A method and system for establishing a channel for a cloud desktop platform gateway

Abstract

The present invention relates to the field of communication technology, and in particular to a method and system for establishing a channel for a cloud desktop platform gateway. The application gateway acts as a TCP Socket server, and the media gateway and the signaling gateway act as TCP Socket clients to initiate a TCP Socket connection to the application gateway. After the connection is successful, the media gateway and the signaling gateway act as SSH servers, and the application gateway acts as an SSH client to actively initiate an SSH negotiation and authentication request to the media gateway and the signaling gateway to establish an SSH channel. The method comprises at least the following steps: S1, a terminal sends a cloud desktop message connection request to the application gateway, the connection request includes a key connection protocol, and the application gateway forwards the cloud desktop message request. The application gateway of the present invention can automatically expand and deploy signaling gateways and media gateways without pre-judging terminal services. A modified SSH connection method is used in the application gateway, signaling gateway and media gateway of the cloud desktop platform, and multiple independent signaling gateways and media gateways are deployed to expand the gateway capacity.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method and system for establishing a channel for a cloud desktop platform gateway. Background Art

[0002] The existing VDI cloud desktop platform uses an application gateway to provide cloud desktop information and authentication tokens to external network terminals for authorized access to cloud desktops, such as Figure 2 As shown in the figure, when the external network terminal carries the authentication token and accesses the cloud desktop through the signaling gateway and media gateway, it can access the cloud desktop if the authentication token is verified, ensuring the control, security and effectiveness of access. The application gateway actively connects to the signaling gateway and media gateway through SSH, and can issue and check the authentication token information at any time and securely.

[0003] However, existing application gateways need to know the information of existing signaling gateways and media gateways in advance and actively connect to them. They cannot expand the capacity of the gateway online, and their disaster recovery capabilities will also be reduced. In the event of a gateway outage, they cannot normally connect and disconnect and monitor cloud desktops, reducing the gateway's load capacity and disaster recovery capabilities. Summary of the Invention

[0004] The purpose of the present invention is to overcome the defects of the prior art and provide a method for establishing a channel in a cloud desktop platform gateway.

[0005] The present invention provides a method for establishing a channel for a cloud desktop platform gateway. The application gateway acts as a TCP Socket server, and the media gateway and the signaling gateway act as TCP Socket clients to initiate a TCP Socket connection to the application gateway. After the connection is successful, the media gateway and the signaling gateway act as SSH servers, and the application gateway acts as an SSH client to actively initiate SSH negotiation and authentication requests to the media gateway and the signaling gateway to establish an SSH channel.

[0006] The method comprises at least the following steps:

[0007] S1, the terminal sends a cloud desktop message connection request to the application gateway, the connection request includes a key connection protocol, and the application gateway forwards the cloud desktop message request;

[0008] S2: The application gateway generates an authentication token and sends it to the signaling gateway and media gateway. The application gateway responds with the cloud desktop information and returns the authentication token to the terminal.

[0009] S3, the signaling gateway and the media gateway are respectively connected to the application gateway through the SSH channel to register with the application gateway. When the terminal carries the authentication token to access the cloud desktop server through the media gateway and the signaling gateway, the media gateway and the signaling gateway verify the authentication token. If the media gateway and the signaling gateway verify that the authentication token is legal, the signaling gateway establishes a cloud desktop session with the cloud desktop, and the media gateway performs flow control operations with the cloud desktop. If the signaling gateway and the media gateway verify that the authentication token is illegal, an illegal authentication token is returned to the terminal.

[0010] S4, the cloud desktop server responds to the forwarding request cloud desktop message, and the cloud desktop server and the terminal establish a connection through the connection request.

[0011] Furthermore, in step S2, the application gateway sends the authentication token to the signaling gateway and the media gateway in a round-robin manner.

[0012] Furthermore, in step S3, the signaling gateway and media gateway further include a plurality of media gateways and signaling gateways, and the plurality of signaling gateways and media gateways are respectively connected to the application gateway via SSH channels.

[0013] Furthermore, in step S1, the terminal sends a cloud desktop message connection request to the application gateway, wherein the connection request includes a key connection protocol, and a connection between the cloud desktop server and the terminal is established by verifying the key of the key connection protocol.

[0014] A system using a cloud desktop platform gateway to establish a channel method,

[0015] The system includes:

[0016] Terminal: used to send cloud desktop message connection requests to the application gateway, carrying authentication tokens to access the cloud desktop;

[0017] The application gateway acts as a TCP socket server, and the media gateway and signaling gateway act as TCP socket clients to initiate a TCP socket connection to the application gateway. After the connection is successful, the media gateway and signaling gateway act as SSH servers, and the application gateway acts as an SSH client to initiate SSH negotiation and authentication requests to the media gateway and signaling gateway to establish an SSH channel.

[0018] The application gateway includes a cloud desktop message forwarding request unit and an authentication token generation unit, which are used to forward cloud desktop message request, generate authentication token and send it to the signaling gateway and media gateway; respond to cloud desktop message and return authentication token;

[0019] The signaling gateway and the media gateway include an authentication token validity judgment unit, which is used to judge whether the generated authentication token message is legal. If the media gateway and the signaling gateway verify that the authentication token is legal, the signaling gateway establishes a cloud desktop session with the cloud desktop, and the media gateway and the cloud desktop perform flow control operations; if the media gateway and the signaling gateway verify that the authentication token is illegal, an illegal authentication token is returned to the terminal;

[0020] Cloud desktop server: used to respond to the forwarding request cloud desktop message, and the cloud desktop server and the terminal establish a connection through the connection request.

[0021] Furthermore, the signaling gateway and media gateway include several media gateways and signaling gateways, and the several signaling gateways and media gateways are respectively connected to the application gateway through SSH channels;

[0022] Compared with the prior art, the present invention has the following beneficial effects:

[0023] (1) The present invention uses a modified SSH connection method, with the application gateway serving as a TCP Socket server, the media gateway and the signaling gateway serving as TCP Socket clients, and other media gateways and signaling gateways connected to the application gateway, so that the application gateway can automatically expand and deploy signaling gateways and media gateways without prejudging terminal services; the modified SSH connection method is used in the application gateway, signaling gateway, and media gateway of the cloud desktop platform, and multiple independent signaling gateways and media gateways are deployed to expand the gateway capacity. The gateways can register with the application gateway at any time, and register with the application gateways after startup. The application gateway can select any successfully registered signaling gateway and media gateway and send information, or send information to the signaling gateway and media gateway in a polling distribution manner, without affecting business continuity, improving load capacity, and reducing downtime risks;

[0024] (2) When the signaling gateway and media gateway of the present invention receive a request from an external network terminal to access the cloud desktop, they verify the legitimacy of the authorization authentication token generated by the application gateway to determine whether the external network terminal continues to access the cloud desktop, so that the external network terminal can immediately and securely access the cloud desktop through the media gateway and signaling gateway. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The following drawings are merely provided for illustrative purposes only and are not intended to limit the scope of the present invention.

[0026] Figure 1 : The signaling gateway and media gateway of the present invention use the modified SSH active registration access application gateway flow chart;

[0027] Figure 2 : The existing technology uses the gateway to actively connect to the signaling gateway and the media gateway and the authorization and authentication process through SSH. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solution, design method and advantages of the present invention more clear, the present invention is further described in detail below through specific embodiments in conjunction with the accompanying drawings. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0029] like Figure 1 As shown, the present invention provides a method for establishing a channel for a cloud desktop platform gateway, comprising the following steps:

[0030] The application gateway acts as a TCP socket server, and the media gateway and signaling gateway act as TCP socket clients to initiate a TCP socket connection to the application gateway. After the connection is successful, the media gateway and signaling gateway act as SSH servers, and the application gateway acts as an SSH client to initiate SSH negotiation and authentication requests to the media gateway and signaling gateway to establish an SSH channel.

[0031] The method comprises at least the following steps:

[0032] S1, the terminal sends a cloud desktop message connection request to the application gateway, the connection request includes a key connection protocol, and the application gateway forwards the cloud desktop message request;

[0033] S2: The application gateway generates an authentication token and sends it to the signaling gateway and media gateway. The application gateway responds to the cloud desktop information and returns the authentication token to the terminal (the software that indirectly obtains cloud desktop related information when the application gateway external terminal is connected to the intranet cloud platform).

[0034] In step S3, the signaling gateway and the media gateway are respectively connected to the application gateway through an SSH channel to register with the application gateway. When the terminal carries an authentication token to access the cloud desktop server through the media gateway and the signaling gateway, the media gateway and the signaling gateway verify the authentication token. If the authentication token is verified to be legitimate by the media gateway and the signaling gateway, the signaling gateway establishes a cloud desktop session with the cloud desktop (software that indirectly connects and disconnects desktop sessions when an extranet terminal is connected to an intranet cloud desktop); the media gateway and the cloud desktop perform flow control operations (software that monitors resources such as traffic or image quality when an extranet terminal is connected to an intranet cloud desktop);

[0035] S4, the cloud desktop server responds to the forwarding request cloud desktop message, and the cloud desktop server and the terminal establish a connection through the connection request;

[0036] It should be noted that the application gateway acts as a TCP socket server, while the media gateway and signaling gateway act as TCP socket clients, initiating a TCP socket connection to the application gateway. Once the connection is successful, the media gateway and signaling gateway act as SSH servers, while the application gateway acts as an SSH client to initiate SSH negotiation and authentication requests to the media gateway and signaling gateway to establish an SSH channel. The signaling gateway and media gateway can automatically register with the application gateway and establish an SSH channel without restarting the application gateway or interrupting gateway services. The signaling gateway and media gateway can securely issue authentication token validation information in real time, and they can be deployed and expanded at any time. Multiple signaling gateways and media gateways can be independently deployed and registered with the application gateway at any time. The application gateway does not need to know which signaling gateways and media gateways will be connected at startup, and the application gateway does not need to be restarted when adding new signaling gateways and media gateways. This does not affect service continuity and increases expansion flexibility. The application gateway can securely issue authentication token validation information at any time through the SSH channel, ensuring both real-time and secure information delivery. When external network terminals carry authentication tokens to access cloud desktops through signaling gateways and media gateways, verification can be completed quickly and at any time, improving the security and timeliness of access to cloud desktops.

[0037] Furthermore, in step S2, the application gateway sends the authentication token to the signaling gateway and the media gateway in a round-robin manner;

[0038] It should be noted that the application gateway can select any successfully registered signaling gateway and media gateway and send information, or it can send information to the signaling gateway and media gateway in a round-robin manner;

[0039] Furthermore, in step S3, the signaling gateway and media gateway further include a plurality of media gateways and signaling gateways, and the plurality of signaling gateways and media gateways are respectively connected to the application gateway via SSH channels; additional deployment of signaling gateways and media gateways can register with the application gateway at any time without affecting business continuity, improving load capacity, and reducing downtime risks;

[0040] Further, in step S1, the terminal sends a cloud desktop message connection request to the application gateway, wherein the connection request includes a key connection protocol, and a connection is established between the cloud desktop server and the terminal by verifying the key of the key connection protocol;

[0041] A system for establishing a channel using a cloud desktop platform gateway, comprising:

[0042] The system includes:

[0043] Terminal: used to send cloud desktop message connection requests to the application gateway, carrying authentication tokens to access the cloud desktop;

[0044] The application gateway acts as a TCP socket server, and the media gateway and signaling gateway act as TCP socket clients to initiate a TCP socket connection to the application gateway. After the connection is successful, the media gateway and signaling gateway act as SSH servers, and the application gateway acts as an SSH client to initiate SSH negotiation and authentication requests to the media gateway and signaling gateway to establish an SSH channel.

[0045] The application gateway includes a cloud desktop message forwarding request unit and an authentication token generation unit, which are used to forward cloud desktop message request, generate authentication token and send it to the signaling gateway and media gateway; respond to cloud desktop message and return authentication token;

[0046] The signaling gateway and the media gateway include an authentication token validity judgment unit, which is used to judge whether the generated authentication token message is legal. If the media gateway and the signaling gateway verify that the authentication token is legal, the signaling gateway establishes a cloud desktop session with the cloud desktop, and the media gateway and the cloud desktop perform flow control operations; if the media gateway and the signaling gateway verify that the authentication token is illegal, an illegal authentication token is returned to the terminal;

[0047] Cloud desktop server: used to respond to the forwarding request cloud desktop message, and the cloud desktop server and the terminal establish a connection through the connection request;

[0048] The signaling gateway and media gateway include several media gateways and signaling gateways, and the several signaling gateways and media gateways are respectively connected to the application gateway through SSH channels;

[0049] In specific implementation, Figure 1 After the cloud desktop platform is connected to the application gateway, signaling gateway and media gateway, the external network terminal needs to access the VDI-based cloud desktop of the cloud desktop platform. The external network terminal obtains the VDI cloud desktop information from the cloud desktop platform through the application gateway. The application gateway generates an authorization authentication token and returns it to the external network terminal. At the same time, it immediately sends the verification authentication token information to the signaling gateway and media gateway. When the signaling gateway and the media gateway receive the request to access the cloud desktop from the external network terminal, they check the legitimacy of the authorization authentication token generated by the application gateway to determine whether the external network terminal continues to access the cloud desktop. The application gateway ensures the timeliness and security of the information it sends to the signaling gateway and the media gateway, and ensures that the signaling gateway and the media gateway can be added at any time without interrupting the gateway business, and automatically register with the application gateway.

[0050] It is worth noting that the application gateway of this application automatically identifies the registered signaling gateway and media gateway without restarting, and can realize the application gateway to securely and in real time send information for verifying the legitimacy of the authentication token, so that the external network terminal can immediately and securely access the cloud desktop through the media gateway and signaling gateway;

[0051] The signaling gateway and media gateway can automatically register with the application gateway and establish a secure communication channel without restarting the application gateway or interrupting gateway services. The signaling gateway can securely issue information used to verify the legitimacy of the authentication token in real time. The signaling gateway and media gateway can be deployed and expanded at any time.

[0052] Among them, the application gateway sends information for checking the authentication token to the media gateway and signaling gateway through the established SSH channel; the application gateway securely and in real time sends information for verifying the legitimacy of the authentication token, so that external network terminals can immediately and securely access the cloud desktop through the media gateway and signaling gateway; the application gateway securely sends information for checking the authentication token at any time through the SSH channel, and the real-time and security of the information sent are guaranteed. When the external network terminal carries the authentication token to access the cloud desktop through the signaling gateway and media gateway, the verification can be completed at any time and quickly, improving the security and timeliness of access to the cloud desktop;

[0053] In specific implementations, the media gateway and signaling gateway can actively register with the application gateway, allowing the application gateway to securely and in real time deliver information for cloud desktop authentication. Furthermore, the application gateway can automatically expand and deploy signaling gateways and media gateways without foreseeing terminal services.

[0054] It should be noted that SSH in the traditional sense is a secure connection over TCP Socket. The SSH server is consistent with the TCP Socket server and uses the same port for listening. The SSH client is consistent with the TCP Socket client and actively initiates a request to the server to establish a connection. The present invention adopts a modified SSH connection method: the application gateway acts as the TCP Socket server, the media gateway and the signaling gateway act as TCP Socket clients, and several media gateways and signaling gateways are connected to the application gateway. The application gateway establishes a connection each time it listens to a connection request, so that the application gateway can automatically expand the deployment of signaling gateways and media gateways without pre-judging the terminal business. The technology of the present invention is used in the application gateway, signaling gateway and media gateway of the cloud desktop platform to increase the deployment of signaling gateways and media gateways, which can be registered with the application gateway at any time without affecting business continuity, improving load capacity and reducing the risk of downtime.

[0055] The present invention uses the application gateway as a TCP Socket server to listen to the designated port, and the media gateway and signaling gateway as TCP Socket clients to initiate a connection to the application gateway; on top of the TCP Socket connection, the media gateway and signaling gateway act as SSH servers, and the application gateway, as an SSH client, actively initiates a request to the media gateway and signaling gateway, and the terminal and the cloud desktop server perform key negotiation to establish an SSH channel;

[0056] The signaling gateway and media gateway proactively initiate a request to the application gateway. After the SSH channel is successfully established, the signaling gateway and media gateway automatically register with the application gateway. Multiple signaling gateways and media gateways can be deployed independently and register with the application gateway after startup.

[0057] The application gateway can select any successfully registered signaling gateway and media gateway and send information, or it can send information to the signaling gateway and media gateway in a round-robin manner; among them, the application gateway sends information for checking authentication tokens to the media gateway and signaling gateway through the established SSH channel.

[0058] The implementation process of using the modified SSH to establish a channel for the cloud platform gateway in this application is as follows:

[0059] The cloud desktop platform's application gateway listens for TCP sockets and receives TCP socket connections from the signaling and media gateways. Once the connection is established, the signaling and media gateways function as SSH servers, while the application gateway functions as an SSH client. Key negotiation is performed between the two ends, establishing a secure channel and subsystem.

[0060] like Figure 2 As shown, when the terminal requests cloud desktop authentication information from the application gateway, an authorization authentication token is generated and returned to the terminal. At the same time, corresponding authentication token verification information is sent to the signaling gateway and the media gateway. When the terminal connects to the cloud desktop through the signaling gateway and the media gateway, the signaling gateway and the media gateway verify the token; the technology of the present invention is used in the application gateway, signaling gateway and media gateway of the cloud desktop platform, and the signaling gateway and the media gateway are additionally deployed, so that they can be registered with the application gateway at any time without affecting business continuity, improving load capacity and reducing the risk of downtime.

[0061] It is worth noting that a method for establishing a channel for a cloud desktop platform gateway uses a modified SSH connection method, with the application gateway serving as a TCP Socket server, the media gateway and the signaling gateway serving as TCP Socket clients, and several media gateways and signaling gateways connected to the application gateway. The application gateway establishes a connection each time it listens to a connection request, thereby enabling the application gateway to automatically expand and deploy signaling gateways and media gateways without pre-judging terminal services. The technology of the present invention is used in the application gateway, signaling gateway and media gateway of the cloud desktop platform to increase the deployment of signaling gateways and media gateways, which can be registered with the application gateway at any time without affecting business continuity, improving load capacity and reducing the risk of downtime.

[0062] While various embodiments of the present invention have been described above, the above descriptions are intended to be illustrative, non-exhaustive, and not limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, their practical applications, or technological improvements in the marketplace, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for establishing a channel by a cloud desktop platform gateway, characterized in that: The application gateway acts as a TCP socket server, and the media gateway and signaling gateway act as TCP socket clients to initiate a TCP socket connection to the application gateway. After the connection is successful, the media gateway and signaling gateway act as SSH servers, and the application gateway acts as an SSH client to initiate SSH negotiation and authentication requests to the media gateway and signaling gateway to establish an SSH channel. The method comprises at least the following steps: S1, the terminal sends a cloud desktop message connection request to the application gateway, the connection request includes a key connection protocol, and the application gateway forwards the cloud desktop message request; S2: The application gateway generates an authentication token and sends it to the signaling gateway and media gateway. The application gateway responds with the cloud desktop information and returns the authentication token to the terminal. S3, the signaling gateway and the media gateway are respectively connected to the application gateway through the SSH channel to register with the application gateway. When the terminal carries the authentication token to access the cloud desktop server through the media gateway and the signaling gateway, the media gateway and the signaling gateway verify the authentication token. If the media gateway and the signaling gateway verify that the authentication token is legal, the signaling gateway establishes a cloud desktop session with the cloud desktop, and the media gateway performs flow control operations with the cloud desktop. If the signaling gateway and the media gateway verify that the authentication token is illegal, an illegal authentication token is returned to the terminal. S4, the cloud desktop server responds to the forwarding request cloud desktop message, and the cloud desktop server and the terminal establish a connection through the connection request.

2. A method for establishing a channel by a cloud desktop platform gateway according to claim 1, characterized in that: In step S2, the application gateway also sends the authentication token to the signaling gateway and the media gateway in a round-robin manner.

3. The method for establishing a channel by a cloud desktop platform gateway according to claim 2, characterized in that: In step S3, the signaling gateway and media gateway further include several media gateways and signaling gateways, and the several signaling gateways and media gateways are respectively connected to the application gateway via SSH channels.

4. The method for establishing a channel by a cloud desktop platform gateway according to claim 1, characterized in that: In step S1, the terminal sends a cloud desktop message connection request to the application gateway. The connection request includes a key connection protocol, and a connection between the cloud desktop server and the terminal is established by verifying the key of the key connection protocol.

5. A system using the method for establishing a channel using a cloud desktop platform gateway according to any one of claims 1 to 4, the system comprising: Terminal: used to send cloud desktop message connection requests to the application gateway, carrying authentication tokens to access the cloud desktop; The application gateway acts as a TCP socket server, and the media gateway and signaling gateway act as TCP socket clients to initiate a TCP socket connection to the application gateway. After the connection is successful, the media gateway and signaling gateway act as SSH servers, and the application gateway acts as an SSH client to initiate SSH negotiation and authentication requests to the media gateway and signaling gateway to establish an SSH channel. The application gateway includes a cloud desktop message forwarding request unit and an authentication token generation unit, which are used to forward cloud desktop message request, generate authentication token and send it to the signaling gateway and media gateway; respond to cloud desktop message and return authentication token; The signaling gateway and media gateway include an authentication token validity judgment unit, which is used to judge whether the generated authentication token message is legal. If the media gateway and signaling gateway verify that the authentication token is legal, the signaling gateway establishes a cloud desktop session with the cloud desktop, and the media gateway performs flow control operations with the cloud desktop. If the media gateway and signaling gateway verify that the authentication token is invalid, they return an invalid authentication token to the terminal; Cloud desktop server: used to respond to the forwarding request cloud desktop message, and the cloud desktop server and the terminal establish a connection through the connection request.

6. A cloud desktop platform gateway channel establishment system according to claim 5, characterized in that: 所述 The signaling gateway and the media gateway include several media gateways and signaling gateways, and the several signaling gateways and media gateways are respectively connected to the application gateway through SSH channels.

Images