Automatically reconnecting a client across reliable and persistent communication sessions

• US 8,874,791 B2
• Filed: 01/18/2011
• Issued: 10/28/2014
• Est. Priority Date: 06/13/2001
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Panasyuk, Anatoliy, Kramer, Andre, Pedersen, Bradley Jay, Stone, David Sean, Treder, Terry
• Primary Examiner(s): Etienne, Ario
• Assistant Examiner(s): Halim, Sahera
• Application Number:
  US13/008,634
• Publication Number:
  US 20110113247A1
• Time in Patent Office: 1,379 Days
• Field of Search: 709/227, 709/228, 709/232, 709/219, 709/246
• US Class Current: 709/246
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

The invention relates to methods and systems for reconnecting a client and providing user authentication across a reliable and persistent communication session. The method includes providing a first connection between a client and first protocol service and a second connection between the first protocol service and a host service. The first protocol service detects a disruption in the first connection. The client re-establishes the first connection between the client and the first protocol service while maintaining the second connection between the first protocol service and the host service. The first protocol service receives a ticket associated with the client and validates the ticket. The first protocol service links the re-established first connection to the maintained second connection after the ticket is validated.

Claims

1. A method for reconnecting a client to a host service, the method comprising:

(a) providing a first connection between a client computing device and a first protocol service executing on a second computing device, and a second connection between the first protocol service and a host service executing on a third computing device;

(b) detecting, by the first protocol service, a disruption in the first connection between the client computing device and the first protocol service;

(c) re-establishing, by the client, the first connection between the client and the first protocol service while maintaining the second connection between the first protocol service and the host service;

(d) receiving at the first protocol service a ticket associated with the client and associated with the first connection between the client computing device and the first protocol service;

(e) validating, by the first protocol service, the ticket responsive to retrieving encrypted authentication credentials associated with the first connection between the client computing device and the first protocol service; and

(f) linking, by the first protocol service after the ticket is validated, the re-established first connection to the maintained second connection.

2. The method of claim 1, wherein step (a) further comprises authenticating the client with the host service during a first communication session between the client and the host service.

3. The method of claim 1, wherein step (e) further comprises obtaining, from the ticket, a key and session id.

4. The method of claim 3, wherein step (e) further comprises using the session id from the ticket to retrieve encrypted authentication credentials.

5. The method of claim 4, wherein step (e) further comprises using the key from the ticket to decrypt the retrieved authentication credentials.

6. The method of claim 5, wherein step (e) further comprises re-authenticating the client with the host service using the decrypted authentication credentials.

7. The method of claim 1, wherein step (f) further comprises generating, after deleting the ticket, a replacement ticket.

8. The method of claim 1, wherein step (a) further comprises generating a ticket at the first protocol service.

9. The method of claim 8, wherein step (a) further comprises saving, at the first protocol service, a copy of the ticket.

10. The method of claim 1, wherein step (a) further comprises transmitting the ticket from the first protocol service to the client.

11. The method of claim 1, wherein step (a) further comprises deleting the ticket automatically after a pre-determined period of time.

12. The method of claim 1, wherein the third computing device is the second computing device.

13. A system for reconnecting a client to a host service, the system comprising:

a client computing device configured to maintain a first connection with a first protocol service executing on a second computing device, the client re-establishing the first connection between the client and the first protocol server while maintaining the second connection between the first protocol server and the host service; and

the first protocol service configured to maintain the first connection with the client and a second connection with the host service executing on a third computing device, the first protocol service;

detecting a disruption in the first connection between the client computing device and the first protocol service,

receiving a ticket transmitted by the client and associated with the client and associated with the first connection between the client computing device and the first protocol service,

validating the ticket responsive to retrieving encrypted authentication credentials associated with the first connection between the client computing device and the first protocol service, and

after the ticket is validated, linking the re-established first connection to the maintained second connection.

14. The system of claim 13, wherein the client is authenticated with the host service during a first communication session between and the client and the host service.

15. The system of claim 13, wherein the ticket comprises a key and a session id.

16. The system of claim 15, wherein the ticket is validated by the first protocol service using the session id to retrieve encrypted authentication credentials.

17. The system of claim 16, wherein the ticket is further validated by decrypting the retrieved authentication credential with the key from the ticket.

18. The system of claim 17, wherein the client is re-authenticated with the host service using the decrypted authentication credentials.

19. The system of claim 13, wherein the first protocol service is further configured to generate, after deleting the ticket, a replacement ticket.

20. The system of claim 13, wherein the first protocol service is further configured to generate the ticket.

21. The system of claim 20, wherein the first protocol service is further configured to save a copy of the ticket.

22. The system of claim 13, wherein the first protocol service is configured to transmit the ticket to the client.

23. The system of claim 13, wherein the first protocol service is further configured to automatically delete the ticket after a pre-determined period of time.

24. The system of claim 13, wherein the third computing device is the second computing device.