Caching public objects with private connections

• US 8,091,124 B2
• Filed: 02/23/2007
• Issued: 01/03/2012
• Est. Priority Date: 02/23/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Almog, Itai, Shiran, Tomer
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): KANAAN, SIMON P
• Application Number:
  US11/710,335
• Publication Number:
  US 20080209524A1
• Time in Patent Office: 1,775 Days
• Field of Search: 726/2, 726/3, 726/4, 726/5, 726/26, 726/27, 726/28, 726/29, 726 11- 14
• US Class Current: 726/12
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

Described is a technology by which a web proxy server forwards a client request for content to a web server over an unauthenticated connection, including when the client already has an authenticated connection to that web server. If the web content is received in response, the content is public, whereby the web proxy server caches the content and returns the content to the client. If the requested content is not received because of a need for authentication, the content is re-requested over the client'"'"'s authenticated connection, or if one does not yet exist, returns the response to the client to complete the authentication process to establish an authenticated connection. A learning mechanism (e.g., that persists known private URLs) may be coupled to the selection mechanism to maintain references to objects that are private, and thereby avoid redundant retrieval attempts for known private objects over unauthenticated connections.

Claims

1. In a computing environment, a method comprising:

receiving at a web proxy server a request from a client for web content, in which the client has an existing authenticated connection to a web server that serves the content;

selecting to use an unauthenticated connection instead of the existing authenticated connection to determine whether the web content is private or public;

forwarding the request to the web server over the unauthenticated connection, and

1) if the web content is received in response to the request, determining that the web content is public, caching the content and returning the content to the client, or

2) if the requested content is not received because of a need for authentication, determining that the web content is private, re-requesting the web content over the existing authenticated connection, receiving the web content via the existing authenticated connection, and returning the content to the client without storing the content in a cache local to the web proxy, content stored in the cache local to the web proxy available for subsequent client requests.

2. The method of claim 1 wherein an authentication request is received in response to the request for web content to indicate the need for authentication.

3. The method of claim 1 further comprising, passing an authentication request from the web server to the client to complete an authentication process to establish the authenticated connection.

4. The method of claim 3 further comprising, at the web proxy server, marking the established connection between the client and the web server as authenticated including updating a data structure.

5. In a computing environment, a system comprising, a web proxy server configured to cache at least some public objects received from web servers, and to return a cached object in response to a client request when the object is cached and valid, and to otherwise forward the client request for the object to a web server, and a selection mechanism coupled to the web proxy server that forwards the client request for an object that may or may not be private via an unauthenticated connection even if an authenticated connection exits to determine based on the web server response whether the object is private or public in the absence of a specific cache directive, if the web server response does not include an authentication request, wherein the web server returns the requested object in response to the request via the unauthenticated connection, and wherein the web proxy server caches the object and returns the object to the client, and, if the web server response includes an authentication request, wherein the selection mechanism requests the object over the authenticated connection, the web proxy server receives the object and returns the object to the client without storing the object in a cache local to the web proxy, objects stored in the cache local to the web proxy available for subsequent client requests.

6. The system of claim 5 further comprising a data structure that indicates whether the client has an authenticated connection to the web server, and wherein the web proxy server accesses the data structure to determine whether the client has an already-existing authenticated connection to the web server.

7. The system of claim 5 wherein the web proxy server determines that the client does not have an already-existing authenticated connection to the web server, and wherein the selection mechanism returns the response indicating authentication is needed to the client to allow the client to complete the authentication process.

8. The system of claim 5 further comprising a learning mechanism coupled to the selection mechanism to establish that the requested object is known to be private.

9. The system of claim 8 wherein the learning mechanism maintains data corresponding to URLs.

10. A non-transitory computer-readable storage medium having computer-executable instructions, comprising:

receiving at a web proxy server a request from a client for web content;

determining whether the request is to be forwarded to a web server, and if so, selecting as a selected connection an unauthenticated connection or an authenticated connection for forwarding the request to the web server, and forwarding the request via the selected connection, wherein selecting comprises, selecting the unauthenticated connection as the selected connection when no prior attempt to request the content was made for this client and web page via an unauthenticated connection even if an authenticated connection exits;

receiving a response from the web server in response to the request, and

1) if the selected connection was an unauthenticated connection and web content is received in response to the request and is cacheable, caching the content and returning the content to the client;

or

2) if the selected connection was an unauthenticated connection and requested content is not received because of a need for authentication, determining whether the client has an authenticated connection to the web server, and if so, selecting the authenticated connection, re-requesting the web content over the authenticated connection, and returning the content to the client without storing the content in a cache local to the web proxy, or if not, allowing the client to complete the authentication process to establish an authenticated connection, content stored in the cache local to the web proxy available for subsequent client requests.

11. The non-transitory computer-readable storage medium of claim 10 wherein selecting as the selected connection comprises, determining whether the requested content is known to be private, and if so, determining whether an authenticated connection exists for this client, and if so, selecting the authenticated connection as the selected connection.

12. The non-transitory computer-readable storage medium of claim 10 wherein selecting comprises, determining whether the requested content is known to be private, and if not known, selecting the unauthenticated connection as the selected connection.

13. The non-transitory computer-readable storage medium of claim 10 wherein determining whether the request is to be forwarded to a web server comprises accessing cache data to determine whether the content is valid in a cache.

14. The non-transitory computer-readable storage medium of claim 10 wherein an authentication request is received in response to the request for web content to indicate the need for authentication, and wherein allowing the client to complete the authentication process comprises returning the authentication request to the client.

15. The non-transitory computer-readable storage medium of claim 14 wherein the client completes the authentication process, and further comprising, marking an established connection between the client and the web server as authenticated.