Back to results
US 10,097,532 B2Granted
Session management technique
AssigneeInternational Business Machines Corporation
InventorsKuniaki Kawabata, Kohsuke Okamoto
Life of this patent
Estimating the term…
Loading patent…
Loading patent…
AssigneeInternational Business Machines Corporation
InventorsKuniaki Kawabata, Kohsuke Okamoto
Estimating the term…
A system for managing sessions between a client and multiple servers includes: a receiver for receiving, as a proxy for each of the servers, a request from the client to any of the servers; a determination unit for determining, upon receipt of the request from the client to any of the servers, whether sessions established between the client and the multiple servers are maintained; a disconnection unit for disconnecting, on condition that a session between the client and any of the multiple servers is already disconnected, the sessions established between the client and the servers different from the disconnected server; and a forward unit for forwarding, on condition that the sessions established between the client and all of the multiple servers are maintained, the received request to the destination server for the request.
A method for managing client-server communications, the method comprising computer-executed actions of:
A non-transitory computer-readable media embodying a program executable by at least one processor unit of a computer for causing the computer to function as a system for managing communications between a common client apparatus and a plurality of server apparatuses, the common client apparatus and the plurality of server apparatuses being separate from said computer, the program causing the computer to:
Dependencies are inferred from the claim text.
From the US filing history. Foreign family members aren’t listed.
Drawings are temporarily unavailable. Open the PDF at USPTO
For authentication of entities: providing single-sign-on or federations
Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity: protecting distributed…
Implementing security features at a particular protocol layer: above the transport layer
Network arrangements or protocols for supporting network services or applications: session management
About 3 years of term left · ends 11 Nov 2029 (estimated)
The present invention relates to a technique for managing sessions. The present invention more specifically relates to a technique for managing a session established between a client apparatus and each of a plurality of server apparatuses.
In recent years, a Single Sign-On (SSO) authentication system implemented by a reverse proxy server has been used. In the SSO authentication system, a reverse proxy server acting as a proxy for a plurality of server apparatuses collectively processes authentication requests received from a client apparatus. When the authentication is successful, a session between the client apparatus and each of the plurality of servers are established. As described, in the SSO authentication system, the user can access every one of the plurality of server apparatuses by performing a login operation only once (refer to paragraph 0219 of Japanese Patent Application Publication No. 2005-11098, for example).
In the SSO authentication system, it is preferable that the authentication statuses respectively of the plurality of server apparatuses should be in synchronization. In a system including a plurality of server apparatuses operating in a coordinated manner, for example, an unexpected error may occur when a session is disconnected in a server apparatus, that is, when a session is disconnected only in a part of the system. However, when a system is to be built taking into consideration various combinations of authentication statuses are, the amount of work and costs associated with the development of the system adversely increases.
For a more complete understanding of the present invention and the advantage thereof, reference is now made to the following description taken in conjunction with the accompanying drawings.
FIG. 1 shows an entire configuration of a communication network 10 according to the present embodiment.
FIG. 2 shows an example of a transition of an authentication state.
Hereinafter, the present invention will be described by using a preferred mode for carrying out the present invention (referred to as an embodiment, below). The following embodiment, however, does not limit the present invention recited in the scope of claims, and all combinations of the features described in the embodiment are not necessarily essential for solving means of the present invention.
FIG. 1 shows an entire configuration of a communication network 10 according to the present embodiment. The communication network 10 includes a client apparatus 100, a plurality of server apparatuses 200 (server apparatuses 200A to 200C, for example) and a reverse proxy server system 300. The client apparatus 100 includes, as the basic hardware, a communication interface 102 such as a network interface card, and a storage unit 104 such as a hard disk drive. Then, the client apparatus 100 functions as a web browser 106 by executing through a CPU a program read from the storage unit 104.
Likewise, each of the server apparatuses 200A to 200C includes, as the basic hardware, a communication interface 202 such as a network interface card and a storage unit 204 such as a hard disk drive. The components described above are referred to as communication interfaces 202A to 202C and storage units 204A to 204C. Then, the server apparatuses 200A to 200C function as web servers 206A to 206C by executing programs through CPUs read from the storage units 204A to 204C, respectively.