Cisco Technology, Inc.

Pauline Chen

Thomas Anthony Roden

John Knight

Sonny Bui

Kavita Shekhar Patil

Darrell Myers Shively, Ii

David Cates

Terry Kerstetter

A mechanism for authorizing a data communication session between a client and a first server is disclosed. When a request is received to establish a session with a particular entity that is associated with the client, it is determined whether authorization of the session can be performed locally at a second server. If it is determined that authorization of the session can be performed locally at the second server then, the first server is informed that the session may be established between the client and the first server for the particular entity. A third server that is associated with the particular entity is identified and once the first server is informed that the session may be established, the third server is informed that the session has been authorized to be established for the particular entity. However, if authorization of the session cannot be performed locally at the second server then, the third server is requested to authorize the session between the client and the first server. Thereafter, based on the response that is received from the third server, the first server is informed as to whether the session may be authorized.

Method and apparatus providing distributed authorization management of communication sessions

An authorizing apparatus for use with a client that connects to a first server in a network includes a second server that authorizes session requests of the client for the first server. Resource allocation data is available to the second server and indicates whether a session may be established between the client and the first server. The second server has information that associates an entity that is associated with one or more clients, and information that associates the second server to a third server that is authoritative for the second server and the associated clients. When a request to establish a session between the client and the first server is received, the second server determines, based on one of the records that is associated with the client, whether the session may be established when the client is associated with the entity. If not, the second server requests a global authorization server to determine whether a session is allowable. As a result, session management is resolved locally when possible, and over-subscription of clients to servers is prevented.

Distributed database system with authoritative node

An authorizing apparatus for use with a client that connects to a first server in a network is described. The authorizing apparatus includes a second server that authorizes session requests of the client for the first server. A plurality of records of resource allocation data is coupled with the second server. Each record indicates whether a session may be established between the client and the first server. Coupled to the second server is information that associates an entity that includes and is associated with one or more clients, and information that associates the second server to a third server that is authoritative for the second server and the associated clients. Means are provided for receiving a request to establish a session between the client and the first server and for determining, at the second server, based on one of the records that is associated with the client, whether the session may be established when the client is associated with the entity. Also provided are means for informing the first server that the session is authorized only when the second server determines from the one of the records that the session may be established. Although the first, second and third servers have been described as separate servers the functions performed by two or more of the servers may actually be combined in a single server unit.

Mechanism for authorizing a data communication session between a client and a server

Growing community of inventors

Irvine, CA, United States of America

Pauline Chen