IP Library Granted Patent US 11,140,135
Granted Patent B2
US 11,140,135 · App. 16/686,885 · Granted Oct 5, 2021

Scalable proxy clusters

Inventors: Udayakumar Subbarayan (Bangalore, IN); Bernard Harguindeguy (Atherton, CA); Anoop Krishnan Gopalakrishnan (Bangalore, IN); Abdu Raheem Poonthiruthi (Bangalore, IN)
Assignee: Ping Identity Corporation
H04L63/0281G06F9/546H04L41/0813H04L41/0893H04L41/12H04L41/28H04L41/50H04L45/46H04L45/56H04L45/58H04L45/74H04L47/125H04L47/20H04L63/08H04L63/166H04L67/02H04L67/10H04L67/1068H04L67/1095H04L67/12H04L67/145H04L67/28H04L67/32H04L67/42H04L69/16H04L69/329H04L69/40
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,140,135
App. No.
16/686,885
Granted
Oct 5, 2021
Kind
B2
Abstract

The invention enables high-availability, high-scale, high security and disaster recovery for API computing, including in terms of capture of data traffic passing through proxies, routing communications between clients and servers, and load balancing and/or forwarding functions. The invention inter alia provides (i) a scalable cluster of proxies configured to route communications between clients and servers, without any single point of failure, (ii) proxy nodes configured for implementing the scalable cluster (iii) efficient methods of configuring the proxy cluster, (iv) natural resiliency of clusters and/or proxy nodes within a cluster, (v) methods for scaling of clusters, (vi) configurability of clusters to span multiple servers, multiple racks and multiple datacenters, thereby ensuring high availability and disaster recovery (vii) switching between proxies or between servers without loss of session.

Claims (72)

1. A method, comprising:

detecting, at a first proxy node from a plurality of networked proxy nodes, a synchronization event;

in response to the synchronization event, synchronizing data states of the first proxy node with data states of remaining proxy nodes from the plurality of networked proxy nodes such that each proxy node from the plurality of networked proxy nodes has synchronized data states, the synchronized data states including information descriptive of a set of Application Programming Interfaces (APIs) implemented on a plurality of servers and information associated with API requests received at the plurality of networked proxy nodes;

sending, from the first proxy node, a first API request to a first server from the plurality of servers based on the synchronized data states, the first server associated with a first data center; and

sending, from the first proxy node and via a second proxy node from the plurality of networked proxy nodes, a second API request to a second server from the plurality of servers based on the synchronized data states, the second server being different from the first server and associated with a second data center different from the first data center.

2. The method of claim 1 , further comprising:

maintaining routing information stored in a Domain Name System (DNS) server based on the synchronized data states such that the first API request is routed to the first proxy node and the second API request is routed to the second proxy node based on the routing information.

3. The method of claim 1 , wherein the synchronized data states further include:

session data including information descriptive of one or more client devices communicating with the plurality of servers via at least one proxy node from the plurality of networked proxy nodes;

security data associated with one or more sessions between the one or more client devices and the plurality of servers;

configuration data associated with routing the API requests to the plurality of servers; and

proxy node data including information descriptive of the plurality of networked proxy nodes.

4. The method of claim 1 , further comprising:

in response to the second proxy node becoming inactive, modifying routing information stored in a Domain Name System (DNS) server such that a third API request received after the second API request is routed to a third proxy node from the plurality of networked proxy nodes to be sent to the second server.

5. The method of claim 1 , further comprising:

sending, from the first proxy node, messages at periodic intervals to a third proxy node from the plurality of networked proxy nodes;

in response to not receiving a response from the third proxy node after sending a predefined number of the messages, modifying proxy node data included in the data states of the first proxy node to: indicate that the third proxy node is inactive, or remove an identifier of the third proxy node from the proxy node data; and

sending, after the modifying the proxy node data, the data states of the first proxy node to the remaining proxy nodes from the plurality of networked proxy nodes to synchronize the data states of the plurality of networked proxy nodes.

6. The method of claim 1 , wherein the synchronization event includes at least one of:

a proxy node being added to the plurality of networked proxy nodes;

a proxy node from the plurality of networked proxy nodes becoming active after a period of inactivity; or

an expiration of a predefined period of time.

7. The method of claim 1 , further comprising:

synchronizing the data states of the first proxy node with the data states of the remaining proxy nodes at periodic intervals.

8. The method of claim 1 , further comprising:

receiving, via a command-line interpreter (CLI) or a RESTful API (REST API), an input to modify information included in the data states of the first proxy node;

modifying the data states of the first proxy node based on the input; and

sending, after the modifying the data states of the first proxy node, the data states of the first proxy node to the remaining proxy nodes from the plurality of networked proxy nodes to synchronize the data states of the plurality of networked proxy nodes.

9. An apparatus, comprising:

a memory; and

a processor associated with a first proxy node from a plurality of networked proxy nodes, the processor operably coupled to the memory and configured to:

detect a synchronization event;

in response to the synchronization event, synchronize data states of the first proxy node with data states of remaining proxy nodes from the plurality of networked proxy nodes such that each proxy node from the plurality of networked proxy nodes has synchronized data states, the synchronized data states including information descriptive of a set of Application Programming Interfaces (APIs) implemented on a plurality of servers and information associated with API requests received at the plurality of networked proxy nodes;

send a first API request to a first server from the plurality of servers based on the synchronized data states, the first server associated with a first data center; and

send, via a second proxy node from the plurality of networked proxy nodes, a second API request to a second server from the plurality of servers based on the synchronized data states, the second server being different from the first server and associated with a second data center different from the first data center.

10. The apparatus of claim 9 , wherein the processor is further configured to:

maintain routing information stored in a Domain Name System (DNS) server based on the synchronized data states such that the first API request is routed to the first proxy node and the second API request is routed to the second proxy node based on the routing information.

11. The apparatus of claim 9 , wherein the synchronized data states further include:

session data including information descriptive of one or more client devices communicating with the plurality of servers via at least one proxy node from the plurality of networked proxy nodes;

security data associated with one or more sessions between the one or more client devices and the plurality of servers;

configuration data associated with routing the API requests to the plurality of servers; and

proxy node data including information descriptive of the plurality of networked proxy nodes.

12. The apparatus of claim 9 , wherein the processor is further configured to:

in response to the second proxy node becoming inactive, modify routing information stored in a Domain Name System (DNS) server such that a third API request received after the second API request is routed to a third proxy node from the plurality of networked proxy nodes to be sent to the second server.

13. The apparatus of claim 9 , wherein the processor is further configured to:

send messages at periodic intervals to a third proxy node from the plurality of networked proxy nodes;

in response to not receiving a response from the third proxy node after sending a predefined number of the messages, modify proxy node data included in the data states of the first proxy node to: indicate that the third proxy node is inactive, or remove an identifier of the third proxy node from the proxy node data; and

send, after the modifying the proxy node data, the data states of the first proxy node to the remaining proxy nodes from the plurality of networked proxy nodes to synchronize the data states of the plurality of networked proxy nodes.

14. The apparatus of claim 9 , wherein the synchronization event includes at least one of:

a proxy node being added to the plurality of networked proxy nodes;

a proxy node from the plurality of networked proxy nodes becoming active after a period of inactivity; or

an expiration of a predefined period of time.

15. The apparatus of claim 9 , wherein the processor is further configured to:

synchronize the data states of the first proxy node with the data states of the remaining proxy nodes at periodic intervals.

16. The apparatus of claim 9 , wherein the processor is further configured to:

receive, via a command-line interpreter (CLI) or a RESTful API (REST API), an input to modify information included in the data states of the first proxy node;

modify the data states of the first proxy node based on the input; and

send, after the modifying the data states of the first proxy node, the data states of the first proxy node to the remaining proxy nodes from the plurality of networked proxy nodes to synchronize the data states of the plurality of networked proxy nodes.

17. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

detect, at a first proxy node from a plurality of networked proxy nodes, a synchronization event;

in response to the synchronization event, synchronize data states of the first proxy node with data states of remaining proxy nodes from the plurality of networked proxy nodes such that each proxy node from the plurality of networked proxy nodes has synchronized data states, the synchronized data states including information descriptive of a set of Application Programming Interfaces (APIs) implemented on a plurality of servers and information associated with API requests received at the plurality of networked proxy nodes;

send, from the first proxy node, a first API request to a first server from the plurality of servers based on the synchronized data states, the first server associated with a first data center; and

send, from the first proxy node and via a second proxy node from the plurality of networked proxy nodes, a second API request to a second server from the plurality of servers based on the synchronized data states, the second server being different from the first server and associated with a second data center different from the first data center.

18. The non-transitory processor-readable medium of claim 17 , wherein the code further comprises code to cause the processor to:

maintain routing information stored in a Domain Name System (DNS) server based on the synchronized data states such that the first API request is routed to the first proxy node and the second API request is routed to the second proxy node based on the routing information.

19. The non-transitory processor-readable medium of claim 17 , wherein the synchronized data states further include:

session data including information descriptive of one or more client devices communicating with the plurality of servers via at least one proxy node from the plurality of networked proxy nodes;

security data associated with one or more sessions between the one or more client devices and the plurality of servers;

configuration data associated with routing the API requests to the plurality of servers; and

proxy node data including information descriptive of the plurality of networked proxy nodes.

20. The non-transitory processor-readable medium of claim 17 , wherein the code further comprises code to cause the processor to:

in response to the second proxy node becoming inactive, modify routing information stored in a Domain Name System (DNS) server such that a third API request received after the second API request is routed to a third proxy node from the plurality of networked proxy nodes to be sent to the second server.

Assignments (8)
RELEASE OF SECURITY INTEREST AT R/F 61703/0988 Recorded Nov 14, 2025
From: BLUE OWL CAPITAL CORPORATION
To: PING IDENTITY CORPORATION
Reel/Frame 073570/0777 →
SECURITY INTEREST Recorded Nov 13, 2025
From: PING IDENTITY CORPORATION; PING IDENTITY INTERNATIONAL, INC.
To: JPMORGAN CHASE BANK, N.A.
Reel/Frame 073557/0093 →
RELEASE OF SECURITY INTEREST Recorded Oct 19, 2022
From: BANK OF AMERICA, N.A.
To: PING IDENTITY CORPORATION
Reel/Frame 061709/0527 →
GRANT OF SECURITY INTEREST IN PATENT RIGHTS Recorded Oct 18, 2022
From: PING IDENTITY CORPORATION
To: OWL ROCK CAPITAL CORPORATION, AS COLLATERAL AGENT
Reel/Frame 061703/0988 →
SECURITY INTEREST Recorded Nov 23, 2021
From: PING IDENTITY CORPORATION
To: BANK OF AMERICA, N.A., AS COLLATERAL AGENT
Reel/Frame 058944/0687 →
CHANGE OF NAME Recorded Feb 20, 2020
From: ELASTIC BEAM INC.
To: ELASTIC BEAM, LLC
Reel/Frame 052886/0374 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Feb 20, 2020
From: SUBBARAYAN, UDAYAKUMAR; HARGUINDEGUY, BERNARD; GOPALAKRISHNAN, ANOOP KRISHNAN; POONTHIRUTHI, ABDU RAHEEM
To: ELASTIC BEAM, INC.
Reel/Frame 051872/0256 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Feb 20, 2020
From: ELASTIC BEAM, LLC
To: PING IDENTITY CORPORATION
Reel/Frame 051872/0335 →
Continuity (4)
Continuation 16050958 · Jul 31, 2018
Division 15164512 · May 25, 2016
Provisional Application 62167165 · May 27, 2015
Related Publication 20200162433A1 · May 21, 2020