Securely Pushing Connection Settings to a Terminal Server Using Tickets

• US 20090259757A1
• Filed: 04/15/2008
• Published: 10/15/2009
• Est. Priority Date: 04/15/2008
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Guo, Donghang, Ben-Shachar, Ido, Malakapalli, Meher P., Palekar, Ashwin
• Application Number:
  US12/103,542
• Publication Number:
  US 20090259757A1
• Time in Patent Office: Days
• US Class Current: 709/228
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213

Abstract

Systems and techniques for securely pushing connection settings to a terminal server using tickets are described. In one embodiment, a request is received at a first network component from a client for access to a second network component. A ticket associated with one or more connection settings is created and provided to the client. The ticket is provided by the client to the second network component. The ticket is provided from the second network component to the first network component, and the one or more connection settings associated with the ticket are received from the first network component back to the second network component. The one or more connection settings are enforced at the second network component.

Claims

1. A method of providing connection settings, comprising:

receiving at a first network component a request from a client for access to a second network component;

creating a ticket associated with one or more connection settings associated with the request;

providing the ticket to the client;

receiving the ticket from the client at the second network component;

providing the ticket from the second network component to the first network component;

receiving at the second network component the one or more connection settings associated with the ticket from the first network component; and

enforcing the one or more connection settings at the second network component.

2. The method of claim 1, wherein the creating a ticket associated with one or more connection settings associated with the request includes accessing a central database for at least some of the one or more connection settings.

3. The method of claim 1, wherein the creating a ticket associated with one or more connection settings associated with the request includes:

accessing a central database for at least some of the one or more connection settings; and

receiving at the first network component one or more additional connection settings from one or more additional network components.

4. The method of claim 3, wherein the request from the client is communicated via a gateway, and wherein receiving at the first network component one or more additional connection settings from one or more additional network components includes receiving one or more additional connection settings associated with an edge-specific policy from the gateway.

5. The method of claim 3, wherein the receiving at the first network component one or more additional connection settings from one or more additional network components includes receiving one or more additional connection settings associated with a license from a license component.

6. The method of claim 1, wherein the first network component comprises a broker component and the second network component comprises a terminal server, and wherein the resource includes at least one of an application, a patch, an upgrade, a desktop, a directory, a documents, image, or data.

7. The method of claim 1, wherein the creating a ticket associated with one or more connection settings associated with the request includes creating a ticket based on at least one of an identity of a user, the second network component, whether the client is connecting through a gateway, whether the client has passed a quarantine check, or a time of day.

8. A system, comprising:

a first network component configured to;

receive a request from a client for access to a second network component;

create a ticket associated with one or more connection settings associated with the request; and

provide the ticket to the client;

a second network component operatively communicating with the first network component, the second network component configured to;

receive the ticket from the client;

provide the ticket to the first network component;

receive the one or more connection settings associated with the ticket from the first network component; and

enforce the one or more connection settings.

9. The system of claim 8, wherein the first network component is configured to access a central database for at least some of the one or more connection settings.

10. The system of claim 8, wherein the first network component is configured to:

access a central database for at least some of the one or more connection settings;

and

receive one or more additional connection settings from one or more additional network components.

11. The system of claim 10, wherein the request from the client is communicated to the first network component via a gateway, and wherein the first network component is configured to receive one or more additional connection settings associated with an edge-specific policy from the gateway.

12. The system of claim 10, wherein the first network component is configured to receive one or more additional connection settings associated with a license from a license component.

13. The system of claim 8, wherein the first network component comprises a broker component and the second network component comprises a terminal server, and wherein the resource includes at least one of an application, a patch, an upgrade, a desktop, a directory, a documents, image, or data.

14. A method of accessing a resource within a network, comprising:

providing a request to access a resource hosted on a first network component;

receiving a ticket created by a second network component, the ticket being associated with one or more connection settings associated with the request;

providing the ticket to the first network component; and

accessing the resource hosted on the first network component subject to the one or more connection settings enforced by the second network component.

15. The method of claim 14, further comprising:

accessing, with the second network component, a central database for at least some of the one or more connection settings; and

creating the ticket using the second network component.

16. The method of claim 15, wherein the creating the ticket using the second network component includes creating the ticket based on at least one of an identity of a user, the second network component, whether the client is connecting through a gateway, whether the client has passed a quarantine check, or a time of day.

17. The method of claim 14, further comprising:

accessing, with the second network component, a central database for at least some of the one or more connection settings;

receiving, at the second network component, one or more additional connection settings from one or more additional network components; and

creating the ticket using the second network component.

18. The method of claim 17, wherein the request to the first network component is communicated via a gateway, and wherein receiving, at the second network component, one or more additional connection settings from one or more additional network components includes receiving one or more additional connection settings associated with an edge-specific policy from the gateway.

19. The method of claim 17, wherein receiving, at the second network component, one or more additional connection settings from one or more additional network components includes receiving one or more additional connection settings associated with a license from a license component.

20. The method of claim 14, wherein the first network component comprises a terminal server and the second network component comprises a broker server, and wherein the resource includes at least one of an application, a patch, an upgrade, a desktop, a directory, a documents, image, or data.