AUTOMATICALLY RECONNECTING A CLIENT ACROSS RELIABLE AND PERSISTENT COMMUNICATION SESSIONS

• US 20050198379A1
• Filed: 09/29/2004
• Published: 09/08/2005
• Est. Priority Date: 06/13/2001
• Status: Abandoned Application

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Treder, Terry, Pedersen, Bradley Jay, Panasyuk, Anatoliy, Stone, David Sean, Kramer, Andre
• Application Number:
  US10/711,646
• Publication Number:
  US 20050198379A1
• Time in Patent Office: Days
• US Class Current: 709/239
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

The invention relates to methods and systems for reconnecting a client and providing user authentication across a reliable and persistent communication session. A first protocol that encapsulates a plurality of secondary protocols is used to communicate over a network. A first protocol service, using the first protocol, provides session persistence and a reliable connection between a client and a host service. When there is a disruption in the network connection between a client and a host service, the connection is reestablished and the user re-authenticated to the host service without the user re-entering his or her authentication credentials or without the user re-establishing the user session with the host service

Claims

1. A method for reconnecting a client to a host service, the method comprising the steps of:

(a) providing a first connection between a client and a first protocol service, and a second connection between the first protocol service and a host service;

(b) detecting a disruption in the first connection;

(c) re-establishing the first connection between the client and the first protocol service while maintaining the second connection between the first protocol service and the host service;

(d) receiving at the first protocol service a ticket associated with the client;

(e) validating the ticket; and

(f) linking, after the ticket is validated, the re-established first connection to the maintained second connection.

2. The method of claim 1 wherein step (a) further comprises authenticating the client with the host service during a first communication session between the client and the host service.

3. The method of claim 1 wherein step (e) further comprises obtaining, from the ticket, a key and session id.

4. The method of claim 3 wherein step (e) further comprises using the session id from the ticket to retrieve encrypted authentication credentials.

5. The method of claim 4 wherein step (e) further comprises using the key from the ticket to decrypt the retrieved authentication credentials.

6. The method of claim 5 wherein step (e) further comprises re-authenticating the client with the host service using the decrypted authentication credentials.

7. The method of claim 1 wherein step (f) further comprises deleting, after the ticket is validated, the ticket.

8. The method of claim 2 wherein step (f) further comprises generating, after the ticket is deleted, a replacement ticket.

9. The method of claim 1 wherein step (a) further comprises generating a ticket at the first protocol service.

10. The method of claim 9 wherein step (a) further comprises saving, at the first protocol service, a copy of the ticket.

11. The method of claim 4 wherein step (a) further comprises transmitting the ticket from the first protocol service to the client.

12. The method of claim 1 wherein step (a) further comprises deleting the ticket automatically after a pre-determined period of time.

22. The system of claim 12 wherein the first protocol service is further configured to save a copy of the ticket.

13. A system for reconnecting a client to a host service, the system comprising:

a client configured to maintain a first connection with a first protocol service; and

the first protocol service configured to maintain the first connection with the client and a second connection with the host service, wherein;

a disruption is detected in the first connection;

the first connection is re-established between the client and the first protocol service while the second connection between the first protocol service and the host service is maintained;

a ticket associated with the client is transmitted from the client to the first protocol service;

the ticket is validated; and

after the ticket is validated, the re-established first connection is linked to the maintained second connection.

14. The system of claim 13 wherein the client is authenticated with the host service during a first communication session between the client and the host service.

15. The system of claim 13 wherein the ticket comprises a key and session id.

16. The system of claim 15 wherein the ticket is validated by the first protocol service using the session id to retrieve encrypted authentication credentials.

17. The system of claim 16 wherein the ticket is further validated by decrypting the retrieved authentication credentials with the key from the ticket.

18. The system of claim 17 wherein the client is re-authenticated with the host service using the decrypted authentication credentials.

19. The system of claim 13 wherein the first protocol service is further configured to delete, after the ticket is validated, the ticket.

20. The system of claim 19 wherein the first protocol service is further configured to generate, after the ticket is deleted, a replacement ticket.

21. The system of claim 13 wherein the first protocol service is further configured to generate the ticket.

23. The system of claim 13 wherein the first protocol service is further configured to transmit the ticket to the client.

24. The system of claim 13 wherein the first protocol service is further configured to automatically delete the ticket after a pre-determined period of time.