INFERRING SERVER STATE IN A STATELESS COMMUNICATION PROTOCOL

• US 20120017010A1
• Filed: 09/22/2011
• Published: 01/19/2012
• Est. Priority Date: 06/25/2004
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Teros, Inc. (Cloud Software Group)
• Inventors: Chauhan, Abhishek
• Granted Patent: US 8,521,909 B2
• Time in Patent Office: Days
• US Class Current: 709/247
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/142 Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms

Abstract

Server state objects are identified by an intermediate server among packets transmitted between an application server and a client device on a network based upon a stateless communication protocol, by monitoring and analyzing the packets transmitted between the application server and the client device. The packets are parsed into a plurality of name-value pairs. The entropy of the name-value pairs having a same name field is computed, and candidate data objects that are likely to be server state objects are selected based upon the computed entropy. Candidate data objects that were transmitted bi-directionally between the application server and the client device are identified as server state objects.

Claims

1. A method for identifying server state objects among packets transmitted between a server and a client device on a network based upon a communication protocol, the method comprising:

computing entropy measures for a plurality of data objects in the packets;

selecting candidate data objects from the plurality of data objects according to their entropy measures; and

identifying at least one of the candidate data objects as a server state object in response to the at least one candidate data object being transmitted bi-directionally between the server and the client device.

2. The method of claim 1, wherein computing entropy measures comprises:

compressing the data objects; and

computing the entropy measures of the compressed data objects.

3. The method of claim 2, wherein compressing the data objects comprises:

concatenating the data objects having a same name field; and

compressing the concatenated data objects using a compression algorithm.

4. The method of claim 3, wherein the compression algorithm is an entropy-2 based compression algorithm.

5. The method of claim 3, wherein computing the entropy measures of the compressed data objects comprises dividing a total size of value fields of the compressed concatenated data objects by a total number of data objects having the same name field.

6. The method of claim 1, wherein the at least one candidate data object is determined to have been transmitted bi-directionally between the server and the client device by:

dividing related packets under the communication protocol into a first group of packets that were transmitted from the server to the client device and a second group of packets that were transmitted from the client device to the server; and

determining whether the at least one candidate data object is included in both the first group of packets and the second group of packets.

7. The method of claim 6, wherein the related packets are packets that correspond to a related message under the communication protocol.

8. A method for identifying server state objects among packets transmitted between a server and a client device on a network based upon a communication protocol, the method comprising:

parsing the packets into a plurality of name-value pairs;

computing the entropies of the name-value pairs having a same name;

selecting the name-value pairs having entropies higher than a threshold as candidates for the server state objects;

determining whether the candidates were sent bi-directionally between the server and the client device; and

determining that at least one of the candidates is a server state object in response to determining that the at least one candidate was sent bi-directionally between the server and the client device.

9. The method of claim 8, wherein computing the entropies of the name-value pairs having a same name comprises:

compressing the name-value pairs having the same name; and

computing the entropies of the compressed name-value pairs.

10. The method of claim 9, wherein compressing the name-value pairs having the same name comprises:

concatenating the value fields of the name-value pairs having the same name; and

compressing the concatenated value fields of the name-value pairs using a compression algorithm.

11. The method of claim 10, wherein the compression algorithm is an entropy-based compression algorithm.

12. The method of claim 10, wherein computing the entropies of the compressed name-value pairs comprises dividing a total size of the compressed concatenated value fields of the name-value pairs by a total number of the name-value pairs having the same name.

13. The method of claim 8, wherein determining whether the candidates were sent bi-directionally between the server and the client device comprises:

dividing related packets under the communication protocol into a first group of packets that were transmitted from the server to the client device and a second group of packets that were transmitted from the client device to the server; and

determining whether the candidates are included in both the first group of packets and the second group of packets.

14. The method of claim 13, wherein the related packets are packets that correspond to a related message under the communication protocol.

15. A system for identifying server state objects among packets transmitted between a server and a client device on a network based upon a communication protocol, the system comprising:

a parsing module coupled between the server and the client device for parsing the packets transmitted between into a plurality of data objects; and

an analysis module coupled to the parsing module for receiving the data objects and determining whether the name-value pairs are server state objects by;

computing entropy measures of the data objects;

selecting candidate data objects from the data objects according to their entropy measures; and

identifying at least one of the candidate data objects as a server state object in response to the at least one candidate data object being transmitted bi-directionally between the server and the client device.

16. The system of claim 15, wherein the parsing module operates as a firewall filtering the packets transmitted between the server and the client device in accordance with rules provided by the analysis module.

17. The system of claim 15, wherein the parsing module collects data regarding the packets transmitted between the server and the client device in accordance with data collection parameters provided by the analysis module.

18. The system of claim 15, wherein the analysis module processes the data objects to determine whether the data objects are server state objects in real time as the data objects are received from the parsing module.

19. The system of claim 15, further comprising a storage module coupled to the analysis module, the analysis module storing the received data objects in the storage module and processing the stored data objects in batches to determine whether the data objects are server state objects.

20. The system of claim 15, wherein the analysis module computes the entropy measures of the data objects by:

compressing the data objects; and

computing the entropy measures of the compressed data objects.

21-48. -48. (canceled)