Method and apparatus for re-establishing communication between a client and a server

• US 8,234,694 B2
• Filed: 12/09/2005
• Issued: 07/31/2012
• Est. Priority Date: 12/09/2005
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Youn, Paul, Wong, Daniel ManHung
• Primary Examiner(s): ARMOUCHE, HADI S
• Application Number:
  US11/298,775
• Publication Number:
  US 20070136795A1
• Time in Patent Office: 2,426 Days
• Field of Search: 726/5, 713/150, 713/156, 713/171, 705/51
• US Class Current: 726/5
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords

Abstract

One embodiment of the present invention provides a system that re-establishes communication between a client and a server after an unexpected termination of communication. During operation, the system receives a request from the client at the server to re-establish communication between the client and the server, wherein the request includes a temporary credential. If the temporary credential is valid, the system temporarily re-establishes communication between the client and the server, until the client can be re-authenticated with a permanent credential.

Claims

1. A computer-implemented method for re-establishing communication between a client and a server after termination of communication, wherein the computer includes a processor, the method comprising:

establishing, at the server, initial communication with the client based on a permanent credential;

providing a temporary credential to the client, wherein the temporary credential;

cannot be used to establish initial communication with the client;

limits the client'"'"'s capability to access data on the server; and

includes an authentication-indicator indicating that the client was authenticated using the permanent credential;

detecting a termination of communication with the client; and

re-establishing communication between the client and the server, based on the temporary credential, received from the client.

2. The method of claim 1, further comprising initializing the server by:

creating an instance of a temporary credential profile from a temporary credential profile template, wherein the temporary credential profile provides instructions to the server to be executed in the event that the server receives the temporary credential from the client; and

configuring the instance of the temporary credential profile, wherein configuring the instance of the temporary credential profile involves specifying values for the fields of the temporary credential profile.

3. The method of claim 1, wherein the temporary credential includes:

a session key, wherein the session key is obtained from the server after the client is authenticated using a permanent credential.

9. The method of claim 1, further comprising configuring the server by:

generating the permanent credential, which is used to determine whether the client is authorized to establish communication with the server;

creating a temporary credential profile template; and

securing access to the permanent credential so that the permanent credential is restricted to a subset of users.

10. The method of claim 9, wherein the temporary credential profile template which includes one or more of:

a communication time-limit defining how long communication can last before requiring the client to use the permanent credential to authenticate with the server;

a usage time-limit defining how soon the temporary credential must be used after the unexpected termination of communication;

an expiration value defining how long a temporary credential profile is valid before a new temporary credential profile must be created;

an authentication-field defining what authentication-information must be provided by the client attempting to re-establish communication when using the temporary credential;

a format for an alert message alerting an administrator that the temporary credential has been used;

a format for an alert message alerting the administrator of the approaching communication time-limit;

a format for an alert message alerting the administrator of the impending expiration of an instance of the temporary credential profile; and

a capability limit for the client defining what capabilities are available to the client under the temporary credential.

11. The method of claim 10, wherein the authentication-field includes sub-fields which includes:

a user name;

a password;

a packet sequence number of the last packet received by the client from the server;

a packet sequence number of the last packet sent by the client to the server; and

an Internet Protocol address of the client.

12. The method of claim 9, wherein securing access to the permanent credential involves:

deleting the permanent credential;

supplying the permanent credential to a third-party authentication service;

encrypting the permanent credential; and

obfuscating the permanent credential.

13. The method of claim 9, wherein the temporary credential can only be used once and the permanent credential can be used more than once.

4. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for re-establishing communication between a client and a server after termination of communication, the method comprising:

establishing, at the server, initial communication with the client based on a permanent credential;

providing a temporary credential to the client, wherein the temporary credential;

cannot be used to establish initial communication with the client;

limits the client'"'"'s capability to access data on the server; and

includes an authentication-indicator indicating that the client was authenticated using the permanent credential;

detecting a termination of communication with the client; and

re-establishing communication between the client and the server, based on the temporary credential, received from the client.

5. The computer-readable storage medium of claim 4, further comprising initializing the server by:

creating an instance of a temporary credential profile from a temporary credential profile template, wherein the temporary credential profile provides instructions to the server to be executed in the event that the server receives the temporary credential from the client; and

configuring the instance of the temporary credential profile, wherein configuring the instance of the temporary credential profile involves specifying values for the fields of the temporary credential profile.

6. The computer-readable storage medium of claim 4, wherein the temporary credential includes:

a session key, wherein the session key is obtained from the server after the client is authenticated using a permanent credential.

14. The computer-readable storage medium of claim 4, further comprising configuring the server by:

generating the permanent credential, which is used to determine whether the client is authorized to establish communication with the server;

creating a temporary credential profile template; and

securing access to the permanent credential so that the permanent credential is restricted to a subset of users.

15. The computer-readable storage medium of claim 14, wherein the temporary credential profile template which includes one or more of:

a communication time-limit defining how long communication can last before requiring the client to use the permanent credential to authenticate with the server;

a usage time-limit defining how soon the temporary credential must be used after the unexpected termination of communication;

an expiration value defining how long a temporary credential profile is valid before a new temporary credential profile must be created;

an authentication-field defining what authentication-information must be provided by the client attempting to re-establish communication when using the temporary credential;

a format for an alert message alerting an administrator that the temporary credential has been used;

a format for an alert message alerting the administrator of the approaching communication time-limit;

a format for an alert message alerting the administrator of the impending expiration of an instance of the temporary credential profile; and

a capability limit for the client defining what capabilities are available to the client while the temporary credential is in use.

16. The computer-readable storage medium of claim 15, wherein the authentication-field includes sub-fields which includes:

a user name;

a password;

a packet sequence number of the last packet received by the client from the server;

a packet sequence number of the last packet sent by the client to the server; and

an Internet Protocol address of the client.

17. The computer-readable storage medium of claim 14, wherein securing access to the permanent credential involves:

deleting the permanent credential;

supplying the permanent credential to a third-party authentication service;

encrypting the permanent credential; and

obfuscating the permanent credential.

18. The computer-readable storage medium of claim 14, wherein the temporary credential can only be used once and the permanent credential can be used more than once.

7. An apparatus for re-establishing communication between a client and a server after termination of communication, comprising:

a processor;

a memory;

a communication-establishing mechanism configured to establish, at the server, initial communication with the client based on a permanent credential;

a credential-providing mechanism configured to provide a temporary credential to the client, wherein the temporary credential;

cannot be used to establish initial communication with the client;

limits the client'"'"'s capability to access data on the server; and

includes an authentication-indicator indicating that the client was authenticated using the permanent credential;

detecting a termination of communication with the client; and

a communication re-establishing mechanism configured to re-establish communication between the client and the server, based on the temporary credential, received from the client.

8. The apparatus of claim 7, further comprising a server initiation mechanism configured to initiate the server by:

creating an instance of a temporary credential profile from a temporary credential profile template, wherein the temporary credential profile provides instructions to the server to be executed in the event that the server receives the temporary credential from the client; and

configuring the instance of the temporary credential profile, wherein configuring the instance of the temporary credential profile involves specifying values for the fields of the temporary credential profile.

19. The apparatus of claim 7, further comprising a server configuration mechanism configured to configure the server by:

generating the permanent credential, which is used to determine whether the client is authorized to establish communication with the server;

creating a temporary credential profile template; and

securing access to the permanent credential so that the permanent credential is restricted to a subset of users.

20. The apparatus of claim 19, wherein the server configuration mechanism is further configured to secure access to the permanent credential by:

deleting the permanent credential;

supplying the permanent credential to a third-party authentication service;

encrypting the permanent credential; and

obfuscating the permanent credential.