Atomic session-start operation combining clear-text and encrypted sessions to provide ID visibility to middleware such as load-balancers

• US 20070094373A1
• Filed: 08/31/2006
• Published: 04/26/2007
• Est. Priority Date: 09/01/1999
• Status: Active Grant

• Current Assignee: Hanger Solutions, LLC (IP Investments Group LLC)
• Original Assignee: Resonate (AEG Holdings, Inc.)
• Inventors: Brendel, Juergen
• Granted Patent: US 7,900,040 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/1012 based on compliance of requirements or conditions with available server resources
• CPC Class Codes: H04L 67/1027 Persistence of sessions during load balancing
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A load-balancer assigns incoming requests to servers at a server farm. An atomic operation assigns both un-encrypted clear-text requests and encrypted requests from a client to the same server at the server farm. An encrypted session is started early by the atomic operation, before encryption is required. The atomic operation is initiated by a special, automatically loaded component on a web page. This component is referenced by code requiring that an encrypted session be used to retrieve the component. Keys and certificates are exchanged between a server and the client to establish the encrypted session. The server generates a secure-sockets-layer (SSL) session ID for the encrypted session. The server also generates a server-assignment cookie that identifies the server at the server farm. The server-assignment cookie is encrypted and sent to the client along with the SSL session ID. The Client decrypts the server-assignment cookie and stores it along with the SSL session ID. The load-balancer stores the SSL session ID along with a server assignment that identifies the server that generated the SSL session ID. When other encrypted requests are generated by the client to the server farm, they include the SSL session ID. The load-balancer uses the SSL session ID to send the requests to the assigned server. When the client sends a non-encrypted clear-text request to the server farm, it includes the decrypted server-assignment cookie. The load balancer parses the clear-text request to find the server-assignment cookie. The load-balancer then sends the request to the assigned server.

Claims

1-20. -20. (canceled)

21. A method of assigning servers of a server farm to service requests from clients for encrypted content and non-encrypted content, the method comprising:

establishing a first encrypted session between a server of a plurality of servers and a client before a second encrypted connection is required;

obtaining an encrypted session identification and a server assignment derived from the first encrypted session in response to receiving a request for the second encrypted session from the client; and

assigning the server to service encrypted and non-encrypted content to the client according to the server assignment.

22. The method of claim 21, wherein establishing the encrypted session comprises sending an encrypted web page component from the server farm to the client to invoke the encrypted session.

23. The method of claim 21, further comprising suppressing an encrypted session warning by the client when the first encrypted session is started.

24. The method of claim 21, wherein establishing the first encrypted session comprises providing an encryption component to the client that is an image file portion of a web page.

25. The method of claim 21, wherein establishing the first encrypted session comprises transmitting the encrypted session identification in non-encrypted form and the server assignment in encrypted form to the client.

26. The method of claim 21, wherein the server assignment is stored in a cookie provided to the client.

27. The method of claim 21, wherein assigning comprises determining the assigned server using a load balancer.

28. A system for assigning a server to server both encrypted data and non-encrypted data to a client, the system comprising:

at least one processor;

a computer readable storage medium coupled to the processor, wherein the computer readable storage medium includes instructions stored therein for directing the processor to assign a server to respond to a client'"'"'s request for both encrypted data and non-encrypted data, the instructions comprising;

code for establishing between a server that is part of a plurality of servers and a client, a first encrypted session before a second encrypted connection is requested by the client;

code for obtaining an encrypted session identification and a server assignment derived from the first encrypted session in response to receiving a request for the second encrypted session from the client; and

code for assigning the server to service encrypted and non-encrypted content requests from the client according to the server assignment.

29. The system of claim 28, wherein code for establishing the encrypted session comprises code for sending an encrypted web page component from the server farm to the client to invoke the encrypted session.

30. The system of claim 28, further comprising code for suppressing an encrypted session warning by the client during the establishment of the first encrypted session.

31. The system of claim 28, wherein code for establishing the first encrypted session comprises code for providing an encryption component to the client that is an image file portion of a web page.

32. The system of claim 28, wherein code for establishing the first encrypted session comprises transmitting the encrypted session identification in non-encrypted form and the server assignment in encrypted form to the client.

33. The system of claim 28, wherein the server assignment is stored in a cookie provided to the client.

34. The system of claim 28, wherein code for assigning comprises code for determining the assigned server as part of a load balancing process.

35. A method for receiving encrypted and non-encrypted data at a client from one server which is part of a server farm, the method comprising:

storing at a client, an encrypted-session identifier and encrypted server assignment pertaining to a server assigned to provide both non-encrypted data and encrypted data to the client;

when requesting non-encrypted data from the server farm, transmitting a decrypted version of the encrypted server assignment to the server farm as part of the request for non-encrypted data from the assigned server; and

when requesting encrypted data from the server farm, transmitting encrypted-session identifier to the server farm as part of the request for encrypted data from the assigned server.

36. The method of claim 35, wherein storing comprises decrypting the encrypted server assignment at the client to determine the assigned server.

37. The method of claim 35, further comprising prior to storing receiving an encrypted object used to establish the encrypted-session identifier.

38. The method of claim 35, further comprising prior to storing receiving a cookie comprising the encrypted server assignment.

39. The method of claim 35, prior to storing establishing a first encrypted session with the server farm.

40. The method of claim 35, prior to storing requesting a webpage containing an encrypted object associated with the encrypted-session identifier and the encrypted server assignment.

41. The method of claim 35, wherein transmitting the encrypted-session identifier to the server farm comprises transmitting the encrypted-session identifier in clear-text form.