PLUGGABLE MODULES FOR TERMINAL SERVICES

• US 20090183225A1
• Filed: 01/10/2008
• Published: 07/16/2009
• Est. Priority Date: 01/10/2008
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Malakapalli, Meher P., Palekar, Ashwin
• Application Number:
  US11/972,443
• Publication Number:
  US 20090183225A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Embodiments that facilitate the use of pluggable policy modules and authentication modules for access to a Terminal Services (TS) server are disclosed. In accordance with various embodiments, a method includes accessing one or more pluggable modules at a Terminal Services Gateway (TSG) server or a Terminal Services (TS) server. The method further includes processing a TS server access request from a TS client at the TSG server or the TS server. The TS server access request is processed in part based on the one or more pluggable modules. In one particular embodiment, the one or more pluggable modules include at least one of a connection authorization policy (CAP) module, a resource authorization policy (RAP) module, and an authentication module.

Claims

1. A method, comprising:

accessing one or more pluggable modules at a Terminal Services Gateway (TSG) server, wherein the one or more pluggable modules include at least one of a pluggable connection authorization policy (CAP) module, a pluggable resource authorization policy (RAP) module, or a pluggable authentication module; and

processing a TS server access request from a TS client at the TSG server using at least the one or more pluggable modules.

2. The method of claim 1, wherein the processing of a TS server access request further includes processing a connection request a connection between a TS client and a TSG server based at least on one or more policies included in the pluggable CAP module.

3. The method of claim 1, wherein the processing of a TS server access request further includes processing a resource request for a resource in the TS server based at least on one or more policies included in the pluggable RAP module.

4. The method of claim 1, wherein the processing of a TS server access request further includes processing a user authentication input from the TS client at the TSG server using the pluggable authentication module.

5. The method of claim 4, wherein the authentication input includes one of an authentication token, an authentication certificate, an authentication password, or an authentication cookie.

6. The method of claim 1, wherein the processing of a TS server access request includes processing a user authentication input to verify an identity of a corresponding user for access to a TS server.

7. The method of claim 1, wherein the TSG server is in a trusted network, and the TS client is in one of the trusted network or an untrusted network.

8. The method of claim 1, wherein the TS server and the TSG server are in different domains of the same trusted network.

9. The method of claim 1, wherein processing a TS server access request further includes using an application program interface (API) to interact with a pluggable connection authorization policy (CAP) module.

10. The method of claim 1, wherein processing a TS server access request further includes using an application program interface (API) to interact with a pluggable resource authorization policy (RAP) module.

11. The method of claim 1, wherein processing a TS server access request further includes using an application program interface (API) to interact with a pluggable authentication module.

12. The method of claim 1, wherein the TSG server includes at least one of a CAP engine or a RAP engine, and wherein processing a TS server access request includes processing a connection request based on policies in the CAP engine and the pluggable CAP module, and processing a resource request based on policies in the RAP engine and the pluggable CAP module.

13. A computer readable medium having computer-executable instructions that, when executed, perform acts comprising:

accessing one or more pluggable modules using at least one application program interface (API); and

processing a Terminal Services (TS) server access request from a TS client using the one or more pluggable modules, wherein the TS server access request includes at least one of a user authentication input, a connection request, and a resource request for a resource in the TS server.

14. The computer readable medium of claim 13, wherein the connection request is for a connection between one of the TS client and the TSG server or the TS client and the TS server.

15. The computer readable medium of claim 13, wherein accessing one or more pluggable modules include accessing a pluggable authentication module, and wherein processing a TS server access request further includes using the pluggable authentication module to verify an identity of the user for access to the TS server.

16. The computer readable medium of claim 13, wherein accessing one or more pluggable modules include accessing a pluggable connection authorization policy (CAP) module, and wherein processing a TS server access request further includes processing a connection request based on the at least one policy included in the CAP module.

17. The computer readable medium of claim 13, wherein accessing one or more pluggable modules include accessing a pluggable resource authorization policy (RAP) module, and wherein processing a TS server access request further includes processing the resource request based on the at least one policy include in the RAP module.

18. A server, the server comprising:

one or more processors; and

a first application program interface (API) for interacting with one or more pluggable modules, the one or more pluggable modules include one or more policies for determining at least one of a permissibility a connection between a Terminal Services (TS) client and one of a Terminal Services Gateway (TSG) server or a TS server, or a permissibility of access to a resource on the TS server from the TS client; and

a second API for interacting with a pluggable authentication module, the pluggable authentication module to verify the identity of a user using an authentication input received at the TS client.

19. The system of claim 18, wherein the one or more pluggable modules includes at least one of a pluggable connection authorization policy (CAP) module or a pluggable resource authorization policy (RAP) module.

20. The method of claim 18, wherein the one or more pluggable modules includes a pluggable TS server policy module.