Systems and methods for a VPN ICA proxy on a multi-core system

Patent metadata

Field	Value
Publication number	US-9055064-B2
Application number	US-97772510-A
Country	US
Kind code	B2
Filing date	Dec 23, 2010
Priority date	Dec 28, 2009
Publication date	Jun 9, 2015
Grant date	Jun 9, 2015

Abstract

The present invention is directed towards systems and methods for sharing licenses across resources via a multi-core intermediary device. A device intermediary to a plurality of clients and a server may grant a license for a virtual private network (VPN) session established by a first core of a plurality of cores of the device with a client. A second core of the plurality of cores may receive a first request from the client to establish an application connection between an application and a server via the VPN session. The second core may send a second request to the first core to share the license of the VPN session responsive to determining that the first core owns the VPN session. The second core may establish the application connection responsive to receiving from the first core a response accepting the second request to share the license of the VPN session.

First claim

We claim:

1. A method for sharing licenses across resources via a multi-core intermediary device, the method comprising:
(a) granting, by a device intermediary to a plurality of clients and a server, a license for a virtual private network (VPN) session established by a first processor core of a plurality of processor cores of the device with a client, the license configured for use in granting permission to access a resource of the server via the VPN session;
(b) receiving, by a second processor core of the plurality of processor cores, from the client a first request to establish an application connection between an application and the server via the VPN session;
(c) sending, by the second processor core to the first processor core, a second request to share the license of the VPN session responsive to determining that the first processor core owns the VPN session, wherein determining comprises
identifying via a provisioning list that the license for the VPN session is granted to the first processor core;

(d) establishing, by the second processor core, the application connection responsive to receiving from the first processor core a response accepting the second request to share the license of the VPN session, wherein sharing comprises
allowing the first processor core and the second processor core to use the license to access the resource via the VPN session, and
updating, by the first processor core, the provisioning list to indicate the sharing of the license between the VPN session and the application connection.

2. The method of claim 1 , wherein step (a) further comprises granting the license from a pool of licenses managed via the device.

3. The method of claim 1 , wherein step (a) further comprises establishing the VPN session for a user of a plurality of users for access to a domain.

4. The method of claim 3 , wherein step (b) further comprises receiving the first request from the user to access a resource of the domain.

5. The method of claim 1 , wherein step (c) further comprises determining, by the second processor core, from the provisioning list that the first processor core owns the VPN session.

6. The method of claim 1 , wherein step (d) further comprises determining, by the first processor core, that the first request is for access to the same domain as the VPN session.

7. The method of claim 1 , further comprising disestablishing, by the second processor core, the application connection and sending a message to the first processor core to update the first processor core's provisioning list.

8. The method of claim 1 , further comprising maintaining, by the device, a single VPN session for each user in connection with a domain.

9. The method of claim 1 , further comprising, receiving by a third processor core of the plurality of processor core, a third request to establish a second application connection and establishing, by the third processor core, the second application connection responsive to receiving from the first processor core a second response accepting a fourth request to share the license of the VPN session.

10. A system for sharing licenses across resources via a multi-core intermediary device, the system comprising:
a device intermediary to a plurality of clients and a server, the device comprising at least one processor at least partially implemented in hardware and configured to grant a license for a virtual private network (VPN) session established by a first processor core of a plurality of processor cores of the device with a client, the license configured for use in granting permission to access a resource of the server via the VPN session;
a second processor core of the plurality of processor cores of the device configured for receiving from the client a first request to establish an application connection between an application and the server via the VPN session and configured for sending to the first processor core a second request to share the license of the VPN session responsive to determining that the first processor core owns the VPN session, wherein determining comprises identifying via a provisioning list that the license for the VPN session is granted to the first processor core; and wherein
the second processor core is configured to establish the application connection responsive to receiving from the first processor core a response accepting the second request to share the license of the VPN session, wherein sharing comprises allowing the first processor core and the second processor core to use the license to access the resource via the VPN session, and
the first processor core is further configured to update the provisioning list to indicate the sharing of the license between the VPN session and the application connection.

11. The system of claim 10 , wherein the at least one processor is configured to manage a pool of licenses for resources accessed via the device.

12. The system of claim 10 , wherein the device establishes the VPN session for a user of a plurality of users for access to a domain.

13. The system of claim 12 , wherein the device receives the first request from the user to access a resource of the domain.

14. The system of claim 10 , wherein the second processor core determines from the provisioning list that the first processor core owns the VPN session.

15. The system of claim 10 , wherein the first processor core determines that the first request is for access to the same domain as the VPN session.

16. The system of claim 10 , wherein the second processor core disestablishes the application connection and sends a message to the first processor core to update the first processor core's provisioning list.

17. The system of claim 10 , wherein the device maintains a single VPN session for each user in connection with a domain.

18. The system of claim 10 , wherein a third processor core of the plurality of processor cores receives a third request to establish a second application connection and establishes the second application connection responsive to receiving from the first processor core, a second response accepting a fourth request to share the license of the VPN session.

Assignees

• Kumar Arkesh
• Ramachandra Pratap
• Citrix Systems Inc

Inventors

• Kumar Arkesh
• Ramachandra Pratap

Classifications

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title

• G06F21/105

  Arrangements for software license management or administration, e.g. for managing licenses at corporate level · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/0272 Primary

  Virtual private networks · CPC title