Computing system and related methods providing connection lease infrastructure with gateway appliance failover

Patent metadata

Field	Value
Publication number	US-11394535-B2
Application number	US-202016882856-A
Country	US
Kind code	B2
Filing date	May 26, 2020
Priority date	May 20, 2019
Publication date	Jul 19, 2022
Grant date	Jul 19, 2022

Abstract

A computing system may include a plurality of Point of Presence computing devices (PoPs) configured to provide access to a computing network(s), and a plurality of gateway appliances. The gateway appliances may be configured to relay communications between client devices and virtual delivery appliances to provide the client devices with access to virtual sessions. The gateway appliances may route client device communications through the PoPs based upon gateway connection tickets, and may also generate the gateway connection tickets including a payload encrypted with a symmetric encryption key, and a plurality of different versions of the symmetric key encrypted with different public encryption keys of the PoPs. The PoPs may be further configured to use their private encryption keys to decrypt the encrypted symmetric key, use the decrypted symmetric key to decrypt the payload, and permit routing of the client communications based upon the decrypted payload of the gateway connection tickets.

First claim

That which is claimed is:

1. A method comprising:
at a gateway appliance, relaying communications between client devices requesting access to virtual sessions and virtual delivery appliances providing the client devices with access to the virtual sessions;
at the gateway appliance, routing client device communications through a plurality of Point of Presence (PoP) computing devices configured to provide access to at least one computing network based upon gateway connection tickets, the PoP computing devices having respective public/private encryption key pairs associated therewith, and
at the gateway appliance, generating the gateway connection tickets including a payload encrypted with a symmetric encryption key, and a plurality of different versions of the symmetric key encrypted with different public encryption keys of the PoP computing devices so that the PoP computing devices may use their private encryption keys to decrypt the version of the symmetric key encrypted with their public encryption keys, use the decrypted symmetric key to decrypt the payload, and permit routing of the client communications based upon the decrypted payload of the gateway connection tickets.

2. The method of claim 1 wherein the gateway connection tickets are further signed by private encryption keys of the PoP computing devices.

3. The method of claim 1 further comprising, at the gateway appliance, exchanging authorization and virtual session delivery data of the client communications using separate tunnels over a common transport layer session.

4. The method of claim 1 wherein the gateway connection tickets further comprise an expiration time after which the gateway appliance will no longer permit routing of the client communications.

5. The method of claim 1 wherein the gateway connection tickets further comprise a creation time, and further comprising, at the gateway appliance, ceasing permitting routing of the client communications for creation times older than a threshold age.

6. The method of claim 1 wherein the gateway connection tickets further comprise an authentication token so that the client devices do not have to resend login credentials after establishing a connection with a gateway appliance.

7. The method of claim 1 wherein the payloads of the gateway connection tickets comprise at least one of a virtual delivery appliance Internet Protocol (IP) address, fully qualified domain name (FQDN), and a network port number.

8. The method of claim 1 further comprising, at the gateway appliance, authorizing connections from the client devices to the virtual delivery appliances by verifying the signatures of the gateway connection tickets and an expiration time of the gateway connection tickets.

9. The method of claim 1 further comprising, at the gateway appliance, recovering the payload using the symmetric key responsive to the verification of the signatures.

10. A computing system comprising:
a plurality of Point of Presence (PoP) computing devices configured to provide access to at least one computing network, the PoP computing devices having respective public/private encryption key pairs associated therewith; and
a plurality of gateway appliances configured to
relay communications between client devices requesting access to virtual sessions and virtual delivery appliances to provide the client devices with access to the virtual sessions, the gateway appliances routing client device communications through the PoP computing devices based upon gateway connection tickets, and
generate the gateway connection tickets including a payload encrypted with a symmetric encryption key, and a plurality of different versions of the symmetric key encrypted with different public encryption keys of the PoP computing devices;

wherein the PoP computing devices are further configured to use their private encryption keys to decrypt the version of the symmetric key encrypted with their public encryption keys, use the decrypted symmetric key to decrypt the payload, and permit routing of the client communications based upon the decrypted payload of the gateway connection tickets.

11. The computing system of claim 10 wherein the gateway connection tickets are further signed by private encryption keys of the PoP computing devices.

12. The computing system of claim 10 wherein the PoP computing devices are configured to access the public encryption keys of the other PoP computing devices from a shared database.

13. The computing system of claim 10 wherein the PoP computing devices are configured to exchange their public encryption keys between one another.

14. The computing system of claim 10 wherein the at least one computing network comprises a cloud computing network.

15. A gateway appliance comprising:
a memory and a processor configured to cooperate with the memory to
relay communications between client devices requesting access to virtual sessions and virtual delivery appliances providing the client devices with access to the virtual sessions,
route client device communications through a plurality of Point of Presence (PoP) computing devices configured to provide access to at least one computing network based upon gateway connection tickets, the PoP computing devices having respective public/private encryption key pairs associated therewith, and
generate the gateway connection tickets including a payload encrypted with a symmetric encryption key, and a plurality of different versions of the symmetric key encrypted with different public encryption keys of the PoP computing devices so that the PoP computing devices may use their private encryption keys to decrypt the version of the symmetric key encrypted with their public encryption keys, use the decrypted symmetric key to decrypt the payload, and permit routing of the client communications based upon the decrypted payload of the gateway connection tickets.

16. The gateway appliance of claim 15 wherein the gateway connection tickets are further signed by private encryption keys of the PoP computing devices.

17. The gateway appliance of claim 15 wherein the processor is configured to exchange authorization and virtual session delivery data of the client communications using separate tunnels over a common transport layer session.

18. The gateway appliance of claim 15 wherein the gateway connection tickets further comprise an expiration time after which the gateway appliance will no longer permit routing of the client communications.

19. The gateway appliance of claim 15 wherein the gateway connection tickets further comprise an authentication token so that the client devices do not have to resend login credentials after establishing a connection with a gateway appliance.

20. The gateway appliance of claim 15 wherein the payloads of the gateway connection tickets comprise at least one of a virtual delivery appliance Internet Protocol (IP) address, fully qualified domain name (FQDN), and a network port number.

21. The gateway appliance of claim 15 wherein the processor is further configured to authorize connections from the client devices to the virtual delivery appliances by verifying the signatures of the gateway connection tickets and an expiration time of the gateway connection tickets.

22. The gateway appliance of claim 21 wherein the processor is further configured to recover the payload using the symmetric key responsive to the verification of the signatures.

Assignees

• Citrix Systems Inc

Inventors

• Momchilov Georgy
• Divoux Hubert
• Valdes Roberto

Classifications

• H04L9/0827 Primary

  involving distinctive intermediate devices or communication paths (network architectures or network communication protocols using different networks H04L63/18) · CPC title

• H04L47/72 Primary

  using reservation actions during connection setup · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• H04L9/0822

  using key encryption key · CPC title