Client side redirection with pluggable authentication and authorization

• US 9,900,182 B2
• Filed: 06/17/2015
• Issued: 02/20/2018
• Est. Priority Date: 02/11/2015
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Dell Products LP (Dell Technologies Inc.)
• Inventors: Fausak, Andrew T., Rombakh, Oleg
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Huang, Cheng-Feng
• Application Number:
  US14/742,148
• Publication Number:
  US 20160234216A1
• Time in Patent Office: 979 Days
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 12/4679 Arrangements for the registration or de-registration of VLAN attribute values, e.g. VLAN identifiers, port VLAN membership
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/025 for remote control or remote monitoring of applications
• CPC Class Codes: H04L 67/08 specially adapted for terminal emulation, e.g. Telnet
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/131 Protocols for games, networked simulations or virtual reality
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/142 Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms
• CPC Class Codes: H04L 67/148 Migration or transfer of sessions
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04L 69/04 Protocols for data compression, e.g. ROHC
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: Y02D 30/50 in wire-line communication networks, e.g. low power modes or reduced link rate

Abstract

A system and method of client side redirection with pluggable authentication and authorization is disclosed. In a particular embodiment, an operating system of a first computing device receives a request to cause remote desktop protocol (RDP) client device to connect to a second computing device. The client is coupled to the first computing device via a first RDP connection. The first computing device may use information associated with the first RDP connection to qualify the client to connect to the second computing device. If qualified, first computing device may send a redirect instruction to the client that redirects the client from the first computing device to the second computing device. The first computing device may send credentials to the client for use in establishing a second RDP connection to the second computing device. The redirect instruction and credentials may be sent via a virtual channel of the first RDP connection.

Claims

1. A method comprising:

by an operating system (OS) of a first computing device;

receiving a request to cause a remote desktop protocol (RDP) client device to connect to a second computing device, the RDP client device being coupled to the first computing device via a first RDP connection;

creating an RDP virtual channel over the first RDP connection;

permitting the RDP client device to establish a tunnel and a channel using specialized gateway service attachment through the RDP virtual channel to the second computing device, wherein the tunnel is an encrypted secure shell tunnel;

qualifying the RDP client device to connect to the second computing device based at least on information associated with the first RDP connection, wherein qualifying the RDP client device comprises checking a permissions vector, wherein the permissions vector is provided to the RDP client device from a PAA ticketing server; and

if the RDP client device is qualified to connect to the second computing device, then sending to the RDP client device;

an instruction for the RDP client device to be re-directed from the first computing device to the second computing device;

an instruction for the RDP client device to close the first RDP connection; and

one or more credentials for the RDP client device to establish a second RDP connection to the second computing device, wherein the instruction and the credentials are being sent to the RDP client device via the RDP virtual channel and the tunnel created over the first RDP connection, wherein the RDP virtual channel is used to create a virtual private network between the RDP client device and one or more servers by attaching one or more gateway functions to each end of the RDP virtual channel, wherein the second RDP connection allows the RDP client device to access the second computing device, wherein each of the first and second RDP connections comprises a gateway, and wherein the credentials being sent to the RDP client device allow the RDP client device to access the second computing device from the gateway based at least on a pluggable authentication and authorization framework.

2. The method of claim 1, wherein qualifying the RDP client device comprises allowing the RDP client device to access an RDP server for a pre-determined period of time.

3. The method of claim 1, wherein establishing the second RDP connection between the RDP client device and the second computing device does not involve a user of the RDP client device.

4. The method of claim 1, wherein the credentials being sent to the RDP client device allow the RDP client device to access the gateway.

5. The method of claim 1, wherein the second RDP connection comprises a third computing device.

6. The method of claim 5, wherein the credentials being sent to the RDP client device allow the RDP client device to access the third computing device.

7. One or more computer-readable non-transitory storage media embodying logic that is operable when executed to:

by an operating system (OS) of a first computing device;

receiving a request to cause a remote desktop protocol (RDP) client device to connect to a second computing device, the RDP client device being coupled to the first computing device via a first RDP connection;

creating an RDP virtual channel over the first RDP connection;

permitting the RDP client device to establish a tunnel and a channel using specialized gateway service attachment through the RDP virtual channel to the second computing device, wherein the tunnel is an encrypted secure shell tunnel;

qualifying the RDP client device to connect to the second computing device based at least on information associated with the first RDP connection, wherein qualifying the RDP client device comprises checking a permissions vector, wherein the permissions vector is provided to the RDP client device from a PAA ticketing server; and

if the RDP client device is qualified to connect to the second computing device, then sending to the RDP client device;

an instruction for the RDP client device to be re-directed from the first computing device to the second computing device;

an instruction for the RDP client device to close the first RDP connection; and

one or more credentials for the RDP client device to establish a second RDP connection to the second computing device, wherein the instruction and the credentials are being sent to the RDP client device via the RDP virtual channel and the tunnel created over the first RDP connection, wherein the RDP virtual channel is used to create a virtual private network between the RDP client device and one or more servers by attaching one or more gateway functions to each end of the RDP virtual channel, wherein the second RDP connection allows the RDP client device to access the second computing device, wherein each of the first and second RDP connections comprises a gateway, and wherein the credentials being sent to the RDP client device allow the RDP client device to access the second computing device from the gateway based at least on a pluggable authentication and authorization framework.

8. The media of claim 7, wherein the virtual channel of the first RDP connection is encrypted.

9. The media of claim 7, wherein establishing the second RDP connection between the RDP client device and the second computing device does not involve a user of the RDP client device.

10. The media of claim 7, wherein the credentials being sent to the RDP client device allow the RDP client device to access the gateway.

11. An information handling system comprising:

one or more processors; and

a memory coupled to the processors comprising instructions executable by the processors, the processors being operable when executing the instructions to;

by an operating system (OS) of a first computing device;

receiving a request to cause a remote desktop protocol (RDP) client device to connect to a second computing device, the RDP client device being coupled to the first computing device via a first RDP connection;

creating an RDP virtual channel over the first RDP connection;

permitting the RDP client device to establish a tunnel and a channel using specialized gateway service attachment through the RDP virtual channel to the second computing device, wherein the tunnel is an encrypted secure shell tunnel;

qualifying the RDP client device to connect to the second computing device based at least on information associated with the first RDP connection, wherein qualifying the RDP client device comprises checking a permissions vector, wherein the permissions vector is provided to the RDP client device from a PAA ticketing server; and

if the RDP client device is qualified to connect to the second computing device, then sending to the RDP client device;

an instruction for the RDP client device to be re-directed from the first computing device to the second computing device;

an instruction for the RDP client device to close the first RDP connection; and

one or more credentials for the RDP client device to establish a second RDP connection to the second computing device, wherein the instruction and the credentials are being sent to the RDP client device via the RDP virtual channel and the tunnel created over the first RDP connection, wherein the RDP virtual channel is used to create a virtual private network between the RDP client device and one or more servers by attaching one or more gateway functions to each end of the RDP virtual channel, and wherein the second RDP connection allows the RDP client device to access the second computing device, wherein each of the first and second RDP connections comprises a gateway, and wherein the credentials being sent to the RDP client device allow the RDP client device to access the second computing device from the gateway based at least on a pluggable authentication and authorization framework.

12. The information handling system of claim 11, wherein establishing the second RDP connection between the RDP client device and the second computing device does not involve a user of the RDP client device.

13. The information handling system of claim 11, wherein the credentials being sent to the RDP client device allow the RDP client device to access the gateway.