Systems and methods for communicating a lossy protocol via a lossless protocol

• US 7,724,657 B2
• Filed: 07/22/2005
• Issued: 05/25/2010
• Est. Priority Date: 07/23/2004
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Rao, Goutham P., Brueggemann, Eric R., Rodriguez, Robert A.
• Primary Examiner(s): Nguyen; Steven H
• Assistant Examiner(s): Elpenord; Candal
• Application Number:
  US11/187,513
• Publication Number:
  US 20060039355A1
• Time in Patent Office: 1,768 Days
• Field of Search: 370/237, 370/474, 370/252, 370465-466, 370/229, 370/392, 713/160, 714746-750
• US Class Current: 370/229
• CPC Class Codes: H04L 1/1854 Scheduling and prioritising arrangements
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 45/30 Routing of multiclass traffic
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/2416 Real-time traffic
• CPC Class Codes: H04L 47/2433 Allocation of priorities to traffic types
• CPC Class Codes: H04L 47/2475 for supporting traffic characterised by the type of applications
• CPC Class Codes: H04L 47/36 by determining packet size, e.g. maximum transfer unit [MTU]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/164 : at the network layer
• CPC Class Codes: H04L 63/166 : at the transport layer
• CPC Class Codes: H04L 67/14 : Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70

Abstract

The present invention is generally directed towards a remote access architecture for providing peer-to-peer communications and remote access connectivity. In one embodiment, the remote access architecture of the present provides a method for establishing a direct connection between peer computing devices via a third computing device, such as a gateway. Additionally, the present invention provides the following techniques to optimize peer-to-peer communications: 1) false acknowledgement of receipt of network packets allowing communications via a lossless protocol of packets constructed for transmission via a lossy protocol, 2) payload shifting of network packets allowing communications via a lossless protocol of packets constructed for transmission via a lossy protocol, 3) reduction of packet fragmentation by adjusting the maximum transmission unit (MTU) parameter, accounting for overhead due to encryption, 4) application-aware prioritization of client-side network communications, and 5) network disruption shielding for reliable and persistent network connectivity and access.

Claims

1. A method for transmitting packets from an application using an unreliable transport protocol over a TCP connection, comprising:

receiving, at a first device, a first packet to be transmitted using an unreliable transport protocol;

creating a first TCP packet including a first payload of the received first packet and a first TCP header of information associated with a TCP connection established between the first device and a second device;

transmitting, by the first device, the first TCP packet to the second device;

receiving, at the first device, a second packet to be transmitted using an unreliable transport protocol;

creating a second TCP packet including a second payload of the received second packet and the first TCP header information; and

transmitting, by the first device, before receipt of an acknowledgement of the receipt of the first payload from the second device, the second TCP packet to the second device, the first and second TCP packets intercepted by a filter process of the second device, the filter process stripping the TCP header from the received packets and forwarding the stripped packets, circumventing a TCP stack on the second device, to an intended destination.

2. The method of claim 1, comprising establishing the TCP connection with a port number associated with the unreliable transport protocol.

3. The method of claim 1, comprising dynamically determining, by the first device, the first TCP packet and second TCP packet comprise an unreliable transport protocol.

4. The method of claim 1, wherein the unreliable transport protocol is UDP.

5. The method of claim 1, comprising further:

receiving the first TCP packet and second TCP packet on the first device by intercepting the first TCP packet and second TCP packet using a packet capturing mechanism.

6. The method of claim 1, comprising establishing, by the first device, the TCP connection with a VPN gateway device.

7. The method of claim 1, comprising establishing peer-to-peer communications between the first device and the second device via the TCP connection.

8. The method of claim 1 comprising encrypting, by the first device, the first and second TCP packets, and decrypting, by the second device, the encrypted first and second TCP packets.

9. A system for transmitting packets from an application using an unreliable transport protocol over a TCP connection, the system comprising:

a first device, the first device comprising;

an application generating a first and second packet, the first and second packet intended to be transmitted using an unreliable transport protocol;

a filter process, the filter process intercepting the first and second packets from the application and forwarding the intercepted packets to a tunnel process; and

a tunnel process, the tunnel process requesting the opening of a TCP connection between the first device and a second device, the request to open the TCP connection indicating to the first and second device that the TCP connection will transport packets intended to be transmitted with an unreliable transport protocol, the tunnel process forwarding the first and second packets as payloads in a first and second TCP packet to the second device, the tunnel process sending the second TCP packet after sending the first TCP packet and prior to receiving an acknowledgement for the first TCP packet; and

a second device in communication with the first device, the second device comprising;

a second tunnel process opening the TCP connection requested by the first device, the second tunnel process identifying and forwarding the source address of the TCP connection to a second filter process; and

the second filter process, the second filter process intercepting packets from the application received at the second device with the TCP connection source address in a header, the second filter process stripping the TCP header from the received packets and forwarding the stripped packets, circumventing a TCP/IP stack on the second device, to an intended destination.

10. The system of claim 9, wherein the filter process on the first device comprises a packet capture driver.

11. The system of claim 9, wherein the second filter process on the second device comprises a packet capture driver.

12. The system of claim 9 wherein the first device is a client device and the second device is a VPN gateway device.

13. The system of claim 9, further comprising:

a third device to which the stripped packets are transmitted.

14. The system of claim 13 wherein the second device comprises further:

a Network Address Translation (NAT) table used to perform network address translation prior to transmitting the stripped packets to a third device.

15. The system of claim 9 wherein the unreliable data protocol is UDP.