# US 2024/0205227 A1 · Synchronizing a user's authentication state across multiple data centers using event messages

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2024/0205227 A1
- Document ID: US20240205227A1
- Status: Published application
- Kind: A1
- Application number: 18/084,881
- Filed: 2022-12-20
- Published: 2024-06-20
- Earliest claimed: 2022-12-20
- Assignees: Red Hat, Inc.
- Applicants: Red Hat, Inc.
- Inventors: Alexander Schwartz; Stefan Guilhen; Martin Kanis
- Web page: https://patentgrep.com/patent/US20240205227A1

## CPC

- H04L 63/102: {Entity profiles}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/108: {when the policy decisions are valid for a limited amount of time}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Techniques for synchronizing the authentication state of a user across data centers using event messages are provided herein. In one example, a system can determine a first change in the authentication state, update a first data structure representing the authentication state in a first data center based on the change, and store a first event message indicating the first change in a message queue. The system can then transmit the first event message to a second data center. Based on the event message, the second data center can update a second data structure also representing the authentication state of the user. In some examples, the second data center can also transmit a second event message to the first data center indicating a second change to the authentication state of the user. The first data center can update first data structure based on the second event message.

## Claims

### Claim 1

A non-transitory computer-readable medium comprising program code that is executable by a processor of a first data center for causing the processor to:
determine a first change in an authentication state of a user;
update a first data structure representing a current authentication state of the user based on the first change in the authentication state of the user;
store a first event message indicating the first change in the authentication state of the user in a message queue;
transmit the first event message from the message queue to a second data center that is remote from the first data center, the second data center being configured to receive the first event message and update a second data structure based on the first event message, the second data structure representing the current authentication state of the user;
receive a second event message from the second data center, the second event message indicating a second change in the authentication state of the user; and
update the first data structure based on the second event message.

### Claim 2 (depends on 1)

The non-transitory computer-readable medium of claim 1, wherein the message queue is a first message queue, and further comprising program code that is executable by the processor of the first data center for causing the processor to:
receive a plurality of event messages from the second data center, the plurality of event messages indicating a sequence of changes in the authentication state of the user;
store the plurality of event messages in a second message queue in an order in which the plurality of event messages were received; and
update the first data structure based on the order of the plurality of event messages in the second message queue.

### Claim 3 (depends on 2)

The non-transitory computer-readable medium of claim 2, further comprising program code that is executable by the processor of the first data center for causing the processor to:
receive another plurality of event messages from a third data center;
store the other plurality of event messages in a third message queue in an order in which the other plurality of event messages were received, the third message queue being specific to the third data center and the second message queue being specific to the second data center; and
update the first data structure based on the order of the other plurality of event messages in the third message queue.

### Claim 4 (depends on 3)

The non-transitory computer-readable medium of claim 3, further comprising program code that is executable by the processor for causing the processor to:
receive a request from a client device of the user for an authentication token to be renewed; and
in response to receiving the request:
renew the authentication token;
update the first data structure to indicate that the authentication state of the user has been renewed;
store an event message in the message queue indicating that the authentication state of the user has been renewed; and
transmit the event message from the message queue to the second data center and the third data center, the second data center and the third data center being configured to update respective data structures representing the current authentication state of the user based on the event message.

### Claim 5 (depends on 1)

The non-transitory computer-readable medium of claim 1, further comprising program code that is executable by the processor for causing the processor to:
receive a request from a client device of the user for modifying the authentication state of the user; and
update the first data structure to indicate the current authentication state of the user based on event messages from other data centers, prior to transmitting a response to the request to the client device.

### Claim 6 (depends on 1)

The non-transitory computer-readable medium of claim 1, further comprising program code that is executable by the processor for causing the processor to:
subscribe to event systems of a plurality of data centers to maintain continuity of the authentication state of the user by receiving a plurality of event messages related to changes in the authentication state of the user in a plurality of queues, wherein each queue of the plurality of queues corresponds to an individual data center for receiving event messages from that data center.

### Claim 7 (depends on 1)

The non-transitory computer-readable medium of claim 1, further comprising program code that is executable by the processor for causing the processor to:
receive a request from a client device of the user for an authentication token to be renewed;
in response to receiving the request, determine that the authentication token is unknown;
in response to determining that the authentication token is unknown, delay handling of the request until an event message identifying the authentication token is received from the second data center;
receive the event message from the second data center, the event message indicating that the authentication token has been renewed;
update the first data structure based on the event message to indicate that the current authentication state of the user has been renewed; and
transmit a response to the client device indicating that the authentication token has been renewed.

### Claim 8

A method comprising:
determining, by one or more processors of a first data center, a first change in an authentication state of a user;
updating, by the one or more processors, a first data structure representing a current authentication state of the user based on the first change in the authentication state of the user;
storing, by the one or more processors, a first event message indicating the first change in the authentication state of the user in a message queue;
transmitting, by the one or more processors, the first event message from the message queue to a second data center that is remote to the first data center, the second data center being configured to receive the first event message and update a second data structure based on the first event message, the second data structure representing the current authentication state of the user;
receiving, by the one or more processors, a second event message from the second data center, the second event message indicating a second change in the authentication state of the user; and
updating, by the one or more processors, the first data structure based on the second event message.

### Claim 9 (depends on 8)

The method of claim 8, further comprising:
receiving, by the one or more processors, a plurality of event messages from the second data center, the plurality of event messages indicating a sequence of changes in the authentication state of the user;
storing, by the one or more processors, the plurality of event messages in a second message queue in an order in which the plurality of event messages were received; and
updating, by the one or more processors, the first data structure based on the order of the plurality of event messages in the second message queue.

### Claim 10 (depends on 9)

The method of claim 9, further comprising:
receiving, by the one or more processors, another plurality of event messages from a third data center;
storing, by the one or more processors, the other plurality of event messages in a third message queue in an order in which the other plurality of event messages were received, the third message queue being specific to the third data center and the second message queue being specific to the second data center; and
updating, by the one or more processors, the first data structure based on the order of the other plurality of event messages in the third message queue.

### Claim 11 (depends on 8)

The method of claim 8, further comprising:
receiving, by the one or more processors, a request from a client device of the user for an authentication token to be renewed; and
in response to receiving the request:
renewing, by the one or more processors, the authentication token;
updating, by the one or more processors, the first data structure to indicate that the authentication state of the user has been renewed;
storing, by the one or more processors, an event message in the message queue indicating that the authentication state of the user has been renewed; and
transmitting, by the one or more processors, the event message from the message queue to the second data center and a third data center, the second data center and the third data center being configured to update respective data structures representing the current authentication state of the user based on the event message.

### Claim 12 (depends on 8)

The method of claim 8, further comprising:
receiving, by the one or more processors, a request from a client device of the user for modifying the authentication state of the user; and
updating, by the one or more processors, the first data structure to indicate the current authentication state of the user based on event messages from other data centers, prior to transmitting a response to the request to the client device.

### Claim 13 (depends on 8)

The method of claim 8, further comprising subscribing, by the one or more processors, to event systems of a plurality of data centers to maintain continuity of the authentication state of the user by receiving a plurality of event messages related to changes in the authentication state of the user in a plurality of queues, wherein each queue of the plurality of queues corresponds to an individual data center for receiving event messages from that data center.

### Claim 14 (depends on 8)

The method of claim 8, further comprising:
receiving, by the one or more processors, a request from a client device of the user for an authentication token to be renewed;
in response to receiving the request, determining, by the one or more processors, that the authentication token is unknown;
in response to determining that the authentication token is unknown, delaying, by the one or more processors, handling of the request until an event message identifying the authentication token is received from the second data center;
receiving, by the one or more processors, the event message from the second data center, the event message indicating that the authentication token has been renewed;
updating, by the one or more processors, the first data structure based on the event message to indicate that the current authentication state of the user has been renewed; and
transmitting, by the one or more processors, a response to the client device indicating that the authentication token has been renewed.

### Claim 15

A system comprising:
one or more processors of a first data center; and
a memory including instructions that are executable by the one or more processors for causing the one or more processors to:
determine a first change in an authentication state of a user;
update a first data structure representing a current authentication state of the user based on the first change in the authentication state of the user;
store a first event message indicating the first change in the authentication state of the user in a message queue;
transmit the first event message from the message queue to a second data center that is remote to the first data center, the second data center being configured to receive the first event message and update a second data structure based on the first event message, the second data structure representing the current authentication state of the user;
receive a second event message from the second data center, the second event message indicating a second change in the authentication state of the user; and
update the first data structure based on the second event message.

### Claim 16 (depends on 15)

The system of claim 15, wherein the memory further includes instructions that are executable by the one or more processors for causing the one or more processors to:
receive a plurality of event messages from the second data center, the plurality of event messages indicating a sequence of changes in the authentication state of the user;
store the plurality of event messages in a second message queue in an order in which the plurality of event messages were received; and
update the first data structure based on the order of the plurality of event messages in the second message queue.

### Claim 17 (depends on 16)

The system of claim 16, wherein the memory further includes instructions that are executable by the one or more processors for causing the one or more processors to:
receive another plurality of event messages from a third data center;
store the other plurality of event messages in a third message queue in an order in which the other plurality of event messages were received, the third message queue being specific to the third data center and the second message queue being specific to the second data center; and
update the first data structure based on the order of the other plurality of event messages in the third message queue.

### Claim 18 (depends on 15)

The system of claim 15, wherein the memory further includes instructions that are executable by the one or more processors for causing the one or more processors to:
receive a request from a client device of the user for an authentication token to be renewed; and
in response to receiving the request:
renew the authentication token;
update the first data structure to indicate that the authentication state of the user has been renewed;
store an event message in the message queue indicating that the authentication state of the user has been renewed; and
transmit the event message to the second data center and a third data center, the second data center and the third data center being configured to update respective data structures representing the current authentication state of the user based on the event message.

### Claim 18 (depends on 15)

The system of claim 15, wherein the memory further includes instructions that are executable by the one or more processors for causing the one or more processors to:
receive a request from a client device of the user for modifying the authentication state of the user; and
update the first data structure to indicate the current authentication state of the user based on event messages from other data centers, prior to transmitting a response to the request to the client device.

### Claim 19 (depends on 15)

The system of claim 15, wherein the memory further includes instructions that are executable by the one or more processors for causing the one or more processors to:
subscribe to event systems of a plurality of data centers to maintain continuity of the authentication state of the user by receiving a plurality of event messages related to changes in the authentication state of the user in a plurality of queues, wherein each queue of the plurality of queues corresponds to an individual data center.

### Claim 20 (depends on 15)

The system of claim 15, wherein the memory further includes instructions that are executable by the one or more processors for causing the one or more processors to:
receive a request from a client device of the user for an authentication token to be renewed;
in response to receiving the request, determine that the authentication token is unknown;
in response to determining that the authentication token is unknown, delay handling of the request until an event message identifying the authentication token is received from the second data center;
receiving the event message from the second data center, the event message indicate that the authentication token has been renewed;
update the first data structure based on the event message to indicate that the current authentication state of the user has been renewed; and
transmit a response to the client device indicating that the authentication token has been renewed.