Method and apparatus for recovering sessions

• US 8,793,494 B2
• Filed: 09/07/2010
• Issued: 07/29/2014
• Est. Priority Date: 03/04/2008
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: Shen, Shuo
• Primary Examiner(s): Williams, Jeffery
• Assistant Examiner(s): Harris, Christopher C
• Application Number:
  US12/876,855
• Publication Number:
  US 20100332836A1
• Time in Patent Office: 1,421 Days
• Field of Search: 713/150, 713/171
• US Class Current: 713/171
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066

Abstract

A method for recovering sessions includes storing, by a client, session information after a session is established between the server and the client. When the session needs to be recovered upon interruption, the client sends all state information before interruption of the session and the session information to the server, and the server recovers the session upon the received session information and all state information before interruption of the session. After a session is interrupted, the server does not need to store any session-related information, thus saving the resources of the server, and all information about the previous session can be recovered completely.

Claims

1. A method for recovering a secure shell (SSH) session upon interruption of the SSH session, the method, comprising:

sending, by a client, all state information before the interruption of the SSH session and session information of the session to a server, wherein all the state information comprises a completion ratio of data transmission, wherein the SSH session comprises a plurality of channels and wherein the session information includes information for one or more of the respective plurality of channels; and

recovering, by the server, the SSH session upon the session information and all the state information before the interruption of the SSH session;

wherein before the SSH session is interrupted, the method further comprises;

receiving, by the client, a first key encrypted and the session information encrypted from the server after the SSH session is established between the server and the client, wherein the first key is shared by the client and the server, and the first key and the session information are encrypted through a local key of the server; and

storing, by the client, the encrypted first key and the encrypted session information;

wherein the step of the client sending all state information before interruption of the SSH session to the server when the SSH session needs to be recovered upon interruption comprises;

encrypting, by the client, all the state information before the interruption of the SSH session with the first key, and

sending, by the client, the encrypted state information, the encrypted first key, and the encrypted session information received from the server, to the server.

2. The method according to claim 1, wherein the first key is a session key or a traffic encryption (TE) key.

3. The method according to claim 1, further comprising:

receiving, by the client, a user identity (ID), address information, authentication information, session-related information, or security-related information, or any combination thereof, from the server after the session is established between the server and the client.

4. The method according to claim 3, wherein:

the security-related information comprises a validity period, a number of valid use times, or a timestamp of the first key, or any combination thereof.

5. The method according to claim 1, wherein:

the client further receives a validity period of a packet A, a timestamp of delivering the packet A, a user identity (ID) of the client who obtains the packet A, a SSH session ID, or authorization information of the client, or any combination thereof, from the server.

6. The method according to claim 5, wherein:

the client further sends a timestamp of requesting to recover the session, the user ID of the client, an Internet Protocol (IP) address, the SSH session ID, or session services being requested to be recovered, or any combination thereof, to the server.

7. A method for recovering a secure shell (SSH) session upon interruption of the SSH session, the method, comprising:

sending, by a client, all state information before the interruption of the SSH session and session information of the SSH session to a server, wherein all the state information comprises a completion ratio of data transmission, wherein the SSH session comprises a plurality of channels and wherein the session information includes information for one or more of the respective plurality of channels; and

recovering, by the server, the SSH session upon the session information and all the state information before the interruption of the SSH session;

wherein the step of the client sending all state information before interruption of the SSH session to the server when the SSH session needs to be recovered upon interruption comprises;

encrypting, by the client, all state information before interruption of the SSH session with a first key shared with the server, and sending the encrypted state information to the server.

8. The method according to claim 7, wherein the first key is a session key or a traffic encryption (TE) key.

9. The method according to claim 7, further comprising:

receiving, by the client, a user identity (ID), address information, authentication information, session-related information, or security-related information, or any combination thereof, from the server after the session is established between the server and the client.

10. A method for recovering a secure shell (SSH) session, the method comprising:

encrypting, by a server, session information of a client to generate first encrypted information through a local key when the Secure Shell (SSH) session is established between the server and the client, wherein the first encrypted information comprises the session information and a first key shared between the client and the server, wherein the SSH session comprises a plurality of channels and wherein the session information includes information for one or more of the respective plurality of channels;

sending, by the server, the first encrypted information to the client;

receiving, by the server, the first encrypted information and second encrypted information sent by the client when the SSH session needs to be recovered upon SSH interruption, the second encrypted information is generated, by the client, through encrypting all state information before the interruption of the SSH session with the first key, wherein all the state information comprises a completion ratio of data transmission;

decrypting, by the server, the first encrypted information with the local key to obtain the first key and the session information; and

decrypting, by the server, the second encrypted information with the first key to obtain the state information before the interruption of the SSH session and recover the SSH session.

11. The method according to claim 10, wherein:

the first encrypted information further comprises a user identity (ID), address information, authentication information, session-related information, or security-related information, or any combination thereof.

12. The method according to claim 11, wherein:

the security-related information comprises a validity period, a number of valid use times, or a timestamp of the first key, or any combination thereof.

13. The method according to claim 10, wherein:

the first encrypted information further comprises a validity period of a packet A, a timestamp of delivering the packet A, a user identity (ID) of the client who obtains the packet A, a SSH session ID, or authorization information of the client, or any combination thereof.

14. The method according to claim 13, wherein:

the second encrypted information further comprises a timestamp of requesting to recover the SSH session, the user ID of the client, an Internet Protocol (IP) address, the SSH session ID, or session services being requested to be recovered, or any combination thereof.

15. The method according to claim 10, wherein:

the first key is a session key or a traffic encryption (TE) key.

16. A non-transitory computer-readable storage medium containing a program, the program comprising instructions that when executed by a processor cause:

a first encrypting unit to encrypt session information of a Secure Shell (SSH) session with a first key to generate first encrypted information when the SSH session is established between an apparatus and a client, wherein the first encrypted information comprises a second key shared by the apparatus and the client, the first key is privately owned by the apparatus, and the client is unaware of the first key, wherein the SSH session comprises a plurality of channels and wherein the session information includes information for one or more of the respective plurality of channels;

a first sending unit to send the first encrypted information to the client;

a first receiving unit to receive second encrypted information and the first encrypted information when the SSH session between the apparatus and the client needs to be recovered upon SSH interruption, wherein the second encrypted information is generated by encrypting all state information before interruption of the SSH session with the second key, wherein all the state information comprises a completion ratio of data transmission;

a first decrypting unit to decrypt the first encrypted information received by the first receiving unit through the first key and obtain the second key; and

a second decrypting unit to decrypt the second encrypted information with the second key to obtain all state information before interruption of the SSH session and recover the SSH session.

17. The non-transitory computer-readable storage medium of claim 16, wherein:

the first key is a session key or a traffic encryption (TE) key, and the second key is a session key or a TE key.