GLOBAL UNIFIED SESSION IDENTIFIER ACROSS MULTIPLE DATA CENTERS

• US 20150089604A1
• Filed: 12/19/2013
• Published: 03/26/2015
• Est. Priority Date: 09/20/2013
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: MATHEW, Stephen, KOOTAYI, Vipin Anaparakkal, SUBRAMANYA, Ramya Kukkehali
• Granted Patent: US 9,544,293 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 65/1066 Session management
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70

Abstract

Systems and methods are disclosed for using a global unified session identifier across data centers. When a user first accesses a data center and an initial session is created for the user in the data center, a session identifier is generated for the user session. Because the initial session is the first session created for that user, the initial session identifier is designated as the global unified session identifier for all sessions that may be created for the user in other data centers within the enterprise network. Other data centers may then map the global unified session identifiers to locally generated session identifiers for the user. Using a global unified session identifier enables various user session actions to be performed globally across the data centers, including global logout, global session termination, global session updates, and/or the like. Using a global unified session identifier also prevents the risk of collision that can occur between randomly generated numbers of different data centers.

Claims

1. A method of using a global unified session identifier across data centers, the method comprising:

receiving, at a first data center, a request for a resource from a client device;

creating, by the first data center, a first session for a user of the client device at the first data center;

generating, using at least one processor operatively coupled with a memory at the first data center, a first session identifier identifying the first session;

receiving, at a first data center, a second session identifier from a second data center, the second session identifier identifying a second session of the user at the second data center; and

assigning, by the first data center, the second session identifier as the global unified session identifier, the global unified session identifier allowing one or more session actions to be applied globally to the first session and the second session.

2. The method of claim 1, further comprising:

mapping the first session identifier to the global unified session identifier.

3. The method of claim 1, wherein the one or more session actions include a session update, synchronization of sessions across data centers, or terminating a session of the user.

4. The method of claim 1, further comprising:

receiving, at the first data center, a request to log the user out of the first session;

terminating the first session of the user at the first data center in response to the request; and

transmit a message to one or more data centers, the message directing the one or more data centers to terminate all sessions of the user that are associated with the global unified session identifier.

5. The method of claim 4, wherein the request to log the user out of the first session is received from the user.

6. The method of claim 4, wherein the request to log the user out of the first session is received from an administrator.

7. The method of claim 1, further comprising:

prompting, from the first data center, the user for authentication credentials in response to receiving the request;

receiving, at the first data center, the authentication credentials from the user;

determining, at the first data center, that the authentication credentials are valid; and

granting the user with access to the resource.

8. A system of a first data center, comprising:

a memory storing a plurality of instructions; and

one or more processors configurable to;

receive a request for a resource from a client device;

create a first session for a user of the client device at the first data center;

generate a first session identifier identifying the first session;

receive a second session identifier from a second data center, the second session identifier identifying a second session of the user at the second data center; and

assign the second session identifier as a global unified session identifier, the global unified session identifier allowing one or more session actions to be applied globally to the first session and the second session.

9. The system of claim 9, wherein the one or more processors are further configurable to:

map the first session identifier to the global unified session identifier.

10. The system of claim 9, wherein the one or more session actions include a session update, synchronization of sessions across data centers, or terminating a session of the user.

11. The system of claim 9, wherein the one or more processors are further configurable to:

receive a request to log the user out of the first session;

terminate the first session of the user at the first data center in response to the request; and

transmit a message to one or more data centers, the message directing the one or more data centers to terminate all sessions of the user that are associated with the global unified session identifier.

12. The system of claim 11, wherein the request to log the user out of the first session is received from the user.

13. The system of claim 11, wherein the request to log the user out of the first session is received from an administrator.

14. The system of claim 9, wherein the one or more processors are further configurable to:

prompt the user for authentication credentials in response to receiving the request;

receive the authentication credentials from the user;

determine that the authentication credentials are valid; and

grant the user with access to the resource.

15. A computer-readable medium storing a plurality of instructions executable by one or more processors of a first data center, the plurality of instructions causing the one or more processors to:

receive a request for a resource from a client device;

create a first session for a user of the client device at the first data center;

generate a first session identifier identifying the first session;

receive a second session identifier from a second data center, the second session identifier identifying a second session of the user at the second data center; and

assign the second session identifier as a global unified session identifier, the global unified session identifier allowing one or more session actions to be applied globally to the first session and the second session.

16. The computer-readable medium of claim 15, wherein the one or more processors are further configurable to:

map the first session identifier to the global unified session identifier.

17. The computer-readable medium of claim 15, wherein the one or more session actions include a session update, synchronization of sessions across data centers, or terminating a session of the user.

18. The computer-readable medium of claim 15, wherein the one or more processors are further configurable to:

receive a request to log the user out of the first session;

terminate the first session of the user at the first data center in response to the request; and

transmit a message to one or more data centers, the message directing the one or more data centers to terminate all sessions of the user that are associated with the global unified session identifier.

19. The computer-readable medium of claim 19, wherein the request to log the user out of the first session is received from the user.

20. The computer-readable medium of claim 19, wherein the request to log the user out of the first session is received from an administrator.