Load balancer metadata forwarding on secure connections

Patent metadata

Field	Value
Publication number	US-10659366-B1
Application number	US-201514932577-A
Country	US
Kind code	B1
Filing date	Nov 4, 2015
Priority date	Nov 4, 2015
Publication date	May 19, 2020
Grant date	May 19, 2020

Abstract

Network devices, such as load balancers may be configured to forward client metadata to back-end nodes using defined fields of a security protocol. For example, client metadata may be inserted into an extension field or certificate defined by a security protocol that is used for a secure connection between the load balancer and the back-end node. In some instances, a source IP address based on a received request may be inserted into the extension field or certificate defined by the security protocol before the request is forwarded to the back-end node. The back-end node may extract the client metadata and use the client metadata for any of a number of processes (e.g., billing, tracking, security, logging, etc.).

First claim

What is claimed is:

1. A system, comprising:
a plurality of back-end processes implemented by a plurality of back-end servers; and
one or more load balancers coupled to the plurality of back-end servers, wherein individual ones of the one or more load balancers are configured to:
establish connections with clients;
receive requests from the clients via respective ones of the established connections;
establish secure connections to the respective back-end processes of the plurality of back-end processes according to a secure connection protocol;
apply a load balancing mechanism to select a respective back-end process of the plurality of back-end processes to handle respective ones of the received requests;
for a given one of the requests received via the established connections,
extract client metadata, comprising a source address of the respective client, based on the given received request,
generate a corresponding request for the one of the plurality of back-end processes selected according to the load balancing mechanism, wherein the corresponding request is generated according to the secure connection protocol, and
include the client metadata in a load balancer certificate defined by the secure connection protocol; and

send, to the selected back-end process on a respective one of the established secure connections,
the corresponding request, and
the extracted client metadata comprising the source address of the respective client in the load balancer certificate.

2. The system of claim 1 ,
wherein the secure connection protocol is a transport layer security protocol; and
wherein the certificate used to send the client metadata is a certificate defined by the transport layer security protocol.

3. The system of claim 1 , wherein the extracted client metadata is a source IP address that is extracted from the request.

4. The system of claim 1 , wherein the selected back-end process is configured to:
receive the corresponding request including the client metadata in the certificate;
retrieve the client metadata from the certificate of the corresponding request; and
process the client metadata.

5. The system of claim 4 , wherein to process the client metadata, the selected back-end process is further configured to:
process the client metadata as a security measure,
provide the client metadata to a logging process,
provide the client metadata to a tracking process,
provide the client metadata to a billing process associated with the client, or process the client metadata to enforce a priority service level associated with the client.

6. A process, comprising:
performing by one or more load balancers:
receiving a request from a client via a connection;
obtaining, based on the request, client metadata associated with the request, the client metadata comprising a source address of the client;
establishing, according to a secure connection protocol, a secure connection to a back-end process, the back-end process selected from a plurality of back-end processes of a service provider according to a load balancing mechanism;
generating another request for the selected back-end process that corresponds to the request received via the connection, the other request generated according to the secure connection protocol;
including the client metadata, comprising the source address of the client, in a load balancer certificate defined by the secure connection protocol; and
sending the corresponding request and the client metadata comprising the source address of the client in the load balancer certificate to the selected back-end process.

7. The process as recited in claim 6 , wherein the client metadata includes a source address that was extracted from the received request or data associated with a client certificate.

8. The process as recited in claim 6 , wherein the one or more load balancers are part of a provider network that provides network-based services to a plurality of remote client networks.

9. The process as recited in claim 6 , further comprising:
receiving, by the selected back-end process, the corresponding request including the client metadata in the certificate;
performing said obtaining client metadata via extracting the client metadata from the certificate of the received request; and
processing the retrieved client metadata, processing including:
processing the client metadata as a security measure,
providing the client metadata to a logging process,
providing the client metadata to a tracking process,
providing the client metadata to a billing process associated with the client, or
processing the client metadata to enforce a priority service level associated with the client.

10. The process as recited in claim 6 , wherein said establishing the secure connection to the back-end process includes:
establishing the secure connection between a back-end secure connection manager of the one or more load balancers and a secure connection manager of a back-end device that implements the selected back-end process, wherein the secure connection manager of the back-end device manages secure connections for a plurality of distinct back-end processes.

11. The process as recited in claim 6 ,
wherein said establishing the secure connection to the back-end process comprises:
establishing the secure connection to a secure connection manager associated with the selected back-end process by a back-end secure connection manager of the load balancer; and

wherein the process further comprises:
receiving, by the secure connection manager, the corresponding request including the client metadata in the certificate;
retrieving, by the secure connection manager, the client metadata from the certificate of the corresponding request; and
providing, by the secure connection manager, the client metadata to the selected back-end process.

12. The process as recited in claim 6 , wherein the process further comprises applying the load balancing mechanism to select the back-end process of the plurality of back-end processes to handle the received request.

13. A non-transitory computer readable medium storing program instructions that when executed by one or more processors implement a load balancer configured to:
receive a request from a client via a connection;
obtain, based on the request, client metadata associated with the request, the client metadata comprising a source address of the client;
apply a load balancing mechanism to select a back-end process of a plurality of back-end processes to handle the request;
establish, in accordance with a secure connection protocol, a secure connection to a back-end process, the back-end process selected according to the load balancing mechanism;
generate a corresponding request for the selected back-end process that corresponds to the request received via the connection, the corresponding request generated according to the secure connection protocol;
including the client metadata, comprising the source address of the client, in a load balancer certificate defined by the secure connection protocol; and
send the corresponding request and the client metadata comprising the source address of the client in the load balancer certificate to the selected back-end process.

14. The computer readable medium as recited in claim 13 ,
wherein the secure connection protocol is a transport layer security protocol;
wherein the certificate used to send the client metadata is defined by the transport layer security protocol; and
wherein the obtained client metadata is:
a source IP address that is extracted from the received request, or
a client certifi

Assignees

• Amazon Tech Inc

Inventors

• Mehr Nima Sharifi

Classifications

• H04L63/166

  at the transport layer · CPC title

• H04L47/125 Primary

  by balancing the load, e.g. traffic engineering · CPC title

• H04L67/1029

  using data related to the state of servers by a load balancer · CPC title

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title