A secure connection system and method for external network terminals and cloud desktops based on gateway access.

Abstract

This invention belongs to the field of communication technology, specifically disclosing a secure connection system between an external network terminal and a cloud desktop based on gateway access. The system includes an external network terminal and a cloud desktop server connected via a gateway. The gateway includes an application gateway, a signaling gateway, and a media gateway. The application gateway forwards and retrieves cloud desktop information, the signaling gateway controls the connection between the cloud desktop server and the external network terminal, and the media gateway monitors cloud desktop server information. The cloud desktop server generates cloud desktop information. The application gateway generates an authentication token, and the signaling gateway and media gateway verify the authentication token respectively. Based on this system, this invention also discloses a secure connection method between an external network terminal and a cloud desktop based on gateway access. The application gateway of this invention can securely send authentication token verification information to the signaling gateway and media gateway at any time when authorizing the authentication token to the terminal. When the external network terminal carries the authentication token, it can verify the authentication token and access the cloud desktop.

Description

Technical Field

[0001] This invention belongs to the field of communication technology, and specifically relates to a secure connection system and method between an external network terminal and a cloud desktop based on gateway access. Background Technology

[0002] External network terminals connected to VDI cloud desktops need to connect to the cloud desktop platform through a gateway to obtain connection information for accessing specific cloud desktops. External network terminals can then access and use the cloud desktops normally using this connection information. While a gateway typically provides secure access to the cloud platform and the acquisition of cloud desktop connection information from the external network, once a terminal exposed to the external network obtains this connection information, it can access the cloud desktops uncontrollably at any time, from any location, and by any user who has obtained the connection information, posing a threat and challenge to the secure use of cloud desktops. Furthermore, the gateway deployment of the cloud desktop platform is limited to centralized deployment, restricting scalability and increasing the risk of downtime. Summary of the Invention

[0003] Existing gateway technologies allow external network terminals to access cloud desktop information via HTTPS connections using usernames and passwords. These terminals then use this information to access the cloud desktop directly via TLS. While the cloud desktop access and connection process is secure, uncontrolled and prolonged access to the cloud desktop reduces security. Furthermore, a single gateway handling functions such as accessing cloud desktop information, connecting / disconnecting the desktop, and monitoring desktop resources hinders flexible deployment and expansion, reducing load and disaster recovery capabilities. Therefore, this invention provides a secure connection system and method between external network terminals and cloud desktops based on gateway access.

[0004] In a first aspect, the present invention provides a secure connection system between an external network terminal and a cloud desktop based on gateway access, comprising an external network terminal and a cloud desktop server connected through a gateway;

[0005] The gateway includes an application gateway, a signaling gateway, and a media gateway. The application gateway is used to forward and obtain cloud desktop information, the signaling gateway is used to control the connection between the cloud desktop server and the external network terminal, and the media gateway is used to monitor cloud desktop server information.

[0006] The application gateway is connected to the signaling gateway and the media gateway via the SSH protocol, respectively.

[0007] The cloud desktop server generates cloud desktop information based on the request information from the external network terminal;

[0008] The application gateway generates an authentication token based on the cloud desktop information, and the signaling gateway and media gateway respectively verify the authentication token.

[0009] A further solution is that the application gateway is configured with a sending module;

[0010] Both the signaling gateway and the media gateway are equipped with a receiving module;

[0011] The sending module is used to send an authentication token to the receiving module, and the receiving module receives and saves the authentication token.

[0012] A further solution is that the application gateway is configured with a key generation module. The key generation module generates a random public key MAC_KEY based on the cloud desktop information as the unique identifier of the cloud desktop information, and generates a private key KEY, and uses an encryption algorithm to generate an authentication token.

[0013] A further proposed solution is that the cloud desktop information includes at least the cloud desktop's IP address, port, connection duration, and traffic threshold.

[0014] A further embodiment is that the media gateway is configured with a traffic monitoring module, a duration monitoring module, and a second sending module;

[0015] The traffic monitoring module is used to monitor the communication traffic between the external network terminal and the cloud desktop server after the authentication token is successfully verified once.

[0016] The duration monitoring module is used to monitor the communication duration between the external network terminal and the cloud desktop server after the authentication token is successfully verified once.

[0017] The second sending module is used to send the communication traffic information and communication duration information to the signaling gateway, and the signaling gateway controls the connection between the cloud desktop server and the external network terminal based on the communication traffic information and communication duration information.

[0018] A second aspect of the present invention provides a method for secure connection between an external network terminal and a cloud desktop based on gateway access, using the above-described system, comprising the following steps:

[0019] The application gateway actively initiates SSH protocol connections to the signaling gateway and media gateway to establish a communication channel;

[0020] The external network terminal logs into the request page via HTTPS and a username and password, and requests cloud desktop information available for the username from the application gateway.

[0021] The application gateway forwards external terminal requests to the cloud desktop server. After the cloud desktop server responds to the external terminal requests, the application gateway generates an authentication token.

[0022] The signaling gateway and media gateway respectively verify the authentication token. If the verification is successful, the external network terminal and the cloud desktop server establish communication based on cloud desktop information. If the verification fails, the external network terminal and the cloud desktop server cannot establish communication.

[0023] A further solution is that the method for generating the authentication token is as follows: the application gateway generates a random public key MAC_KEY based on the cloud desktop information as the unique identifier of the cloud desktop, and generates a private key KEY, and uses an encryption algorithm to generate the authentication token.

[0024] A further proposed solution is that the verification process is as follows:

[0025] The application gateway sends a random public key MAC_KEY and a private key KEY to the signaling gateway and the media gateway, and the signaling gateway and the media gateway maintain the public key MAC_KEY and the private key KEY;

[0026] The application gateway sends the random public key MAC_KEY and authentication token to the external terminal.

[0027] The external network terminal sends a request to the signaling gateway and media gateway, carrying cloud desktop information, a random public key MAC_KEY, and an authentication token.

[0028] Upon receiving the request, the signaling gateway and media gateway look up the maintained random public key MAC_KEY and private key KEY according to the random public key MAC_KEY, and use the private key KEY to decrypt the authentication token.

[0029] A further proposed solution is that the cloud desktop information includes at least the cloud desktop's IP address, port, connection duration, and traffic threshold.

[0030] A further solution involves the following steps: After the external network terminal establishes communication with the cloud desktop server, the media gateway monitors the communication traffic information between the external network terminal and the cloud desktop server in real time through a traffic monitoring module, and sends the communication traffic information to the signaling gateway. The signaling gateway receives the communication traffic information and loads a control mechanism. Based on this control mechanism, the signaling gateway sends corresponding control commands to control the communication connection and disconnection between the external network terminal and the cloud desktop server.

[0031] The media gateway monitors the communication duration information between the external network terminal and the cloud desktop server in real time through the duration monitoring module, and sends the communication duration information to the signaling gateway. The signaling gateway receives the communication duration information and loads a control mechanism. Based on the control mechanism, the signaling gateway sends corresponding control commands to control the communication between the external network terminal and the cloud desktop server.

[0032] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0033] This invention improves load and disaster recovery capabilities by decomposing the original gateway functions into an application gateway, a signaling gateway, and a media gateway. It also adds the functions of generating authentication tokens and checking the validity of authentication tokens. This allows the application gateway to send verification information for the authentication token to the signaling gateway and the media gateway at any time and securely when authorizing the authentication token to the terminal. When an external terminal carries the authentication token, it can immediately verify the authentication token and access the cloud desktop.

[0034] This invention decomposes the cloud desktop server gateway function into application gateway, signaling gateway, and media gateway. One application gateway can connect to multiple signaling gateways and media gateways, enabling horizontal scaling of signaling and media gateways to application gateways. This increases the load capacity of signaling and media gateways while reducing the risk of a single signaling or media gateway failing, improving disaster recovery and availability. When generating an authentication token, the application gateway sends verification information to the signaling and media gateways via SSH, ensuring real-time and secure communication between the application gateway, signaling gateway, and media gateway. The signaling and media gateways determine whether an external terminal can continue to access the cloud desktop when verifying the validity of the authentication token received from an external terminal, improving the security of authorized desktop access.

[0035] The authentication token of this invention is generated based on the request of the external network terminal. Each authentication token corresponds to a set of cloud desktop information, namely, the IP address, port, connection duration, and traffic threshold of the cloud desktop. The IP address and port of the cloud desktop are used for the connection between the external network terminal and the cloud desktop. The connection duration and communication traffic are monitored in real time through the media gateway. When the connection duration or communication traffic reaches the preset threshold, the signaling gateway performs a disconnection operation, which avoids the cloud desktop being occupied for a long time without control after authorization and improves the security of cloud desktop use. Attached Figure Description

[0036] The following figures are for illustrative purposes only and are not intended to limit the scope of the invention, wherein:

[0037] Figure 1 Framework diagram of a secure connection system between external network terminals and cloud desktops;

[0038] Figure 2 : Diagram illustrating the access of application gateway, signaling gateway, and media gateway;

[0039] Figure 3 : A diagram illustrating the application gateway's proactive connection and authentication process to the signaling gateway and media gateway via SSH. Detailed Implementation

[0040] To make the objectives, technical solutions, design methods, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the invention.

[0041] like Figure 3 The present application provides a method for secure connection between an external network terminal and a cloud desktop based on gateway access, including the following steps:

[0042] S1. The signaling gateway enables the SSH service, and the application gateway actively initiates an SSH connection to the signaling gateway to establish a communication channel; the media gateway enables the SSH service, and the application gateway actively initiates an SSH connection to the media gateway to establish a communication channel; after the above two communication channels are established, the application gateway can send relevant information about the verification and authentication token to the signaling gateway and the media gateway at any time.

[0043] S2. External network terminals log in via HTTPS and username / password to request cloud desktop information available for the username from the application gateway, including the cloud desktop's IP, port, communication traffic information, and connection duration information.

[0044] S3. After performing necessary parameter checks, the application gateway forwards the request from the external terminal to the cloud desktop server to obtain cloud desktop information.

[0045] S4. The cloud desktop server obtains available cloud desktops based on the input parameters and returns their relevant information to the application gateway.

[0046] S5. The application gateway generates a random public key MAC_KEY for the cloud desktop as its unique identifier, and generates a private key KEY. Using the AES encryption algorithm, it generates an authentication token.

[0047] S6. The application gateway sends the public key MAC_KEY and private key KEY generated in S5 to the signaling gateway, and the signaling gateway maintains the public key MAC_KEY and private key KEY; the application gateway sends the public key MAC_KEY and private key KEY generated in S5 to the media gateway, and the media gateway maintains the public key MAC_KEY and private key KEY.

[0048] S7. The application gateway responds to the external terminal with the relevant information returned by the cloud desktop server, along with the public key MAC_KEY and authentication token.

[0049] S8, the external network terminal carries cloud desktop-related information, as well as the corresponding public key MAC_KEY and authentication token, and sends a request to the signaling gateway and media gateway;

[0050] S9. Upon receiving a request, the signaling gateway looks up and matches the public key MAC_KEY and private key KEY in its maintained database based on the public key MAC_KEY. It then uses the private key KEY to decrypt the authentication token and verifies the relevant parameters and whether they match the public key MAC_KEY. If the match is successful, the verification passes, and the signaling gateway forwards access to the cloud desktop based on the cloud desktop information carried, generating a session connection and returning it to the external network terminal. The external network terminal can then interact with the cloud desktop through this session. If the match fails, the verification fails. Similarly, upon receiving a request, the media gateway looks up and matches the public key MAC_KEY and private key KEY in its maintained database based on the public key MAC_KEY. It then uses the private key KEY to decrypt the authentication token and verifies the relevant parameters and whether they match the public key MAC_KEY. If the match is successful, the verification passes, and the media gateway forwards access to the cloud desktop based on the cloud desktop information carried, communicating with the cloud desktop and controlling the uplink and downlink rates between the external network terminal and the cloud desktop, as well as the frame rate returned by the cloud desktop to the external network terminal. If the match fails, the verification fails.

[0051] In step S5, the authentication token corresponds to the request information of the external network terminal. That is, after each authentication token is verified, the cloud desktop available to the external network terminal is determined, including the cloud desktop's IP, port, communication traffic information and connection duration information.

[0052] In step S9, after the authentication token is verified, the external network terminal establishes communication with the cloud desktop server. The media gateway monitors the communication traffic information between the external network terminal and the cloud desktop server in real time through the traffic monitoring module and sends the communication traffic information to the signaling gateway. The signaling gateway receives the communication traffic information and loads a control mechanism. Based on the control mechanism, the signaling gateway sends corresponding control commands to control the communication between the external network terminal and the cloud desktop server. Specifically, after each authentication token is verified, the cloud desktop information available to the external network terminal is fixed. The external network terminal connects to the cloud desktop using its IP address and port. When the media gateway detects that the communication traffic information between the external network terminal and the cloud desktop server exceeds a preset threshold, the signaling gateway controls the external network terminal to disconnect from the cloud desktop server. If the external network terminal needs to continue using the cloud desktop, it needs to resend the request. The media gateway also monitors the communication duration information between the external network terminal and the cloud desktop server in real time through a duration monitoring module, and sends the communication duration information to the signaling gateway. The signaling gateway receives the communication duration information and loads a control mechanism. Based on the control mechanism, the signaling gateway sends corresponding control commands to control the communication between the external network terminal and the cloud desktop server. Specifically, after each authentication token is verified, the cloud desktop information available to the external network terminal is fixed. The external network terminal connects to the cloud desktop using its IP address and port. When the media gateway detects that the communication duration information between the external network terminal and the cloud desktop server exceeds a preset threshold, the signaling gateway controls the external network terminal to disconnect from the cloud desktop server. If the external network terminal needs to continue using the cloud desktop, it needs to resend the request.

[0053] It should be noted that the methods for generating and verifying the authentication tokens involved in the above steps are not limited to the AES encryption algorithm, but also include any symmetric encryption and / or asymmetric encryption that can implement the generation and verification methods of the authentication tokens of this invention, as well as methods such as using key and / or public key-private key pairing.

[0054] To achieve the above-mentioned secure connection method between external network terminals and cloud desktops, such as Figure 1 and Figure 2 As shown, this embodiment also discloses a secure connection system between an external network terminal and a cloud desktop based on gateway access, including an external network terminal and a cloud desktop server connected through a gateway;

[0055] The gateway includes an application gateway, a signaling gateway, and a media gateway. The application gateway is used to forward and obtain cloud desktop information, the signaling gateway is used to control the connection between the cloud desktop server and the external network terminal, and the media gateway is used to monitor cloud desktop information.

[0056] The application gateway is connected to the signaling gateway and the media gateway via the SSH protocol, respectively.

[0057] The cloud desktop server generates cloud desktop information based on the request information from the external network terminal;

[0058] The application gateway generates an authentication token based on the cloud desktop information, and the signaling gateway and media gateway respectively verify the authentication token.

[0059] The application gateway is configured with a sending module; both the signaling gateway and the media gateway are configured with receiving modules; the sending module is used to send an authentication token to the receiving module, and the receiving module receives and saves the authentication token.

[0060] In the above, the application gateway is configured with a key generation module. The key generation module generates a random public key MAC_KEY based on the cloud desktop information as the unique identifier of the cloud desktop information, and generates a private key KEY, and uses an encryption algorithm to generate an authentication token.

[0061] In the above, the cloud desktop information includes at least the cloud desktop's IP address, port, connection duration, and traffic threshold.

[0062] In the above, the media gateway is configured with a traffic monitoring module, a duration monitoring module, and a second sending module;

[0063] The traffic monitoring module is used to monitor the communication traffic between the external network terminal and the cloud desktop server after the authentication token is successfully verified once.

[0064] The duration monitoring module is used to monitor the communication duration between the external network terminal and the cloud desktop server after the authentication token is successfully verified once.

[0065] The second sending module is used to send the communication traffic information and communication duration information to the signaling gateway, and the signaling gateway controls the connection between the cloud desktop server and the external network terminal based on the communication traffic information and communication duration information.

[0066] It is important to emphasize that this application decomposes the gateway function into an application gateway, a signaling gateway, and a media gateway. These can be deployed on the same physical machine or independently on different physical machines; similarly, multiple instances of the signaling gateway and media gateway can be deployed on different physical machines. The application gateway actively connects to these signaling gateways and media gateways for secure communication, improving the load capacity when a large number of cloud desktops are accessed. Using the technology of this invention to deploy the application gateway, signaling gateway, and media gateway, terminals accessing the cloud desktop from the external network can effectively improve the security of authorized cloud desktop usage.

[0067] The various embodiments of the present invention have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or technical improvements to the embodiments in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A secure connection system between an external network terminal and a cloud desktop based on gateway access, characterized in that: This includes external network terminals and cloud desktop servers connected via gateways; The gateway includes an application gateway, a signaling gateway, and a media gateway. The application gateway is used to forward and obtain cloud desktop information, the signaling gateway is used to control the connection between the cloud desktop server and the external network terminal, and the media gateway is used to monitor cloud desktop server information. The application gateway is connected to the signaling gateway and the media gateway via the SSH protocol, respectively. The cloud desktop server generates cloud desktop information based on the request information from the external network terminal; The application gateway generates an authentication token based on the cloud desktop information, and the signaling gateway and media gateway respectively verify the authentication token. The application gateway is configured with a key generation module. The key generation module generates a random public key MAC_KEY based on the cloud desktop information as the unique identifier of the cloud desktop information, and generates a private key KEY. It then uses an encryption algorithm to generate an authentication token. The cloud desktop information includes at least the cloud desktop's IP address, port, connection duration, and traffic threshold. The media gateway is configured with a traffic monitoring module, a duration monitoring module, and a second sending module; The traffic monitoring module is used to monitor the communication traffic between the external network terminal and the cloud desktop server after the authentication token is successfully verified once. The duration monitoring module is used to monitor the communication duration between the external network terminal and the cloud desktop server after the authentication token is successfully verified once. The second sending module is used to send the communication traffic information and communication duration information to the signaling gateway, and the signaling gateway controls the connection between the cloud desktop server and the external network terminal based on the communication traffic information and communication duration information.

2. The secure connection system between an external network terminal and a cloud desktop based on gateway access as described in claim 1, characterized in that, The application gateway is configured with a sending module; Both the signaling gateway and the media gateway are equipped with a receiving module; The sending module is used to send an authentication token to the receiving module, and the receiving module receives and saves the authentication token.

3. A method for secure connection between an external network terminal and a cloud desktop based on gateway access, characterized in that: The system according to any one of claims 1-2 is characterized by the following steps: The application gateway actively initiates SSH protocol connections to the signaling gateway and media gateway to establish a communication channel; The external network terminal logs into the request page via HTTPS and a username and password, and requests cloud desktop information available for the username from the application gateway. The application gateway forwards external terminal requests to the cloud desktop server. After the cloud desktop server responds to the external terminal requests, the application gateway generates an authentication token. The signaling gateway and media gateway respectively verify the authentication token. If the verification is successful, the external network terminal and the cloud desktop server establish communication based on cloud desktop information. If the verification fails, the external network terminal and the cloud desktop server cannot establish communication.

4. The method for secure connection between an external network terminal and a cloud desktop based on gateway access according to claim 3, characterized in that, The verification process is as follows: The application gateway sends a random public key MAC_KEY and a private key KEY to the signaling gateway and the media gateway, and the signaling gateway and the media gateway maintain the public key MAC_KEY and the private key KEY; The application gateway sends the random public key MAC_KEY and authentication token to the external terminal. The external network terminal sends a request to the signaling gateway and media gateway, carrying cloud desktop information, a random public key MAC_KEY, and an authentication token. Upon receiving the request, the signaling gateway and media gateway look up the random public key MAC_KEY and private key KEY maintained by the media gateway based on the random public key MAC_KEY, and use the private key KEY to decrypt the authentication token.

5. The method for secure connection between an external network terminal and a cloud desktop based on gateway access according to claim 4, characterized in that, After the external network terminal establishes communication with the cloud desktop server, the media gateway monitors the communication traffic information between the external network terminal and the cloud desktop server in real time through the traffic monitoring module, and sends the communication traffic information to the signaling gateway. The signaling gateway receives communication traffic information and loads a control mechanism. Based on this control mechanism, the signaling gateway sends corresponding control commands to control the communication connection between the external network terminal and the cloud desktop server. The media gateway monitors the communication duration information between the external network terminal and the cloud desktop server in real time through the duration monitoring module, and sends the communication duration information to the signaling gateway; The signaling gateway receives communication duration information and loads a control mechanism. Based on the control mechanism, the signaling gateway sends corresponding control commands to control the communication between the external network terminal and the cloud desktop server.

Images