System and method for managing security meta-data in a reverse proxy

A computer readable storage medium storing instructions that, when executed by a computer, cause the computer to perform a method of managing access control meta-data in a reverse proxy located between an origin server and one or more clients, the method at the reverse proxy comprising:

• receiving a data request from a user;
• receiving access control meta-data associated with the requested data;
• caching said access control meta-data;
• using said access control meta-data to arbitrate the data request;
• examining communication between the user and the origin server;
• extracting user session meta-data from the communication by monitoring the pattern or content of the communication between the user and the origin server, and using the pattern or content of the communication to detect the creation and tearing down of a user session as well as any associated expiration, wherein the user session meta data associates the user with a user session established for the user on the origin server;
• and
• maintain the user session meta-data on the reverse proxy, wherein the reverse proxy is configured to notify the origin server of any expiration of the user session established for the user on the origin server.

A computer-implemented method of applying access control information at a reverse proxy server acting as a proxy for a separate origin server, the method comprising:

• caching a data object received from an origin server;
• receiving access control information relating to the data object;
• caching said access control information;
• applying said access control information to arbitrate a user request for the data object;
• examining communication between the user and the separate origin server;
• extracting user session meta-data from the communication by monitoring the pattern or content of the communication between the user and the separate origin server, and using the pattern or content of the communication to detect the creation and tearing down of a user session as well as any associated expiration, wherein the user session meta data associates the user with a user session established for the user on the separate origin server;
• and
• maintaining user session meta-data on the reverse proxy, wherein the reverse proxy is configured to notify the origin server of any expiration of the user session established for the user on the origin server.

A computer readable storage medium storing instructions that, when executed by a computer, cause the computer to perform a method of applying access control information at a reverse proxy server acting as a proxy for a separate origin server, the method comprising:

• caching a data object received from an origin server;
• receiving access control information relating to the data object;
• caching said access control information;
• and
• applying said access control information to arbitrate a user request for the data object;
• examining communication between the user and the separate origin server;
• extracting user session meta-data from the communication by monitoring the pattern or content of the communication between the user and the separate origin server, and using the pattern or content of the communication to detect the creation and tearing down of a user session as well as any associated expiration, wherein the user session meta data associates the user with a user session established for the user on the separate origin server;
• and
• maintaining user session meta-data on the reverse proxy, wherein the reverse proxy is configured to notify the origin server of any expiration of the user session established for the user on the origin server.

A computer-readable storage medium encoded with a data structure configured for storing access control meta-data associated with data cached in a reverse proxy cache, the data structure comprising:

• one or more access control tokens configured to indicate a type of access by users to data objects cached in the reverse proxy cache;
• a first association configured to associate a first access control token with a first data object cached in the reverse proxy cache;
• and
• user session meta-data on the reverse proxy, wherein said user session meta-data is extracted from communication between the users and an origin server by monitoring the pattern or content of the communication, and using the pattern or content of the communication to detect the creation and tearing down of a user session as well as any associated expiration, wherein said user session meta-data associates the user with a user session established for the user on the origin server, and wherein the reverse proxy is configured to notify the origin server of any expiration of the user session established for the user on the origin server.

A computer-readable storage medium encoded with instructions for executing a reverse proxy server for caching security meta-data associated with data cached on the reverse proxy server, the instructions comprising:

• an authorization module configured to apply said security meta-data to facilitate arbitration of a request from a user for a first data object cached on the reverse proxy server;
• an access control management module configured to obtain said security meta-data;
• and
• an access control invalidation module configured to invalidate said security meta-data;
• wherein said security meta-data comprises access control information for controlling access to the data cached on the reverse proxy server;
• a traffic analyzer configured to examine communication between an origin server and the user;
• and
• a user session management module configured to:
• extract user session meta-data from the communication by monitoring the pattern or content of the communication between the origin server and the user, including;
• a first user identifier configured to identify the user;
• and
• a session identifier configured to identify the user session of the user on the origin server;
• and
• maintain the user session meta-data;
• wherein said user session management module is further configured to use the pattern or content of the communication to detect the creation and tearing down of a user session as well as any associated expiration;
• and notify the origin server of any expiration of the user session of the first user on the origin server.