Distributed database system with authoritative node

• US 6,442,608 B1
• Filed: 01/14/1999
• Issued: 08/27/2002
• Est. Priority Date: 01/14/1999
• Status: Expired due to Term

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Patil, Kavita Shekhar, Roden, Thomas Anthony, Knight, John, Bui, Sonny, Shively, Darrell Myers II, Chen, Pauline
• Primary Examiner(s): Le, N.
• Assistant Examiner(s): Benson, Walter
• Application Number:
  US09/231,929
• Time in Patent Office: 1,321 Days
• Field of Search: 709/203, 709/224, 709/225, 709/229, 709/223, 709/227, 713/200, 713/201, 713/202, 717/11
• US Class Current: 709/225
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

An authorizing apparatus for use with a client that connects to a first server in a network is described. The authorizing apparatus includes a second server that authorizes session requests of the client for the first server. A plurality of records of resource allocation data is coupled with the second server. Each record indicates whether a session may be established between the client and the first server. Coupled to the second server is information that associates an entity that includes and is associated with one or more clients, and information that associates the second server to a third server that is authoritative for the second server and the associated clients. Means are provided for receiving a request to establish a session between the client and the first server and for determining, at the second server, based on one of the records that is associated with the client, whether the session may be established when the client is associated with the entity. Also provided are means for informing the first server that the session is authorized only when the second server determines from the one of the records that the session may be established. Although the first, second and third servers have been described as separate servers the functions performed by two or more of the servers may actually be combined in a single server unit.

Claims

1. A method of authorizing a session between a client and a first server, the method comprising the computer-implemented steps of:

(A) storing, in the first server, data that identifies a second server as a distributed authorization server for authorizing session requests for the first server;

(B) storing, in the second server, distributed resource allocation data that indicates whether said second server may locally authorize a session to be established for a particular entity between the client and the first server;

(C) storing, at the second server, data that identifies a third server that has been designated as a global authorization server for globally authorizing sessions for said particular entity;

(D) in response to receiving a request to establish a session between the client and the first server for said particular entity, performing the steps of,

(E) determining, at the second server based on said distributed resource allocation data whether the session for said particular entity may be established between the client and said first server;

(F) if said second server determines that said session cannot be authorized based on said distributed resource allocation data, said second server communicating with said third server to determine whether said third server may authorize said session for said particular entity to be established between said client and said first server; and

(G) informing the first server that the session is authorized only when the second server determines that the session may be established for said particular entity.

2. The method recited in claim 1, wherein step (B) includes the steps of storing, at the second server, a local session threshold value that identifies a maximum number of sessions that may be locally authorized for said particular entity.

3. The method recited in claim 2, wherein step (B) comprises the steps of storing, at the second server, a local session counter that identifies a current number of sessions that are established with the first server for said particular entity.

4. The method recited in claim 1, wherein the first server is a network access server, and wherein step (A) comprises the steps of storing, at the network access server, a reference to a local distributed session counter that stores a local session threshold value that identifies a maximum number of sessions that may be locally authorized for said particular entity, and a local session counter that identifies a current number of sessions that are currently established by the first server for said particular entity.

5. The method recited in claim 1, further including the steps of associating with said third server as global session authorization information, a global session threshold value that identifies a maximum number of sessions that may be authorized for said particular entity, and a global session counter that identifies a total number of sessions that are currently established by all servers for said particular entity.

6. The method recited in claim 1, wherein the second server and the third server are the same server.

7. The method recited in claim 1, wherein the first server and the second server are the same server.

8. An authorizing apparatus for use with a client that connects to a first server in a network, comprising:

said first server storing data that identifies a second server as a distributed authorization server for authorizing session requests for said first server;

the second server storing,

distributed resource allocation data that indicates whether said second server may locally authorize a session to be established for a particular entity between the client and the first server; and

data that identifies a third server that has been designated as a global authorization server for globally authorizing sessions for said particular entity;

means for receiving a request to establish a session between the client and the first server for said particular entity;

means for determining, at the second server based on said distributed resource allocation data whether the session for said particular entity may be established between the client and said first server;

means for, if said second server determines that said session cannot be authorized based on said distributed resource allocation data, said second server communicating with said third server to determine whether said third server may authorize said session for said particular entity to be established between said client and said first server; and

means for informing the first server that the session is authorized only when the second server determines that the session may be established for said particular entity.

9. The apparatus recited in claim 8, further comprising means for storing a local session threshold value at the second server that identifies a maximum number of sessions that may be locally authorized for said particular entity.

10. The apparatus recited in claim 9, further comprising means for storing a local session counter at the second server, wherein the local session counter identifies a current number of sessions that are established with the first server for said particular entity.

11. The apparatus recited in claim 8, wherein the first server is a network access server, and further comprising means for, storing at the network access server, a reference to a local distributed session counter that stores a local session threshold value that identifies a maximum number of sessions that may be locally authorized for said particular entity, and a local session counter that identifies a current number of sessions that are currently established by the first server for said particular entity.

12. The apparatus recited in claim 8, further comprising means for associating with said third server as global session authorization information, a global session threshold value that identifies a maximum number of sessions that may be authorized for said particular entity, and a global session counter that identifies a total number of sessions that are currently established by all servers for said particular entity.

13. The apparatus recited in claim 8, wherein the second server and the third server are the same server.

14. The apparatus recited in claim 8, wherein the first server and the second server are the same server.

15. A computer-readable medium carrying one or more sequences of instructions for authorizing a session between a client and a first server, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of:

(A) storing, in the first server, data that identifies a second server as a distributed authorization server for authorizing session requests for the first server;

(B) storing, in the second server, distributed resource allocation data that indicates whether said second server may locally authorize a session to be established for a particular entity between the client and the first server;

(C) storing, at the second server, data that identifies a third server that has been designated as a global authorization server for globally authorizing sessions for said particular entity;

(D) in response to receiving a request to establish a session between the client and the first server for said particular entity, performing the steps of,

(E) determining, at the second server based on said distributed resource allocation data whether the session for said particular entity may be established between the client and said first server;

(F) if said second server determines that said session cannot be authorized based on said distributed resource allocation data, said second server communicating with said third server to determine whether said third server may authorize said session for said particular entity to be established between said client and said first server; and

(G) informing the first server that the session is authorized only when the second server determines that the session may be established for said particular entity.

16. The computer-readable medium recited in claim 15, wherein step (B) includes the steps of storing, at the second server, a local session threshold value that identifies a maximum number of sessions that may be locally authorized for said particular entity.

17. The computer-readable medium recited in claim 16, wherein step (B) comprises the steps of storing, at the second server, a local session counter that identifies a current number of sessions that are established with the first server for said particular entity.

18. The computer-readable medium recited in claim 15, wherein the first server is a network access server, and wherein step (A) comprises the steps of storing, at the network access server, a reference to a local distributed session counter that stores a local session threshold value that identifies a maximum number of sessions that may be locally authorized for said particular entity, and a local session counter that identifies a current number of sessions that are currently established by the first server for said particular entity.

19. The computer-readable medium recited in claim 15, further comprising instructions for performing the steps of associating with said third server as global session authorization information, a global session threshold value that identifies a maximum number of sessions that may be authorized for said particular entity, and a global session counter that identifies a total number of sessions that are currently established by all servers for said particular entity.

20. A method of authorizing session requests between a client and a first server, the method comprising the computer-implemented steps of:

receiving, at a distributed session counter, a first request message, wherein said first request message requests authorization for establishing a session between the client and the first server for a particular entity;

in response to receiving said first request message, said distributed session counter determining, based on locally stored resource allocation data, whether said distributed session counter may locally authorize said session to be established between said client and said first server for said particular entity;

if said distributed session counter determines that said session may be locally authorized by said distributed session counter, said distributed session counter transmitting a first authorization message to said first server that authorizes the establishment of said session between said client and said first server for said particular entity;

if said distributed session counter determines that said session may not be locally authorized by said distributed session counter, said distributed session counter transmitting a second request message to a global session counter that requests authorization to authorize the establishment of said session for said particular entity, wherein said global session counter is associated with global resource allocation data that identifies the total number of sessions that are currently established for said particular entity;

in response to receiving said second request message, said global session counter determining, based on said global resource allocation data, whether said global session counter should authorize said session to be established between said client and said first server for said particular entity;

if said global session counter determines that said session should be authorized, said global session counter transmitting a second authorization message to said distributed session counter, wherein said second authorization message authorizes said distributed session counter to authorize the establishment of said session between said client and said first server for said particular entity; and

if said global session counter determines that said session should not be authorized, said global session counter transmitting a non-authorization message to said distributed session counter, wherein said non-authorization message indicates that said distributed session counter is not authorized to authorize the establishment of said session between said client and said first server for said particular entity.