Systems and methods for adjusting the maximum transmission unit for encrypted communications

• US 20060039404A1
• Filed: 07/22/2005
• Published: 02/23/2006
• Est. Priority Date: 07/23/2004
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Rao, Goutham P., Brueggemann, Eric R., Rodriguez, Robert A.
• Granted Patent: US 7,609,721 B2
• Time in Patent Office: Days
• US Class Current: 370/465
• CPC Class Codes: H04L 1/1854 Scheduling and prioritising arrangements
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 45/30 Routing of multiclass traffic
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/2416 Real-time traffic
• CPC Class Codes: H04L 47/2433 Allocation of priorities to traffic types
• CPC Class Codes: H04L 47/2475 for supporting traffic characterised by the type of applications
• CPC Class Codes: H04L 47/36 by determining packet size, e.g. maximum transfer unit [MTU]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/164 : at the network layer
• CPC Class Codes: H04L 63/166 : at the transport layer
• CPC Class Codes: H04L 67/14 : Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70

Abstract

The present invention is generally directed towards a remote access architecture for providing peer-to-peer communications and remote access connectivity. In one embodiment, the remote access architecture of the present provides a method for establishing a direct connection between peer computing devices via a third computing device, such as a gateway. Additionally, the present invention provides the following techniques to optimize peer-to-peer communications: 1) false acknowledgement of receipt of network packets allowing communications via a lossless protocol of packets constructed for transmission via a lossy protocol, 2) payload shifting of network packets allowing communications via a lossless protocol of packets constructed for transmission via a lossy protocol, 3) reduction of packet fragmentation by adjusting the maximum transmission unit (MTU) parameter, accounting for overhead due to encryption, 4) application-aware prioritization of client-side network communications, and 5) network disruption shielding for reliable and persistent network connectivity and access.

Claims

1. A method for adjusting the maximum transmission unit of a secure network communication to reduce network fragmentation, the method comprising the steps of:

(a) establishing a session between a first computing device and a second computing device, the first computing device having a first network stack;

(b) detecting, by the first computing device, a network packet having an encrypted payload;

(c) determining, by the first computing device, a setting for a maximum transmission unit parameter of the first network stack to reduce the maximum transmission unit size by at least a size associated with the encrypted portion of the payload; and

(d) altering the maximum transmission unit parameter of the first network stack to the determined setting.

2. The method of claim 1, comprising communicating the network packet via one of a secure socket layer or a transport layer security tunnel to the second computing device.

3. The method of claim 1, wherein the payload comprises a real-time protocol.

4. The method of claim 1, further comprising altering the maximum transmission unit parameter via a network driver interface specification level mechanism of the first network stack

5. The method of claim 1, further comprising determining the setting of the maximum transmission unit parameter dynamically per session between the first computing device and the second computing device.

6. The method of claim 1, comprising establishing the session between the first computing device and the second computing device via a gateway.

7. The method of claim 1, communicating by the first computing device one of real-time voice, audio, or data to the second computing device via the payload of the network packet.

8. The method of claim 1, comprising communicating a false acknowledgement of receipt of the network packet to one of the first computing device or the second computing device before communicating the network packet.

9. The method of claim 1, further comprising establishing the session between the first computing device and the second computing device via an agent of the first computing device.

10. The method of claim 9, comprising communicating, by the agent, via an IOCTL application programming interface to the first network stack to alter the maximum transmission unit parameter to the determined setting.

11. A system for adjusting the maximum transmission unit of a secure network communication to reduce network fragmentation, the system comprising:

a means for establishing a session between a first computing device and a second computing device, the first computing device having a first network stack;

a means for detecting, by the first computing device, a network packet having an encrypted payload;

a means for determining, by the first computing device, a setting for a maximum transmission unit parameter of the first network stack to reduce the maximum transmission unit size by at least a size associated with the encrypted portion of the payload; and

a means for altering the maximum transmission unit parameter of the first network stack to the determined setting.

12. The system of claim 11, comprising a means for communicating the network packet via one of a secure socket layer or a transport layer security tunnel to the second computing device.

13. The system of claim 11, wherein the payload comprises a real-time protocol.

14. The system of claim 11, wherein the payload comprises a representation of one of real-time voice, audio, or data.

15. The system of claim 11, further comprising a means for altering the maximum transmission unit parameter of the first computing device via a network driver interface specification level mechanism of the first network stack

16. The system of claim 11, further comprising a means for determining the setting of the maximum transmission unit parameter dynamically per session between the first computing device and the second computing device.

17. The system of claim 11, comprising a means for establishing the session between the first computing device and the second computing device via a gateway.

18. The system of claim 11, comprising a means for communicating by the first computing device one of real-time voice, audio, or data to the second computing device via the payload of the network packet.

19. The system of claim 11, comprising a means for communicating a false acknowledgement of receipt of the network packet to one of the first computing device or the second computing device before communicating the network packet.

20. The system of claim 11, wherein the network packet comprises a lossless protocol packet.

21. The system of claim 20, wherein the lossless protocol packet comprises a transport control protocol.

22. The system of claim 11, wherein the payload comprises a lossy protocol packet.

23. The system of claim 22, wherein the lossy protocol packet comprises a user datagram protocol.

24. The system of claim 11, comprising an agent of the first computing device for establishing the session between the first computing device and the second computing device.

25. The system of claim 24, wherein the agent communicates via an IOCTL application programming interface to the first network stack to alter the maximum transmission unit parameter to the determined setting.