

compare the extracted session ID and the source/destination information associated with the second request to the session ID and source/destination information stored in the table, and

determine if the session is valid based on the comparison.

12. The network device of claim 9, where the processor is further to:

store data associated with the request in a table,

determine a value based on the stored data, and

determine if the session is valid based on receiving the second request within a predetermined period of time from receiving the request, where the predetermine period of time is based on the determined value.

13. The network device of claim 9, where the processor is further to:

store, when the session is determined to be valid, data associated with the second request in the table,

determine another value based on the stored data associated with the second request, and

determine, after storing the data, if the session continues to be valid based on receiving a third request within another predetermined period of time from receiving the second request, where the other predetermine period of time is based on the other determined value.

14. The network device of claim 12, where the processor is further to:

transmit, to the client device and when the session is determined not to be valid, another user interface.

15. A method comprising,

receiving, by a network device, a request to initiate an hyper-text transfer protocol (HTTP) management session for managing the network device;

generating, by the network device and in response to receiving the request, a session ID, where the session ID uniquely identifies the session to the network device;

concurrently hosting, by the network device, the HTTP management session and a plurality of other HTTP management sessions; and

distinguishing, by the network device, requests associated with the HTTP management session from requests associated with a plurality of other HTTP management sessions based on the session identifier (ID) appearing in the requests associated with the HTTP management sessions and based on the session ID not appearing in the requests associated with the plurality of other HTTP management sessions.

16. The method of claim 15, further comprising:

embedding the session ID in a document associated with the session;

transmitting the document to a client device; and

where the request and a plurality of other requests for initiating the plurality of other HTTP management session originate from the client device.

17. The method of claim 15, where the HTTP management session and the plurality of other HTTP management sessions are each associated with a single Internet Protocol (IP) address and a single login name.

18. The method of claim 15, where the method further comprises, prior to concurrently hosting the HTTP management session and a plurality of other HTTP management sessions:

associating the session ID with a hyper-text markup language (HTML) page, where the HTML page enables a user of a client device to manage the network device, and where associating the session ID with the HTML page causes the session ID to be returned to the network device with another request sent by the client device during the session; and

transmitting the HTML page to the client device.

19. The method of claim 18, where the method further comprises:

embedding, prior to transmitting the HTML page, a hidden field within a form of the HTML page to cause the session ID to be returned to network device with the other HTML page.

20. The method of claim 18, where, the HTML page includes at least one HTML anchor, and

where the method further comprises:

including, prior to transmitting the HTML page, the session ID, in the HTML page, as a query string associated with the at least one HTML anchor within the HTML page.