VIRTUAL DESKTOP ACCELERATOR WITH SUPPORT FOR MULTIPLE CRYPTOGRAPHIC CONTEXTS

• US 20140331046A1
• Filed: 09/13/2013
• Published: 11/06/2014
• Est. Priority Date: 05/03/2013
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Dell Products LP (Dell Technologies Inc.)
• Inventors: KRISHNAMURTHY, SANTHOSH, HANUMANTHARAYAPPA, RAGHUNANDAN, BASHA P.R., KHADER
• Granted Patent: US 9,300,762 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 2209/30 Compression, e.g. Merkle-Damgard construction
• CPC Class Codes: H04L 2209/72 Signcrypting, i.e. digital signing and encrypting simultaneously
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

In particular embodiments, a method includes intercepting a remote desktop connection request and connecting to a network gateway based on the remote desktop connection request. A first connection with a server is initiated via the network gateway using a first communication protocol. A plurality of cryptographic contexts are exchanged with the server. A token encrypted using one of the plurality of cryptographic contexts is received from the server. The token is sent from a client device to the server or a proxy to authenticate the client device, and a second connection is initiated with the server, via the proxy, using a second communication protocol.

Claims

1. One or more computer-readable non-transitory storage media embodying software that is operable when executed to:

intercept a remote desktop connection request;

connect to a network gateway based on the remote desktop connection request;

initiate a first connection with a server via the network gateway using a first communication protocol;

exchange a plurality of cryptographic contexts with the server;

receive a token encrypted using one of the plurality of cryptographic contexts from the server;

send the token from a client device to the server or a proxy to authenticate the client device; and

initiate a second connection with the server, via the proxy, wherein the second connection is initiated using a second communication protocol.

2. The media of claim 1, wherein the software is operable when initiating the first connection with the server to:

provide authentication credentials to authenticate the client device with the network gateway.

3. The media of claim 1, wherein the token comprises authentication information for authenticating the client device.

4. The media of claim 1, wherein authenticating the client device comprises:

authenticating the client device with the server using the token; and

breaking the first connection with the server.

5. The media of claim 1, wherein initiating the second connection comprises:

performing a first authentication step with respect to the proxy; and

performing a second authentication step with respect to the server, wherein the first authentication step and the second authentication step are performed using the token.

6. The media of claim 1, wherein the first communication protocol is TCP and the second communication protocol is UDP Plus.

7. A method comprising:

intercepting a remote desktop connection request;

connecting to a network gateway based on the remote desktop connection request;

initiating a first connection with a server via the network gateway using a first communication protocol;

exchanging a plurality of cryptographic contexts with the server;

receiving a token encrypted using one of the plurality of cryptographic contexts from the server;

sending the token from a client device to the server or a proxy to authenticate the client device; and

initiating a second connection with the server, via the proxy, wherein the second connection is initiated using a second communication protocol.

8. The method of claim 7, wherein initiating the first connection with the server further comprises:

providing authentication credentials to authenticate the client device with the network gateway.

9. The method of claim 7, wherein the token comprises authentication information for authenticating the client device.

10. The method of claim 7, wherein authenticating the client device further comprises:

authenticating the client device with the server using the token; and

breaking the first connection with the server.

11. The method of claim 7, wherein initiating the second connection further comprises:

performing a first authentication step with respect to the proxy; and

performing a second authentication step with respect to the server, wherein the first authentication step and the second authentication step are performed using the token.

12. The method of claim 7, wherein the first communication protocol is TCP.

13. The method of claim 7, wherein the second communication protocol is UDP Plus.

14. A system comprising:

one or more processors; and

a memory coupled to the processors comprising instructions executable by the processors, the processors being operable when executing the instructions to;

intercept a remote desktop connection request;

connect to a network gateway based on the remote desktop connection request;

initiate a first connection with a server via the network gateway using a first communication protocol;

exchange a plurality of cryptographic contexts with the server;

receive a token encrypted using one of the plurality of cryptographic contexts from the server;

send the token from a client device to the server or a proxy to authenticate the client device; and

initiate a second connection with the server, via the proxy, wherein the second connection is initiated using a second communication protocol.

15. The system of claim 14, wherein the processors are operable when initiating the first connection with the server to:

provide authentication credentials to authenticate the client device with the network gateway.

16. The system of claim 14, wherein the token comprises authentication information for authenticating the client device.

17. The system of claim 14, wherein authenticating the client device comprises:

authenticating the client device with the server using the token; and

breaking the first connection with the server.

18. The system of claim 14, wherein initiating the second connection comprises:

performing a first authentication step with respect to the proxy; and

performing a second authentication step with respect to the server, wherein the first authentication step and the second authentication step are performed using the token.

19. The system of claim 14, wherein the first communication protocol is TCP.

20. The system of claim 14, wherein the second communication protocol is UDP Plus.