Systems and methods for network disruption shielding techniques

• US 20060037072A1
• Filed: 07/22/2005
• Published: 02/16/2006
• Est. Priority Date: 07/23/2004
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Rao, Goutham P., Brueggemann, Eric R., Rodriguez, Robert A.
• Granted Patent: US 8,046,830 B2
• Time in Patent Office: Days
• US Class Current: 726/14
• CPC Class Codes: H04L 1/1854 Scheduling and prioritising arrangements
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 45/30 Routing of multiclass traffic
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/2416 Real-time traffic
• CPC Class Codes: H04L 47/2433 Allocation of priorities to traffic types
• CPC Class Codes: H04L 47/2475 for supporting traffic characterised by the type of applications
• CPC Class Codes: H04L 47/36 by determining packet size, e.g. maximum transfer unit [MTU]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/164 : at the network layer
• CPC Class Codes: H04L 63/166 : at the transport layer
• CPC Class Codes: H04L 67/14 : Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70

Abstract

The present invention is generally directed towards a remote access architecture for providing peer-to-peer communications and remote access connectivity. In one embodiment, the remote access architecture of the present provides a method for establishing a direct connection between peer computing devices via a third computing device, such as a gateway. Additionally, the present invention provides the following techniques to optimize peer-to-peer communications: 1) false acknowledgement of receipt of network packets allowing communications via a lossless protocol of packets constructed for transmission via a lossy protocol, 2) payload shifting of network packets allowing communications via a lossless protocol of packets constructed for transmission via a lossy protocol, 3) reduction of packet fragmentation by adjusting the maximum transmission unit (MTU) parameter, accounting for overhead due to encryption, 4) application-aware prioritization of client-side network communications, and 5) network disruption shielding for reliable and persistent network connectivity and access.

Claims

1. A method for shielding from a network disruption a session established via a first protocol, the method comprising the steps of:

(a) establishing, via an agent of a client, a session via a first protocol over a network connection between the client and a device, the network connection associated with a network stack, a first portion of the network stack comprises one or more layers of the network stack below the layer of the first protocol, and a second portion of the network stack comprises a layer for the first protocol and one or more layers of the network stack above the first protocol;

(b) detecting a disruption in the network connection causing the first portion of the network stack to be disestablished;

(c) maintaining, by the agent, the session and the second portion of the network stack during the disruption; and

(d) re-establishing the second portion of the network stack and the network connection while maintaining the session and the second portion of the network stack.

2. The method of claim 1, comprising the step of:

(e) continuing the session with the maintained second portion of the network stack and the re-established first portion of the network stack.

3. The method of claim 1, comprising the step of

(e) dropping, by the second portion of the network stack, any network packets received during the disruption.

4. The method of claim 1, wherein the device comprises one of a remote access gateway or a computing device.

5. The method of claim 1, further comprising establishing the session via the first protocol of one of the following:

secure socket layer (SSL) protocol, a transport layer security (TLS) protocol, and a tunneling protocol.

6. The method of claim 1, comprising communicating, by the agent, real-time data via the session between the client and the device.

7. The method of claim 6, wherein the real-time data comprises a real-time protocol.

8. The method of claim 6, wherein the real-time data comprises a representation of one of voice or audio.

9. The method of claim 1, comprising operating the agent in user-mode of an operating system of the client.

10. The method of claim 1, wherein the first portion of the network comprises one of a transport control protocol or an internet protocol.

11. The method of claim 1, wherein the second portion of the network stack comprises one of an internet protocol, a user datagram protocol, or a voice over internet protocol.

12. The method of claim 1, comprising the client communicating with the device via a remote display protocol.

13. The method of claim 12, wherein the remote display protocol comprises one of an Independent Computing Architecture protocol or a Remote Desktop protocol.

14. The method of claim 1, comprising performing one of steps (b), (c) and (d) transparently to an application of the client communicating via the network connection.

15. The method of claim 1, comprising intercepting, by the agent, transparently to an application of the client one or more network packets associated with the application.

16. The method of claim 1, comprising intercepting, by a network driver associated with the second portion of the stack, transparently to the application on the client one or more network packets associated with the application.

17. A system for shielding from a network disruption a session established via a first protocol, the system comprising

an agent of a client establishing a session between the client and a device over a network connection via a first protocol;

a network stack having a first portion and a second portion, the first portion of the network stack comprising one or more layers of the network stack below the layer of the first protocol, and the second portion of the network stack comprising a layer for the first protocol and one or more layers of the network stack above the first protocol; and

a detector for detecting a disruption in the network connection causing the second portion of the network stack to be disestablished;

wherein;

upon detection of the disruption by the detector, the agent maintains the session and the second portion of the network stack during the disruption; and

the client re-establishes the first portion of the network stack and the network connection while the agent maintains the session and the second portion of the network stack.

18. The system of claim 17, wherein the agent continues the session with the maintained second portion of the network stack and the re-established first portion of the network stack.

19. The system of claim 17, wherein one of the first portion or the second portion of the network stack drops any network packets received during the disruption.

20. The system of claim 17, wherein the device comprises one of a remote access gateway or a computing device.

21. The system of claim 17, wherein the first protocol comprises one of the following:

secure socket layer (SSL) protocol, a transport layer security (TLS) protocol, and a tunneling protocol.

22. The system of claim 17, wherein the agent communicates real-time data via the session between the client and the device.

23. The system of claim 22, wherein the real-time data comprises one of a real-time protocol.

24. The system of claim 22, wherein the real-time data comprises a representation of one of voice or audio.

25. The system of claim 17, wherein the agent operates in user-mode of an operating system of the client.

26. The system of claim 17, wherein the first portion of the network stack comprises one of a transport control protocol or an internet protocol.

27. The system of claim 17, wherein the second portion of the network stack comprises one of an internet protocol, a user datagram protocol, or a voice over internet protocol.

28. The system of claim 17, wherein the first protocol comprises a remote display protocol.

29. The system of claim 28, wherein the remote display protocol comprises one of an Independent Computing Architecture protocol or a Remote Desktop protocol.

30. The system of claim 17, wherein the agent intercepts one or more network packets of an application of the client transparently to the application.

31. The system of claim 17, comprising a network driver associated with the second portion of the network stack, the network driver intercepts one or more network packets of an application of the client transparently to the application, and provides the one or more packets to the agent to communicate via the session.

32. The system of claim 31, wherein the network driver comprises a Network Driver Interface Specification (NDIS) driver.

33. The system of claim 31, wherein the network driver operates in kernel-mode of an operating system of the client.