Internet connection load balancing with direct access to balanced devices
SIP INVITE messages received at a load balancer are returned as SIP Redirect messages which are addressed to an access director and include additional information, such as a tracing token and a cryptographic token. When the access director receives the redirected SIP INVITE, the access director analyzes the included cryptographic token and passes the SIP INVITE if the cryptographic token is correct. This provides the needed access control function to allow the access directors to be directly accessed by the endpoints, rather than funneling all communications through the load balancer.
1. A method of providing a request directly to one of a plurality of replicated access functions controlling access to a load balanced function, the method comprising:
providing an initial request from an endpoint for the load balanced function;
a load balancer providing a redirection response to the endpoint, the redirection response including authorization information and indicating a redirected request should go to a selected one of the plurality of replicated access functions;
the endpoint providing the redirected request to the selected access function, the redirected request including the authorization information;
the selected access function evaluating a received request for proper authorization information to determine if the redirected request is authorized;
the selected access function denying the received request when proper authorization information is not present in the received request; and
the selected access function forwarding the received request for further operations when proper authorization information is present in the received request.
2. The method of claim 1 , wherein the initial request is a communication request and wherein all communication signaling and media flow occur between the endpoint and the selected access function and not involving the load balancer after the initial request.
3. The method of claim 2 , wherein the authorization information is only provided in the redirected request and not in later communication signaling.
4. The method of claim 1 , wherein the authorization information includes an initial request address and a cryptographic token, and
wherein the cryptographic token is formed from the initial request address, a shared secret and a time value.
5. The method of claim 4 , wherein the authorization information further includes a tracing token, and wherein the tracing token is also used in forming the cryptographic token.
6. The method of claim 1 , wherein the plurality of replicated access functions have external addresses and the indication is to one of those external addresses.
7. The method of claim 6 , wherein the external addresses are public Internet Protocol (IP) addresses.
8. A system for allowing a request from an endpoint directly to one of a plurality of replicated access functions controlling access to a load balanced function, the system comprising:
a load balancer, the load balancer:
receiving an initial request from an endpoint for the load balanced function; and
providing a redirection response to the endpoint, the redirection response including authorization information and indicating a request should go to a selected one of the plurality of replicated access functions;
an access function of the plurality of replicated access functions, the access function:
receiving a request for the load balanced function from an endpoint;
evaluating the received request for proper authorization information to determine if the received request is authorized;
denying the received request when proper authorization information is not present in the received request; and
forwarding the received request for further operations when proper authorization information is present in the received request.
9. The system of claim 8 , wherein the initial request is a communication request and wherein all communication signaling and media flow occur between the endpoint and the selected access function and not involving the load balancer after the initial request.
10. The system of claim 8 , wherein the authorization information includes an initial request address and a cryptographic token, and
wherein the cryptographic token is formed from the initial request address, a shared secret and a time value.
11. The system of claim 10 , wherein the authorization information further includes a tracing token, and wherein the tracing token is also used in forming the cryptographic token.
12. The system of claim 8 , wherein the plurality of replicated access functions have external addresses and the indication is to one of those external addresses.
13. The system of claim 12 , wherein the external addresses are public Internet Protocol (IP) addresses.
14. A load balancer for allowing a request from an endpoint to proceed directly to one of a plurality of replicated access functions controlling access to a load balanced function, the load balancer comprising:
a processor;
a network interface coupled to the processor; and
program storage coupled to the processor, the program storage including a program to cause the processor to:
receive, through the network interface, an initial request from an endpoint for the load balanced function; and
provide, through the network interface, a redirection response to the endpoint, the redirection response including authorization information used by an access function to indicate the request should be processed and indicating a request should go to a selected one of the plurality of replicated access functions.
15. The load balancer of claim 14 , wherein the authorization information includes an initial request address and a cryptographic token, and
wherein the cryptographic token is formed from the initial request address, a shared secret and a time value.
16. The load balancer of claim 15 , wherein the authorization information further includes a tracing token, and wherein the tracing token is also used in forming the cryptographic token.
17. The load balancer of claim 14 , wherein the plurality of replicated access functions have external addresses and the indication is to one of those external addresses.
18. The load balancer of claim 17 , wherein the external addresses are public Internet Protocol (IP) addresses.
19. An access function for allowing a request from an endpoint directly to one of a plurality of replicated access functions controlling access to a load balanced function to be processed, the access function comprising:
a processor;
a network interface coupled to the processor; and
program storage coupled to the processor, the program storage including a program to cause the processor to:
receive from an endpoint, through the network interface, a request for the load balanced function, the received request not having passed through a load balancer;
evaluating the received request for proper authorization information to determine if the received request is authorized;
denying the received request when proper authorization information is not present in the received request; and
forwarding the received request for further processing operations when proper authorization information is present in the received request.
20. The access function of claim 19 , wherein the authorization information includes an initial request address and a cryptographic token, and
wherein the cryptographic token is formed from the initial request address, a shared secret and a time value.
21. The access function of claim 20 , wherein the authorization information further includes a tracing token, and wherein the tracing token is also used in forming the cryptographic token.