System and method for providing secure access to a remote desktop across firewalls in an interactive grid environment

• US 8,037,178 B1
• Filed: 09/19/2003
• Issued: 10/11/2011
• Est. Priority Date: 09/19/2003
• Status: Expired due to Fees

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Kumar, Rajendra, Basu, Sujoy, Agarwalla, Bikash, Talwar, Vanish
• Primary Examiner(s): EL CHANTI, HUSSEIN A
• Application Number:
  US10/666,093
• Time in Patent Office: 2,944 Days
• Field of Search: 709/203, 709/217, 709/219, 709/223, 709/227, 709/225, 709/229
• US Class Current: 709/225
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 2209/5014 Reservation
• CPC Class Codes: G06F 2209/549 Remote execution
• CPC Class Codes: G06F 9/5072 Grid computing
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 67/131 Protocols for games, networked simulations or virtual reality

Abstract

A system and method for secure access to a remote desktop across firewalls in an interactive grid environment is disclosed. Embodiments of the present invention include an interactive grid computing system comprising an interactive grid computing service provider comprising: a resource for use over the interactive grid, a first firewall for protecting the resource and a remote display server for providing a secure connection and for providing interactive graphical data associated with the resource. The system further comprises a client comprising: a second firewall protecting the client and a remote display resource for providing a secure connection and for viewing the interactive graphical data provided by the remote display server.

Claims

1. An interactive grid computing system comprising:

a computing service provider side comprising;

an interactive grid computing service provider comprising;

a grid distributed resource management system (grid DRM) configured for managing a plurality of execution nodes;

at least one resource that said grid DRM reserves for a client based on a request from said client, through a submission node, for an interactive session for a service that said resource is enabled to provide, wherein said at least one resource comprises at least one remote execution node of said plurality of remote execution nodes and at least one fine grained resource, said at least one resource reserved for a requested duration of said interactive session;

a first firewall coupled to said at least one resource and configured for protecting said at least one resource, wherein said first firewall is hosting a VNC proxy server;

a remote display server coupled to said first firewall for providing, at a requested time, secure access, by said submission node, to said at least one resource over a secure connection and for providing interactive graphical data associated with said at least one resource, wherein said client is enabled to communicate directly with said at least one resource over said secure connection during said interactive session;

a software agent associated with said at least one resource, wherein if said at least one resource is requested by said client, said software agent initiates interactive communication between said remote display server and a remote display resource; and

a client side coupled to said interactive grid computing service provider, said client side comprising;

a client comprising said remote display resource configured for communicating with said remote display server through said secure connection to access said interactive graphical data provided by said remote display server, wherein said remote display resource is a virtual network computing viewer modified for secure access and for viewing a graphical desktop display associated with said at least one resource, wherein a modification of said virtual network computing viewer comprises;

an established connection between said virtual network computing viewer and said VNC proxy server using a destination host and a destination port address;

a retrieved handle configured for facilitating a creation of a secure socket, said retrieved handle used to create said secure connection through a socks tunnel; and

a second firewall configured for protecting said client, said second firewall hosting a SOCKS proxy server, wherein said secure connection is through said socks tunnel and is used to tunnel said interactive graphical data through said second firewall.

2. The system as described in claim 1 wherein said remote display resource provides a socksified SSL connection.

3. The system as described in claim 1 wherein said interactive graphical data provided by said remote display server is encrypted.

4. The system as described in claim 1 wherein said interactive graphical data is a graphical desktop display associated with said resource.

5. The system as described in claim 1 wherein said first firewall comprises a VNC proxy server.

6. A method for interactively accessing a remote desktop across a secure network comprising:

receiving a request for at least one resource provided by a grid distributed resource management system (grid DRM), said grid DRM configured for managing a plurality of execution nodes, wherein said at least one resource is protected by a first firewall, wherein said at least one resource comprises at least one remote execution node of said plurality of remote execution nodes and at least one fine grained resource, wherein said first firewall comprises a VNC proxy server;

initiating, at a requested time, a remote display server, said remote display server configured for providing interactive graphical data associated with said at least one resource to a remote display viewer, wherein said remote display viewer is protected by a second firewall and is a virtual network computing viewer modified for secure access and for viewing a graphical desktop display associated with said at least one resource, wherein modifying said virtual network computing viewer comprises;

establishing a secure socket layer (SSL) connection between said virtual network computing viewer and said VNC proxy server using a destination host and a destination port address, wherein said virtual network computing viewer is enabled to communicate directly with said VNC proxy server;

retrieving a handle that is configured for facilitating a creation of a secure socket;

utilizing said retrieved handle to create said secure connection through a socks tunnel; and

communicating interactive graphical data between said virtual network computing viewer and said VNC proxy server directly through said SSL connection, and wherein said second firewall hosts a SOCKS proxy server, wherein said secure connection is through said socks tunnel and is used to tunnel said interactive graphical data through said second firewall.

7. The method as described in claim 6 further comprising receiving said request at said grid DRM from a web browser.

8. The method as described in claim 6 further comprising encrypting said graphical data.

9. The method as described in claim 6 further comprising authenticating a user associated with said virtual network computing viewer.

10. The method as described in claim 9 further comprising authenticating said user at an Internet based grid service access point.

11. An interactive grid computer system comprising a processor coupled to a bus and a memory coupled to said bus and comprising instructions that when executed implement a method for accessing a remote desktop across firewalls comprising:

receiving a request for at least one resource provided by a grid distributed resource management system (grid DRM), said grid DRM configured for managing a plurality of execution nodes, wherein said at least one resource is protected by a first firewall, wherein said at least one resource comprises at least one remote execution node of said plurality of remote execution nodes and at least one fine grained resource, wherein said first firewall hosts a VNC proxy server;

initiating, at a requested time, a remote display server, said remote display server configured for providing interactive graphical data associated with said at least one resource to a remote display viewer, wherein said remote display viewer is protected by a second firewall and is a virtual network computing viewer modified for secure access and for viewing a graphical desktop display associated with said at least one resource, wherein modifying said virtual network computing viewer comprises;

establishing a secure socket layer (SSL) connection between said virtual network computing viewer and said VNC proxy server using a destination host and a destination port address, wherein said virtual network computing viewer is enabled to communicate directly with said VNC proxy server;

retrieving a handle that is configured for facilitating a creation of a secure socket;

utilizing said retrieved handle to create said secure connection through a socks tunnel; and

communicating interactive graphical data between said virtual network computing viewer and said VNC proxy server directly through said SSL connection, and wherein said second firewall hosts a SOCKS proxy server, wherein said secure connection is through said socks tunnel and is used to tunnel said interactive graphical data through said second firewall.

12. The interactive grid computer system as described in claim 11 wherein said method further comprises receiving said request at said grid DRM from an application.

13. The interactive grid computer system as described in claim 11 wherein said method further comprises encrypting said graphical data.

14. The interactive grid computer system as described in claim 11 wherein said method further comprises authenticating a user associated with said virtual network computing viewer.

15. The interactive grid computer system as described in claim 11 wherein said method further comprises authenticating said user at an Internet based grid service access point.