Global unified session identifier across multiple data centers

Patent metadata

Field	Value
Publication number	US-10009335-B2
Application number	US-201615372342-A
Country	US
Kind code	B2
Filing date	Dec 7, 2016
Priority date	Sep 20, 2013
Publication date	Jun 26, 2018
Grant date	Jun 26, 2018

Abstract

Techniques are disclosed for using a global unified session identifier across data centers. Upon creating an initial session in the data center for a user first accessing the data center, a session identifier is generated for the user session. Because the initial session is the first session created for that user, the initial session identifier is designated as the global unified session identifier for all sessions that may be created for the user in other data centers within the enterprise network. Data centers may then map the global unified session identifiers to locally generated session identifiers for the user. A global unified session identifier enables various user session actions to be performed globally across the data centers, including global logout, global session termination, global session updates, and/or the like. A global unified session identifier prevents the risk of collision that can occur between randomly generated numbers of different data centers.

First claim

What is claimed is:

1. A method comprising:
determining, by a computer system, a first identifier identifying a first session associated with a user at a first data center, the first session comprising at least a first authentication state of the user with respect to a first resource;
determining, by the computer system, a second identifier identifying a second session associated with the user at a second data center, the second session comprising at least a second authentication state of the user with respect to a second resource, wherein the second data center is different from the first data center;
based on determining the second identifier identifying the second session at the second data center, assigning, by the computer system, the second identifier as a global identifier that is associated with any session that is associated with the user at the first data center, wherein execution of one or more session actions that reference the global identifier is performed using the first session at the first data center and using the second session at the second data center; and
based on assigning the second identifier as the global identifier, associating the first identifier with the global identifier to associate the first session with the global identifier.

2. The method of claim 1 , further comprising:
receiving, at the first data center, a request for the first resource from a device; and
creating the first session associated with the user at the first data center.

3. The method of claim 2 , further comprising:
determining whether any session associated with the user exists at the first data center, wherein the first session is created based on determining that no session associated with the user exists at the first data center; and
based on determining that a session associated with the user exists at the first data center, identifying the first session associated with the user at the first data center.

4. The method of claim 2 , wherein the request is a first request, and wherein the method further comprises:
receiving, at the second data center, a second request from the device, the second request being for the second resource;
wherein the second identifier is determined based on the second request.

5. The method of claim 1 , wherein determining includes generating the first identifier.

6. The method of claim 1 , wherein the first session is associated with the user for a device, wherein the first authentication state is for the user at the device, wherein the second session is associated with the user for the device, and wherein the second authentication state is for the user at the device, and wherein the global identifier is associated with any session that is associated with the user for the device.

7. The method of claim 1 , further comprising:
based on associating the first identifier to the global identifier, mapping the first identifier to the global identifier.

8. The method of claim 1 , wherein the execution of the one or more session actions is performed using any session of the user associated with the global identifier.

9. The method of claim 1 , wherein the one or more session actions includes logging out of any session of the user, synchronization of sessions of the user, updating any session of the user, terminating any session of the user, or a combination thereof.

10. The method of claim 1 , further comprising:
generating the first identifier using a random number generator; and
generating the second identifier using the random number generator.

11. The method of claim 1 , further comprising:
causing the first session of the user at the first data center to be terminated based on a request to terminate the first session at the first data center; and
requesting the second data center to terminate the second session of the user that is associated with the global identifier.

12. The method of claim 1 , further comprising
causing the second session of the user at the second data center to be terminated based on a request to terminate the second session at the second data center; and
requesting the first data center to terminate the first session of the user that is associated with the global identifier.

13. A system comprising:
one or more processors; and
a memory accessible to the one or more processors, wherein the memory stores one or more instructions that, upon execution by the one or more processors, causes the one or more processors to:
determine a first identifier identifying a first session associated with a user at a first data center, the first session comprising at least a first authentication state of the user with respect to a first resource;
determine a second identifier identifying a second session associated with the user at a second data center, the second session comprising at least a second authentication state of the user with respect to a second resource, wherein the second data center is different from the first data center;
based on determining the second identifier identifying the second session at the second data center, assign, the second identifier as a global identifier that is associated with any session that is associated with the user at the first data center, wherein execution of one or more session actions that reference the global identifier is performed using the first session at the first data center and using the second session at the second data center; and
based on assigning the second identifier as the global identifier, associate the first identifier with the global identifier to associate the first session with the global identifier.

14. The system of claim 13 , wherein the first data center and the second data center are included in a multi-data center system.

15. The system of claim 13 , wherein the execution of the one or more session actions is performed using any session of the user associated with the global identifier.

16. The system of claim 13 , wherein the one or more session actions includes logging out of any session of the user, synchronization of sessions of the user, updating any session of the user, terminating any session of the user, or a combination thereof.

17. A method comprising:
determining, by a computer system, a first identifier identifying a first session associated with a user at a first data center, the first session comprising at least a first authentication state of the user with respect to a first resource;
determining, by the computer system, a second identifier identifying a second session associated with the user at a second data center, the second session comprising at least a second authentication state of the user with respect to a second resource, wherein the second data center is different from the first data center;
assigning the first identifier as a global identifier that is associated with any session that is associated with the user, wherein execution of one or more session actions that reference the global identifier is performed using any session that associated with the user at the first data center and the second data center; and
based on assigning the first identifier as the global identifier, associating the second identifier with the global identifier to associate the second session with the global identifier.

18. The method of claim 17 , further comprising:
based on associating the second identifier to the global identifier, mapping the second identifier to the global identifier.

19. The method of claim 17 , wherein the one or more session actions includes logging out of any session o

Assignees

• Oracle Int Corp

Inventors

• Mathew Stephen
• Koottayi Vipin Anaparakkal
• Subramanya Ramya Kukehalli

Classifications

• H04L65/1069

  Session establishment or de-establishment · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L65/1066

  Session management · CPC title

• H04L67/141

  Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) · CPC title

• G06F21/41

  where a single sign-on provides access to a plurality of computers · CPC title