US 9,544,293 B2 · Global unified session identifier across multiple data centers

Abstract

Systems and methods are disclosed for using a global unified session identifier across data centers. When a user first accesses a data center and an initial session is created for the user in the data center, a session identifier is generated for the user session. Because the initial session is the first session created for that user, the initial session identifier is designated as the global unified session identifier for all sessions that may be created for the user in other data centers within the enterprise network. Other data centers may then map the global unified session identifiers to locally generated session identifiers for the user. Using a global unified session identifier enables various user session actions to be performed globally across the data centers, including global logout, global session termination, global session updates, and/or the like. Using a global unified session identifier also prevents the risk of collision that can occur between randomly generated numbers of different data centers.

Drawings

Drawings are temporarily unavailable. Open the PDF at USPTO

Drawings

Claims20

Dependent claims

A method of organizing sessions using a global session identifier across a plurality of data centers, the method comprising:

receiving, at a first data center, a request for a resource from a client device;
creating, by a computer system of the first data center, a first session associated with a user of the client device at the first data center, the first session comprising at least an authentication state of the first user with respect to the resource;
generating, by the computer system of the first data center, a first session identifier identifying the first session associated with the user;
receiving, by the computer system of the first data center, a second session identifier from a second data center, the second session identifier identifying a second session associated with the user at the second data center, the second session comprising at least an authentication state of the user with respect to one or more resources associated with the second data center, wherein the second data center is different from the first data center;
in response to receiving the second session identifier from the second data center, assigning, by the computer system of the first data center, the second session identifier as a global session identifier, the global session identifier being associated with any session that is associated with the user, wherein execution of one or more session actions that reference the global session identifier is performed at the first data center to the first session and at the second data center to the second session;
and
based on assigning the second session identifier as the global session identifier, mapping the first session identifier to the global session identifier to associate the first session with the global session identifier.

4 more elements

A system of a first data center, comprising:

a memory storing a plurality of instructions;
and
one or more processors that, upon executing the plurality of instructions, are configured to:
receive a request for a resource from a client device;
create a first session associated with a user of the client device at the first data center, the first session comprising at least an authentication state of the user with respect to the resource;
generate a first session identifier identifying the first session associated with the user;
receive a second session identifier from a second data center, the second session identifier identifying a second session associated with the user at the second data center, the second session comprising at least an authentication state of the user with respect to one or more resources associated with the second data center, wherein the second data center is different from the first data center;
and
in response to receiving the second session identifier from the second data center, assign the second session identifier as a global session identifier, the global session identifier being associated with any session that is associated with the user, wherein execution of one or more session actions that reference the global session identifier is performed at the first data center to the first session and at the second data center to the second session.

6 more elements

A non-transitory computer-readable medium storing a plurality of instructions executable by one or more processors of a first data center to cause the one or more processors to:

receive a request for a resource from a client device;
create a first session associated with a user of the client device at the first data center, the first session comprising at least an authentication state of the user with respect to the resource;
generate a first session identifier identifying the first session associated with the user;
receive a second session identifier from a second data center, the second session identifier identifying a second session of the user at the second data center, the second session comprising at least an authentication state of the user with respect to one or more resources associated with the second data center, wherein the second data center is different from the first data center;
and
in response to receiving the second session identifier from the second data center, assign the second session identifier as a global session identifier, the global session identifier being associated with any session that is associated with the user, wherein execution of one or more session actions that reference the global session identifier is performed at the first data center to the first session and at the second data center to the second session.

3 more elements

Dependencies are inferred from the claim text.

Description14,237 words

Summary1,247 words

#1. Field of the Art

#Generally, the present application is related to data processing. More specifically, the application is related to using a global unified session identifier across multiple data centers in different locations.

#2. Discussion of the Related Art

Brief description of the drawings9 figures

#FIG. 1 illustrates a system for assigning a unique session identifier for user sessions in accordance with an embodiment.

#FIG. 2 illustrates a system for providing single sign-on access among data centers in accordance with an embodiment.

#FIG. 3 is a sequence diagram in accordance with an embodiment.

Detailed description12,801 words

#In the following description, for the purposes of explanation, specific details are set forth in order to provide a thorough understanding of embodiments of the invention. However, it will be apparent that various embodiments may be practiced without these specific details. The figures and description are not intended to be restrictive.

#The ensuing description provides exemplary embodiments only, and is not intended to limit the scope, applicability, or configuration of the disclosure. Rather, the ensuing description of the exemplary embodiments will provide those skilled in the art with an enabling description for implementing an exemplary embodiment. It should be understood that various changes may be made in the function and arrangement of elements without departing from the spirit and scope of the invention as set forth in the appended claims.

#Specific details are given in the following description to provide a thorough understanding of the embodiments. However, it will be understood by one of ordinary skill in the art that the embodiments may be practiced without these specific details. For example, circuits, systems, networks, processes, and other components may be shown as components in block diagram form in order not to obscure the embodiments in unnecessary detail. In other instances, well-known circuits, processes, algorithms, structures, and techniques may be shown without unnecessary detail in order to avoid obscuring the embodiments.

Facts

Application

14/135,053Filed 19 Dec 2013 · us provisional application

Priority

20 Sep 2013

Published

US 2015/0089604 A126 Mar 2015

Granted

10 Jan 2017

Term ends

19 Dec 2033

Estimated · how

20 years from earliest known nonprovisional domestic filing plus recorded patent term adjustment. Maintenance-fee lapses, terminal disclaimers and statutory extensions have not been checked. The continuity chain may be incomplete; this is not an enforceability determination.

Classification10 codes

H04L 63/0815
For authentication of entities: providing single-sign-on or federations
G06F 21/41
User authentication: where a single sign-on provides access to a plurality of computers
H04L 63/08
Network architectures or network communication protocols for network security: for authentication of entities
H04L 63/10
Network architectures or network communication protocols for network security: for controlling access to devices or network resources

Timeline

20 Sep 2013Priority claimedParent application 61/880,400
19 Dec 2013Application filedUS 14/135,053
19 Dec 2013Assigned to Oracle International Corporationassignment of assignor's interest
26 Mar 2015PublishedUS 2015/0089604 A1
10 Jan 2017GrantedUS 9,544,293 B2
12 Oct 2026TodayWithin its term
19 Dec 2033Term endsEstimated

Global unified session identifier across multiple data centers

Life of this patent

Global unified session identifier across multiple data centers

Life of this patent

Life of this patent

Abstract

Drawings

Drawings

Claims20

Description14,237 words

Drawings

Classification10 codes

Life of this patent

Description14,237 words