Virtual desktop accelerator with support for dynamic proxy thread management

• US 9,485,220 B2
• Filed: 03/03/2016
• Issued: 11/01/2016
• Est. Priority Date: 05/03/2013
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Dell Products LP (Dell Technologies Inc.)
• Inventors: Basha P. R., Khader, Krishnamurthy, Santhosh, Hanumantharayappa, Raghunandan
• Primary Examiner(s): COX, NATISHA D
• Application Number:
  US15/060,178
• Publication Number:
  US 20160191468A1
• Time in Patent Office: 243 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/30 Compression, e.g. Merkle-Damgard construction
• CPC Class Codes: H04L 2209/72 Signcrypting, i.e. digital signing and encrypting simultaneously
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

In particular embodiments, a method includes determining a data flow rate of the active connections at a proxy, comparing the data flow rate to a first pre-determined threshold value, and, when the data flow rate exceeds the first pre-determined threshold value, creating one or more new processing threads associated with the proxy.

Claims

1. A system comprising:

one or more processors; and

a memory coupled to the one or more processors comprising instructions executable by the one or more processors, the one or more processors being operable when executing the instructions to;

initiate a first connection between a client and a server using a first communication protocol via a private network;

establish a secure tunnel between the server and the client associated with the first connection;

perform a handshake via the secure tunnel between the client and the server, wherein the handshake allows exchange of formatting information;

receive an encrypted token from the client, wherein the encrypted token comprises an encrypted signature encrypted using a first cryptographic context;

receive a first encrypted data from the client, wherein the first encrypted data is encrypted using a second cryptographic context;

authenticate the client, wherein the authentication is based, at least in part, on the encrypted signature and the first encrypted data;

establish and maintain a second remote connection between the client and the server via a proxy using a second communication protocol that is different from the first communication protocol, wherein the second connection is an accelerated connection;

send a second encrypted data from the server to the client, wherein a cryptographic context is dynamically selected to encrypt the second encrypted data, wherein a different cryptographic context is used to encrypt a first data packet of the second encrypted data than a second data packet of the second encrypted data;

determine one or more active remote connections, wherein the one or more active remote connections comprises the second remote connection; and

determine a data flow rate of the one or more active remote connections at a proxy.

2. The system of claim 1, the one or more processors being further operable when executing the instructions to:

close the first connection after the second connection is established.

3. The system of claim 1, the one or more processors being further operable when executing the instructions to:

dynamically create or destroy one or more threads associated with establishing and maintaining the second connection.

4. The system of claim 1, wherein determining a data flow rate of the one or more active remote connections at the proxy comprises analyzing one or more socket buffers associated with the proxy, and wherein analyzing one or more socket buffers associated with the proxy comprises determining a number of bytes written to the socket buffers in a pre-determined period of time.

5. The system of claim 1, wherein a number of new processing threads created by the proxy is based at least in part on a load of a machine on which the proxy resides.

6. The system of claim 1, wherein the second communication protocol is used to transport remote desktop protocol data.

7. The system of claim 1, wherein when the data flow rate exceeds a first pre-determined threshold value, create one or more new processing threads associated with the proxy.

8. One or more computer-readable non-transitory storage media embodying software that is operable when executed to:

initiate a first connection between a client and a server using a first communication protocol via a private network;

establish a secure tunnel between the server and the client associated with the first connection;

perform a handshake via the secure tunnel between the client and the server, wherein the handshake allows exchange of formatting information;

receive an encrypted token from the client, wherein the encrypted token comprises an encrypted signature encrypted using a first cryptographic context;

receive a first encrypted data from the client, wherein the first encrypted data is encrypted using a second cryptographic context;

authenticate the client, wherein the authentication is based, at least in part, on the encrypted signature and the first encrypted data;

establish and maintain a second remote connection between the client and the server via a proxy using a second communication protocol that is different from the first communication protocol, wherein the second connection is an accelerated connection;

send a second encrypted data from the server to the client, wherein a cryptographic context is dynamically selected to encrypt the second encrypted data, wherein a different cryptographic context is used to encrypt a first data packet of the second encrypted data than a second data packet of the second encrypted data;

determine one or more active remote connections, wherein the one or more active remote connections comprises the second remote connection; and

determine a data flow rate of the one or more active remote connections at a proxy.

9. The media of claim 8, the software being further operable when executed to:

close the first connection after the second connection is established.

10. The media of claim 8, the software being further operable when executed to:

dynamically create or destroy one or more threads associated with establishing and maintaining the second connection.

11. The media of claim 8, wherein determining a data flow rate of the one or more active remote connections at the proxy comprises analyzing one or more socket buffers associated with the proxy, and wherein analyzing one or more socket buffers associated with the proxy comprises determining a number of bytes written to the socket buffers in a pre-determined period of time.

12. The media of claim 8, wherein a number of new processing threads created by the proxy is based at least in part on a load of a machine on which the proxy resides.

13. The media of claim 8, wherein the second communication protocol is used to transport remote desktop protocol data.

14. The media of claim 8, wherein when the data flow rate exceeds a first pre-determined threshold value, create one or more new processing threads associated with the proxy.

15. A method comprising:

initiating a first connection between a client and a server using a first communication protocol via a private network;

establishing a secure tunnel between the server and the client associated with the first connection;

performing a handshake via the secure tunnel between the client and the server, wherein the handshake allows exchange of formatting information;

receiving an encrypted token from the client, wherein the encrypted token comprises an encrypted signature encrypted using a first cryptographic context;

receiving a first encrypted data from the client, wherein the first encrypted data is encrypted using a second cryptographic context;

authenticating the client, wherein the authentication is based, at least in part, on the encrypted signature and the first encrypted data;

establishing and maintain a second remote connection between the client and the server via a proxy using a second communication protocol that is different from the first communication protocol, wherein the second connection is an accelerated connection;

sending a second encrypted data from the server to the client, wherein a cryptographic context is dynamically selected to encrypt the second encrypted data, wherein a different cryptographic context is used to encrypt a first data packet of the second encrypted data than a second data packet of the second encrypted data;

determining one or more active remote connections, wherein the one or more active remote connections comprises the second remote connection; and

determining a data flow rate of the one or more active remote connections at a proxy.

16. The method of claim 15, further comprising:

closing the first connection after the second connection is established.

17. The method of claim 15, further comprising:

dynamically creating or destroying one or more threads associated with establishing and maintaining the second connection.

18. The method of claim 15, wherein determining a data flow rate of the one or more active remote connections at the proxy comprises analyzing one or more socket buffers associated with the proxy, and wherein analyzing one or more socket buffers associated with the proxy comprises determining a number of bytes written to the socket buffers in a pre-determined period of time.

19. The method of claim 15, wherein a number of new processing threads created by the proxy is based at least in part on a load of a machine on which the proxy resides.

20. The method of claim 15, wherein the second communication protocol is used to transport remote desktop protocol data, and wherein the data flow rate exceeds a first pre-determined threshold value, create one or more new processing threads associated with the proxy.