Secure Connection Authentication for Server Farms
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current client-server communication protocols face challenges such as significant initial connection overhead, vulnerability to Denial of Service (DOS) attacks, and difficulties in reconnecting to centralized servers, especially in server farms, which affect security and seamless user experience.
Innovation Solution
Implementing a method that allows for the early exchange of authentication information using secure communication protocols like Cred-SSP, reducing resource allocation and enabling consistent reestablishment of secure connections, even in server farms behind a virtual IP address.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard connection handshake protocols are used before authentication, then secure communication can be established, but significant connection overhead and resource consumption occur before user authentication
Solution Approach 1:
The patent performs authentication actions before establishing the full connection handshake. Specifically, the server receives authentication credentials from the client in the initial connection request, validates them, and only then proceeds with the standard connection handshake protocols. This preliminary authentication prevents unnecessary connection setup overhead for unauthorized users and reduces resource consumption before actual user verification.
2Ease of operation
If multiple connection requests are allowed before authentication, then client can initiate connection, but server becomes vulnerable to Denial of Service attacks
Solution Approach 1:
The patent applies preliminary anti-action by validating authentication credentials before allowing the connection to proceed beyond the initial request stage. The server receives and validates authentication information in the connection setup phase, and only authorized clients receiving authentication challenge responses are allowed to continue. This preliminary security check prevents DOS attacks by blocking unauthorized connection attempts before they can consume significant server resources.
3Reliability
If connection protocol exchanges are restarted after disconnection, then connection can be reestablished, but seamless user experience is inhibited
Solution Approach 1:
The patent maintains continuity of useful action by preserving the authentication state and connection context on the server side even after network disconnections. When a client reconnects, the server recognizes the authenticated session and restores the connection without requiring full protocol exchanges to restart. This allows seamless reconnection experiences while maintaining reliable connection reestablishment, as the authentication and initial handshake information is retained and reused.
4Adaptability or versatility
If client connects to server farm through virtual IP, then load balancing is achieved, but client cannot automatically reconnect without restarting protocol exchanges
Solution Approach 1:
The patent introduces an intermediary mechanism where the server farm maintains a centralized authentication and session state repository that all virtual IP-addressed servers can access. When a client connects through the virtual IP, the authentication credentials are validated against this intermediary repository, and the session state is stored there. Upon disconnection and reconnection, the client can automatically reconnect through any server in the farm, which queries the intermediary for the stored authentication state and restores the connection without requiring full protocol exchanges to restart.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
Implementations of the present invention efficiently establish secure connections between a client and server, at least in part by authenticating the client and server early on in the connection setup phases. A client initiating a connection with a server identifies the secure communication protocols enabled at the client, and identifies these protocols in a connection request it sends to the server. The server processes the message and responds with a communication protocol it deems appropriate for the connection. The client and server then exchange appropriate authentication information, and then establish a connection session that implements the chosen communication protocol, and encrypts messages using the negotiated communication protocol. Additional implementations relate to reestablishing dropped connections behind virtual Internet Protocol addresses, without necessarily having to recommit much connection resource overhead.