Computing system and related methods providing connection lease exchange and mutual trust protocol

Patent metadata

Field	Value
Publication number	US-11456860-B2
Application number	US-202016878172-A
Country	US
Kind code	B2
Filing date	May 19, 2020
Priority date	May 20, 2019
Publication date	Sep 27, 2022
Grant date	Sep 27, 2022

Abstract

A method may include establishing a transport layer session between a gateway appliance and at least one virtual delivery appliance, establishing a presentation layer session between the gateway appliance and the at least one virtual delivery appliance via the transport layer session, and establishing a connection lease exchange tunnel between the gateway appliance and the at least one virtual delivery appliance via the presentation layer session. The method further include receiving, at the at least one virtual delivery appliance, a connection lease from a client device via the gateway appliance through the connection lease exchange tunnel and validating the connection lease, and issuing a resource connection ticket at the at least one virtual delivery appliance to the client device through the connection lease exchange tunnel responsive to the validation.

First claim

That which is claimed is:

1. A method comprising:
establishing a transport layer session between a gateway appliance and at least one virtual delivery appliance;
establishing a presentation layer session between the gateway appliance and the at least one virtual delivery appliance within the transport layer session;
establishing a connection lease exchange tunnel between the gateway appliance and the at least one virtual delivery appliance within the presentation layer session;
receiving, at the at least one virtual delivery appliance, a connection lease from a client device via the gateway appliance through the connection lease exchange tunnel and validating the connection lease; and
issuing a resource connection ticket at the at least one virtual delivery appliance to the client device through the connection lease exchange tunnel responsive to the validation.

2. The method of claim 1 wherein the resource connection ticket is for causing the at least one virtual delivery appliance to connect the client device to a virtual session.

3. The method of claim 1 further comprising, at the gateway appliance, issuing a gateway connection ticket for the client device responsive to issuance of the resource connection ticket.

4. The method of claim 1 wherein the at least one virtual delivery appliance comprises a plurality of virtual delivery appliances; and further comprising:
at a broker computing device, re-directing a connection request for a first virtual delivery appliance to a second virtual delivery appliance; and
at the second virtual delivery appliance,
establishing a new transport layer session between the gateway appliance and the second virtual delivery appliance,
establishing a new presentation layer session within the new transport layer session,
establishing a new connection lease exchange tunnel within the presentation layer session,
receiving the connection lease from the client device via the gateway appliance through the new connection lease exchange tunnel and validating the connection lease, and
issuing a new resource connection ticket to the client device through the new connection lease exchange tunnel responsive to the validation.

5. The method of claim 1 further comprising:
establishing a client transport layer session between the gateway appliance and the client device;
establishing a client presentation layer session between the gateway appliance and the client device within the transport layer session;
establishing a client connection lease exchange tunnel between the gateway appliance and the client device within the presentation layer session;
receiving the connection lease at the gateway appliance from the client device through the client connection lease exchange tunnel; and
validating the connection lease.

6. The method of claim 5 further comprising, at the gateway appliance, issuing a gateway connection ticket responsive to issuance of the resource connection ticket, and forwarding the gateway connection ticket and the resource connection ticket to the client device.

7. The method of claim 6 further comprising, at the gateway appliance, terminating the client connection lease exchange tunnel and the client presentation layer session after forwarding the gateway connection ticket and the resource connection ticket.

8. The method of claim 1 further comprising, at the virtual delivery appliance, terminating the connection lease exchange tunnel and the presentation layer session after issuing the resource connection ticket.

9. The method of claim 1 wherein the presentation layer session comprises a Common Gateway Protocol (CGP) session.

10. The method of claim 1 wherein the transport layer session comprises at least one of a Transport Layer Security (TLS) session and a Transmission Control Protocol (TCP) session.

11. The method of claim 1 wherein the transport layer session comprises at least one of an Enlightened Data Transport (EDT) session, Datagram Transport Layer Security (DTLS) session, and a User Datagram Protocol (UDP) session.

12. A computing system comprising:
a gateway appliance; and
at least one virtual delivery appliance configured to cooperate with the gateway appliance to
establish a transport layer session between the gateway appliance and the at least one virtual delivery appliance,
establish a presentation layer session vin within the transport layer session,
establish a connection lease exchange tunnel within the presentation layer session,
receive a connection lease from a client device via the gateway appliance through the connection lease exchange tunnel and validate the connection lease, and
issue a resource connection ticket to the client device through the connection lease exchange tunnel responsive to the validation.

13. The computing system of claim 12 wherein the at least one virtual delivery appliance is further configured to connect the client device to a virtual session based upon the resource connection ticket.

14. The computing system of claim 12 wherein the at least one virtual delivery appliance comprises a plurality of virtual delivery appliances; and further comprising a broker computing device configured to re-direct a connection request for a first virtual delivery appliance to a second virtual delivery appliance.

15. The computing system of claim 14 wherein the second virtual delivery appliance is configured to establish a new transport layer session between the gateway appliance and the second virtual delivery appliance, establish a new presentation layer session within the new transport layer session, establish a new connection lease exchange tunnel within the presentation layer session, receive the connection lease from the client device via the gateway appliance through the new connection lease exchange tunnel and validate the connection lease, and issue a new resource connection ticket to the client device through the new connection lease exchange tunnel responsive to the validation.

16. The computing system of claim 12 wherein the gateway appliance is further configured to issue a gateway connection ticket responsive to issuance of the resource connection ticket, and forward the gateway connection ticket and the resource connection ticket to the client device.

17. The computing system of claim 16 wherein the client device is further configured to:
use a web application to establish the transport layer session, establish the presentation layer session, establish the connection lease exchange tunnel, and receive the gateway connection ticket and the resource connection ticket from the at least one virtual delivery appliance; and
use a native application to connect to a virtual session through the virtual delivery appliance with the gateway connection ticket and the resource connection ticket.

18. The computing system of claim 12 wherein the gateway appliance is further configured to cooperate with the client device to:
establish a client transport layer session between the gateway appliance and the client device;
establish a client presentation layer session with the client device within the transport layer session;
establish a client connection lease exchange tunnel with the client device within the presentation layer session;
receive the connection lease from the client device through the client connection lease exchange tunnel; and
validate the connection lease.

19. The computing system of claim 12 wherein the at least one virtual delivery appliance is further configured to terminate the connection lease exchange

Assignees

• Citrix Systems Inc

Inventors

• Momchilov Georgy
• Divoux Hubert
• Valdes Roberto

Classifications

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L12/4633 Primary

  Interconnection of networks using encapsulation techniques, e.g. tunneling · CPC title

• H04L12/66

  Arrangements for connecting between networks having differing types of switching systems, e.g. gateways · CPC title

• H04L12/4641

  Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272) · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title