Strategies for Securely Applying Connection Policies via a Gateway

• US 20080209538A1
• Filed: 02/28/2007
• Published: 08/28/2008
• Est. Priority Date: 02/28/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ben-Shachar, Ido, Malakapalli, Meher P., Guo, Donghang, Swaminathan, Gautam
• Granted Patent: US 8,201,218 B2
• Time in Patent Office: Days
• US Class Current: 726/12
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/59 Providing operational support to end devices by off-loading in the network or by emulation, e.g. when they are unavailable

Abstract

A strategy is described for securely applying connection policies in a system that includes a first entity (e.g., a TS client) connected to a second entity (e.g., a TS server) via a gateway using a remote-operating protocol (e.g., RDP). The strategy involves establishing a first secure channel between the gateway and the TS server and transmitting policy information from the gateway to the TS server. The strategy then involves deactivating the first secure channel and setting up a second secure channel between the TS client and the TS server. The strategy uses the second secure channel to transmit RDP data from the TS client to the TS server. The TS server uses the previously-transmitted policy information to determine whether to enable or disable a feature that affects the TS client, such as device redirection.

Claims

1. A method for securely transmitting data from a first entity to a second entity via a gateway using a remote-operating protocol, comprising:

establishing a first secure channel between the gateway and the second entity;

receiving policy information from the gateway at the second entity via the first secure channel, the policy information identifying a manner in which the second entity is to interact with first entity;

establishing a second secure channel between the first entity and the second entity;

receiving data at the second entity from the first entity via the second secure channel; and

taking action on the data at the second entity based on the policy information which was previously transmitted from the gateway to the second entity.

2. The method of claim 1, wherein the remote-operating protocol is Remote Desktop Protocol (RDP).

3. The method of claim 1, wherein the first entity is a terminal service (TS) client and the second entity is a TS server.

4. The method of claim 1, wherein the first secure channel is formed as a Secure Sockets Layer (SSL) channel.

5. The method of claim 1, wherein the second secure channel is formed as a Secure Sockets Layer (SSL) channel.

6. The method of claim 1, further comprising deactivating the first secure channel prior to transmitting the data to the second entity using the second secure channel.

7. The method of claim 1, where the policy information indicates whether a feature that affects the first entity should be enabled or disabled.

8. The method of claim 7, wherein the feature is device redirection.

9. The method of claim 7, wherein the feature is associated with at least one packet of the remote-operating protocol.

10. The method of claim 1, wherein the data received via the second secure channel includes a token that has been previously sent from the gateway to the first entity, wherein the second entity uses the token to identify the first entity.

11. One or more machine-readable media containing machine-readable instruction ns for implementing the method of claim 1.

12. One or more computing devices, comprising:

one or more processors; and

memory to store computer-executable instructions that, when executed by the one or more processors, perform the method of claim 1.

13. A method for securely transmitting data from a terminal service (TS) client to a TS server via a gateway using a remote-operating protocol, comprising:

establishing a first secure channel between the gateway and the TS server;

sending policy information from the gateway to the TS server via the first secure channel, the policy information identifying a manner in which the TS server is to interact with the TS client;

deactivating the first secure channel; and

sending data to the TS server via a second secure channel.

14. The method of claim 13, further comprising sending a token from the gateway to the TS client.

15. The method of claim 14, wherein the data sent to the TS server includes the token previously sent to the TS client, wherein the token is used by the TS server to associate the policy information with the TS client.

16. One or more machine-readable media containing machine-readable instructions for implementing the method of claim 13.

17. One or more computing devices, comprising:

one or more processors; and

memory to store computer-executable instructions that, when executed by the one or more processors, perform the method of claim 13.

18. A system for securely transmitting data using a remote-operating protocol, comprising:

a terminal service (TS) server; and

a gateway for proxying the data between at least one TS client and the TS server,

wherein the system is configured to establish a first secure channel between the gateway and the TS server to transmit policy information from the gateway to the TS server,

wherein the system is configured to establish a second secure channel between said at least one TS client and the TS server to receive data from said at least one client,

wherein the TS server is configured to take action on the received data based on the policy information which was previously transmitted from the gateway.

19. The system of claim 18, wherein the remote-operating protocol is Remote Desktop Protocol (RDP).

20. The system of claim 18, wherein the TS server is configured to receive a token from said at least one TS client along with the data, wherein the TS server is configured to use the token to associate the policy information with the TS client.