Transferring data between computing systems

Patent metadata

Field	Value
Publication number	US-11683370-B2
Application number	US-202117213578-A
Country	US
Kind code	B2
Filing date	Mar 26, 2021
Priority date	Mar 26, 2021
Publication date	Jun 20, 2023
Grant date	Jun 20, 2023

Abstract

A backend computing system may receive first data from a first computing system, where the first data may be an encrypted version of second data that has been generated at the first computing system based on a command at the first computing system. The backend computing system may identify a second computing system different than the first computing system based on a status of the second computing system, and may send the first data to the second computing system to enable the second computing system to decrypt the first data and perform a function with respect to the second data. In some embodiments, the first computing system may generate padded data by adding data to the second data, and send the padded data to the backend computing system. In some embodiments, the first computing system may send random data to the backend computing system.

First claim

What is claimed is:

1. A method, comprising:
receiving, by a backend computing system, first data from a first computing system, the first data having been generated by the first computing system by encrypting second data, and the second data having been determined based on a command at the first computing system;
identifying, by the backend computing system, a user session identifier associated with the first computing system and a second computing system, the user session identifier indicating that a user is accessing the first computing system and the second computing system using a client device; and
based at least in part on identifying the user session identifier, sending, by the backend computing system, the first data to the second computing system to enable the second computing system to decrypt the first data and perform a function with respect to the second data.

2. The method of claim 1 , further comprising:
determining a score for the user of the client device, the score being based at least in part on data corresponding to past user sessions for the user, and
wherein determining to send the first data to the second computing system is further based at least in part on the score.

3. The method of claim 1 , further comprising:
decrypting, by at least a first service component of the backend computing system, the first data to determine the second data;
determining, by the first service component, that the second data satisfies a policy associated with at least one of the first computing system and the second computing system; and
determining, by the backend computing system, to send the first data to the second computing system based at least in part on the second data satisfying the policy.

4. The method of claim 1 , wherein the first computing system is configured to provide a first virtualized application to a client device, and the second computing system is configured to provide a second virtualized application to the client device.

5. The method of claim 1 , wherein the command at the first computing system is a copy command, received from the client device, with respect to the second data.

6. The method of claim 1 , further comprising:
determining, by the backend computing system, that the second computing system received a paste command from the client device; and
determining, by the backend computing system, to send the first data to the second computing system based at least in part on the second computing system having received the paste command from the client device.

7. The method of claim 1 , further comprising:
decrypting, by at least a first service component of the backend computing system, the first data to determine the second data;
determining, by the first service component, that the second data does not include malicious content; and
determining, by the backend computing system, to send the first data to the second computing system based at least in part on determining that the second data does not include malicious content.

8. The method of claim 1 , wherein the first data is received at a first service component of the backend computing system, and the method further comprises:
decrypting, at a second service component of the backend computing system that is separate from the first service component, the first data to determine the second data;
approving, by the second service component, sending of the first data to the second computing system based at least in part on evaluation of the second data;
sending, from the second service component to the first service component, a message authorizing the first service component to send the first data to the second computing system; and
determining, by the first service component, to send the first data to the second computing system based at least in part on receiving the message from the second service component.

9. The method of claim 1 , wherein:
the second data is written to a first buffer of a first operating system of the first computing system, and
sending the first data to the second computing system causes the second computing system to write the second data to a second buffer of a second operating system of the second computing system.

10. A method, comprising:
receiving, at a remote server from a first computing system, padded data including first data and second data determined based on a copy command received at the first computing system from a client device;
identifying, by the remote server, a user session identifier associated with the first computing system and a second computing system, the user session identifier indicating that a user is accessing the first computing system and the second computing system using the client device; and
based at least in part on identifying the user session identifier, sending, from the remote server, encrypted data based on the padded data to the second computing system.

11. The method of claim 10 , wherein the first computing system is configured to provide a first virtualized application to the client device and the command is received in response to the client device interacting with the first virtualized application.

12. The method of claim 10 , wherein the first computing system is configured to provide a first virtualized application to the client device, and the second computing system is configured to provide a second virtualized application to the client device.

13. The method of claim 10 , further comprising:
generating, at the first computing system, third data without having received from the client device a command to copy the third data; and
sending, from the first computing system to the remote server, the third data to obfuscate data traffic between the first computing system and the remote server.

14. The method of claim 10 , wherein the encrypted data does not flow through the client device.

15. A method, comprising:
receiving, at a first computing system from a client device, a command to copy first data;
sending, from the first computing system to a remote server, encrypted data based at least in part on the first data to enable the remote server to send the encrypted data to a second computing system;
generating, at the first computing system, second data without having received from the client device a second command to copy the second data; and
sending, from the first computing system to the remote server, the second data to obfuscate data traffic between the first computing system and the remote server.

16. The method of claim 15 , wherein the first computing system is configured to provide a first virtualized application to the client device and the command is received in response to the client device interacting with the first virtualized application.

17. The method of claim 15 , wherein the first computing system is configured to provide a first virtualized application to the client device, and the second computing system is configured to provide a second virtualized application to the client device.

18. The method of claim 15 , further comprising:
generating, at the first computing system, padded data by adding third data to the first data;
wherein the encrypted data is based on the padded data.

19. The method of claim 15 , wherein the encrypted data does not flow through the client device.

Assignees

• Citrix Systems Inc

Inventors

• Nord Joseph
• Mayers Chris

Classifications

• H04L67/1095 Primary

  Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes · CPC title

• H04L67/34

  involving the movement of software or configuration parameters  (network booting or remote initial program loading [RIPL] G06F9/4416) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0435

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title

• H04L67/306

  User profiles · CPC title