Global unified session identifier across multiple data centers

• US 9,544,293 B2
• Filed: 12/19/2013
• Issued: 01/10/2017
• Est. Priority Date: 09/20/2013
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Kootayi, Vipin Anaparakkal, Mathew, Stephen, Subramanya, Ramya Kukkehali
• Primary Examiner(s): Mehedi, Morshed
• Assistant Examiner(s): Naghdali, Khalil
• Application Number:
  US14/135,053
• Publication Number:
  US 20150089604A1
• Time in Patent Office: 1,118 Days
• Field of Search: 726/4, 726/5
• US Class Current: 1/1
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 65/1066 Session management
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70

Abstract

Systems and methods are disclosed for using a global unified session identifier across data centers. When a user first accesses a data center and an initial session is created for the user in the data center, a session identifier is generated for the user session. Because the initial session is the first session created for that user, the initial session identifier is designated as the global unified session identifier for all sessions that may be created for the user in other data centers within the enterprise network. Other data centers may then map the global unified session identifiers to locally generated session identifiers for the user. Using a global unified session identifier enables various user session actions to be performed globally across the data centers, including global logout, global session termination, global session updates, and/or the like. Using a global unified session identifier also prevents the risk of collision that can occur between randomly generated numbers of different data centers.

Claims

1. A method of organizing sessions using a global session identifier across a plurality of data centers, the method comprising:

receiving, at a first data center, a request for a resource from a client device;

creating, by a computer system of the first data center, a first session associated with a user of the client device at the first data center, the first session comprising at least an authentication state of the first user with respect to the resource;

generating, by the computer system of the first data center, a first session identifier identifying the first session associated with the user;

receiving, by the computer system of the first data center, a second session identifier from a second data center, the second session identifier identifying a second session associated with the user at the second data center, the second session comprising at least an authentication state of the user with respect to one or more resources associated with the second data center, wherein the second data center is different from the first data center;

in response to receiving the second session identifier from the second data center, assigning, by the computer system of the first data center, the second session identifier as a global session identifier, the global session identifier being associated with any session that is associated with the user, wherein execution of one or more session actions that reference the global session identifier is performed at the first data center to the first session and at the second data center to the second session; and

based on assigning the second session identifier as the global session identifier, mapping the first session identifier to the global session identifier to associate the first session with the global session identifier.

2. The method of claim 1, wherein the one or more session actions include a session update, synchronization of sessions associated with the user across data centers, or terminating a session associated with the user.

3. The method of claim 1, further comprising:

receiving, at the first data center, a request to end the first session;

terminating, by the computer system of the first data center, the first session associated with the user at the first data center in response to the request to end the first session; and

in response to request to end the first session, transmitting, by the computer system, a message to one or more data centers, the message directing the one or more data centers to terminate all sessions of that are associated with the user based on the global session identifier.

4. The method of claim 3, wherein the request to end the first session is by the user.

5. The method of claim 3, wherein the request to end the first session is by an administrator who is different from the user.

6. The method of claim 1, further comprising:

prompting, from the first data center, the user to provide authentication credential information in response to receiving the request for the resource;

receiving, at the first data center, the authentication credential information provided by the user;

determining, by the computer system of the first data center, authentication of the user based on the authentication credential information; and

granting the user with access to the resource based on the determined authentication of the user.

18. The method of claim 1, further comprising:

identifying, by the computer system of the first data center, a first session action to perform on the first session for the user, wherein the first session action references the global session identifier;

identifying, by the computer system, the second data center having the second session that is associated with the user based on the global session identifier referenced by the first session action; and

responsive to identifying the second data center based on the global session identifier, sending, by the computer system, to the second data center, a request to perform the first session action to the second session associated with the user.

19. The method of claim 1, wherein the first session further comprises first session activity related to the first session, and wherein the second session further comprises second session activity related to the second session.

20. The method of claim 1, wherein the first session further comprises first client device information about the client device used by the user for the first session, and wherein the second session further comprises second client device information about the client device used by the user for the second session.

7. A system of a first data center, comprising:

a memory storing a plurality of instructions; and

one or more processors that, upon executing the plurality of instructions, are configured to;

receive a request for a resource from a client device;

create a first session associated with a user of the client device at the first data center, the first session comprising at least an authentication state of the user with respect to the resource;

generate a first session identifier identifying the first session associated with the user;

receive a second session identifier from a second data center, the second session identifier identifying a second session associated with the user at the second data center, the second session comprising at least an authentication state of the user with respect to one or more resources associated with the second data center, wherein the second data center is different from the first data center; and

in response to receiving the second session identifier from the second data center, assign the second session identifier as a global session identifier, the global session identifier being associated with any session that is associated with the user, wherein execution of one or more session actions that reference the global session identifier is performed at the first data center to the first session and at the second data center to the second session.

8. The system of claim 7, wherein upon executing the plurality of instructions, the one or more processors are further configured to:

based on assigning the second session identifier as the global session identifier, map the first session identifier to the global session identifier to associate the first session with the global session identifier.

9. The system of claim 7, wherein the one or more session actions include a session update, synchronization of sessions associated with the user across data centers, or terminating a session associated with the user.

10. The system of claim 7, wherein upon executing the plurality of instructions, the one or more processors are further configured to:

receive a request to end the first session;

terminate the first session associated with the user at the first data center in response to the request to end the first session; and

in response to request to end the first session, transmitting a message to one or more data centers, the message directing the one or more data centers to terminate all sessions that are associated with the user based on the global session identifier.

11. The system of claim 10, wherein the request to end the first session is by the user.

12. The system of claim 10, wherein the request to end the first session is by an administrator who is different from the user.

13. The system of claim 7, wherein upon executing the plurality of instructions, the one or more processors are further configured to:

prompt the user to provide authentication credential information in response to receiving the request for the resource;

receive the authentication credential information provided by the user;

determine authentication of the user based on the authentication credential information; and

grant the user with access to the resource based on the determined authentication of the user.

14. A non-transitory computer-readable medium storing a plurality of instructions executable by one or more processors of a first data center to cause the one or more processors to:

receive a request for a resource from a client device;

create a first session associated with a user of the client device at the first data center, the first session comprising at least an authentication state of the user with respect to the resource;

generate a first session identifier identifying the first session associated with the user;

receive a second session identifier from a second data center, the second session identifier identifying a second session of the user at the second data center, the second session comprising at least an authentication state of the user with respect to one or more resources associated with the second data center, wherein the second data center is different from the first data center; and

in response to receiving the second session identifier from the second data center, assign the second session identifier as a global session identifier, the global session identifier being associated with any session that is associated with the user, wherein execution of one or more session actions that reference the global session identifier is performed at the first data center to the first session and at the second data center to the second session.

15. The non-transitory computer-readable medium of claim 14, wherein the plurality of instructions are executable to further cause the one or more processors:

based on assigning the second session identifier as the global session identifier, map the first session identifier to the global session identifier to associate the first session with the global session identifier.

16. The non-transitory computer-readable medium of claim 14, wherein the one or more session actions include a session update, synchronization of sessions associated with the user across data centers, or terminating a session ef associated with the user.

17. The non-transitory computer-readable medium of claim 14, wherein the plurality of instructions are executable to further cause the one or more processors:

receive a request to end the first session;

terminate the first session associated with the user at the first data center in response to the request to end the first session; and

in response to request to end the first session, transmitting a message to one or more data centers, the message directing the one or more data centers to terminate all sessions that are associated with the user based on the global session identifier.