Authentication vs load balancing

Question

Hi all u guru's
We are developing an application which must communicate securely with a farm of application servers through load balancing (all servers are assigned virtual ip). The constraint is that all servers are independent ( do not manage back end db to save common secure context for example). We are also constrained on communication between the servers.
Does anybody knows the protocol (or any other solution) for establishing secure communication in such conditions ?
the problem is establishing symmetric key (we don't know to which application server the message is sent).
We proposed next solution:
1. Client invents symmetric key.
2. a payload with symmewtric key encypted (with server public key) and signed (with client private key) is added to every message.
3. every Application server can decrypt and verify the key and store it for future use (if the message come with the the same payload id).
Can someone tell is there any main disadvantages to the scheme, that can ruin it all?
please answer also to [email protected]

Answer 1

The major drawback is transaction size and speed, depending on the type of application. Have you considered using sticky sessions (where every user is assigned to the same machine he first hit)? The other option is serializing the info/key from machine to machine as needed, which in my opinion is not a secure thing to do.
Those are the other two options off the top of my head. I'm guessing that you have some sort of client capable of mainting the key information for the user. If not, and all you have is a browser, I don't think this will work like you think it will.