Method and apparatus for key sharing in conjunction with the Remote Desktop Protocol

Abstract

A key-sharing method for enabling remote desktop access to a service by a client, comprising: receiving a request from an endpoint to grant a user access to a remote desktop service, the request containing session information; obtaining a username and password associated with the user based on the session information; requesting a license from the user; assigning a validity period to the password; generating a first secret key based on the license; generating a second secret key based at least partially on the first secret key and a salt; encrypting a packet containing the password and a specification of the validity period using the second secret key; and appending the salt to the encrypted packet.and transmitting the username, the encrypted packet, and the attached salt to the terminal to authenticate the user to access the requested remote desktop service.

Description

TECHNICAL AREA

[0001] Exemplary embodiments of the present invention relate generally to remote desktop technology and more specifically to a method, a device and a computer program product for key sharing in conjunction with the remote desktop protocol. BACKGROUND

[0002] The computer industry has experienced rapid growth and development over time. Technological advancements have not only led to new models of computing devices, but have also driven developments in the systems and networks in which these devices operate and interact. Each new model, from mainframes and supercomputers to personal computers and mobile devices, has brought its own set of advantages and challenges.

[0003] Over the past several decades, computing has transitioned from distributed systems, such as mainframes, to decentralized systems, such as personal computers. While the new decentralized, user-centric model has provided users with increased flexibility and convenience, it has also resulted in inefficient resource utilization and unnecessary additional costs. For example, each personal computer required the processing power and storage capacity needed for maximum rather than typical workloads. Consequently, the most recent trend in computing has been a return to a centralized model, where applications and data can be centrally managed, stored, and delivered to reduce costs and increase security and efficiency.

[0004] An emerging model, known as "the cloud," relies on delivering computing resources via a computer network. Cloud-provided services can range from individual applications to the full functionality of an operating system. To simplify the delivery of these cloud services, some systems may rely, at least partially, on remote access technologies, such as the Remote Desktop Protocol (RDP). RDP allows a user to view and control a remotely running desktop or application over a network connection. For security reasons, permission to remotely control desktops, applications, and even file systems must, in many cases, be restricted to authorized users. User authentication may require the use of encryption techniques that rely on private keys.

[0005] Therefore, in the current state of the art, there is a need to enable the secure exchange of private keys for the authentication of a user with regard to an RDP service. SUMMARY

[0006] Methods, devices, and computer software products are provided here for the secure exchange of private keys for user authentication in a remote access technology, such as an RDP service. Systems, methods, devices, and computer software products according to various embodiments can provide numerous advantages for computing devices, users of computing devices, and network providers. Various embodiments enable a user logged into a portal environment system, such as a desktop in a browser system, to exchange private keys with the portal environment system in order to obtain login information for user authentication with respect to a requested RDP service.In these implementations, the secure exchange of keys allows the portal environment system to provide access to various RDP services by implementing a single sign-on system. Furthermore, several advantageous implementations enable automatic login to the RDP service without additional user input. By providing a system for routing encrypted passwords to the RDP client, a user does not need to remember and enter login information for each RDP service they attempt to access.

[0007] Advantageous embodiments of the present invention further enable an administrator to limit the validity of a password for accessing a specific RDP service by assigning a validity period to the password. In this way, the system can be less vulnerable to attacks or unauthorized password reuse by using the validity period limitation. In some embodiments, the server can provide both the executable RDP service and the encrypted password to the user's device, thereby allowing the user to access the executable RDP service using the password only for the specified period. For example, if the period is limited to one day, the user would not be able to log in to the executable RDP service using the provided password after one day has elapsed.By specifically assigning a time-limited password to a particular executable RDP service, the administrator can, in various advantageous implementations, transparently deliver updated versions of the executable RDP service to the user when providing new passwords after a time limit expires. In this way, a user can benefit from software updates without explicitly requesting them, while simultaneously being prevented from using outdated versions of an application.

[0008] In one embodiment, a method is provided that may include receiving a request from a device to grant a user access to a Remote Desktop Protocol service. The request may contain session information. This embodiment's method may further include retrieving a username and a password associated with the user based on the session information. The username and password in this embodiment may be retrieved from or obtained from a single sign-on repository. This embodiment's method may further include assigning a validity period to the password. Additionally, this embodiment's method may include generating an initial secret key, at least partially, based on information associated with the user.The method of this embodiment can further include generating a second secret key, at least partially, based on the first secret key and a salt. Furthermore, the method of this embodiment can include encrypting a packet containing the password and a time period specification using the second secret key. The method of this embodiment can also include appending the unencrypted salt to the encrypted packet. Additionally, the method of this embodiment can include providing the username and the encrypted packet for transmission to the device for user authentication with respect to the requested Remote Desktop Protocol service.

[0009] In another embodiment, a method is provided that includes submitting a request for transmission to grant a user access to a Remote Desktop Protocol service. The request may contain session information. This embodiment's method may further include receiving data related to accessing the Remote Desktop Protocol service. The data may include a username, an encrypted packet, and information associated with the user. The encrypted packet may contain a password and a password expiration date. The encrypted packet may also contain an unencrypted salt. Additionally, this embodiment's method may include generating an initial secret key based at least partially on the user-associated information.The method of this embodiment may further include generating a second secret key, which is based at least partially on the first secret key and the salt. Furthermore, the method of this embodiment may include decrypting the encrypted packet containing the password and the password validity period using the second secret key. The method of this embodiment may further include determining the current time. Additionally, the method of this embodiment may include comparing the current time with the password validity period to determine whether the password is valid. The method of this embodiment may further include providing the username and the decrypted password for transmission to the Remote Desktop Protocol Service if the password is valid. FIGURE DESCRIPTION

[0010] Having thus described some embodiments of the invention in a general manner, reference is now made to the accompanying drawing, which is not necessarily drawn to scale, and in which

[0011] Fig. 1 a system for providing a web-enabled feed to a data center via a portal interface, which would benefit from enabling the secure exchange of private keys for authenticating a user with respect to an RDP service according to various embodiments of the present invention,

[0012] Fig. 2 represents a block diagram of a terminal device according to some embodiments of the present invention,

[0013] Fig. 3 represents a block diagram of a server network device according to some embodiments of the present invention,

[0014] Fig. 4 represents a flowchart according to an exemplary method for enabling the secure exchange of private keys for authenticating a user with respect to an RDP service according to some embodiments of the present invention and

[0015] Fig. Figure 5 shows a flowchart according to an exemplary method for enabling the secure exchange of private keys for authenticating a user with respect to an RDP service according to some embodiments of the present invention. DETAILED DESCRIPTION

[0016] Exemplary embodiments of the present invention are now described in more detail below with reference to the accompanying drawing, which shows some, but not all, embodiments of the invention. In fact, the invention can be implemented in many different forms and should not be interpreted as being limited to the exemplary embodiments shown below; rather, these exemplary embodiments are provided so that this disclosure satisfies applicable legal requirements. Identical reference numerals refer to the same elements throughout. The terms “data”, “content”, “information”, and similar expressions may be used interchangeably according to some embodiments of the present invention to refer to data that can be transmitted, received, processed, and / or stored. Definitions

[0017] The term "computer-readable medium," as used here, refers to any medium configured to participate in providing information to a processor, including instructions for execution. Such a medium can take many forms, including but not limited to non-transient computer-readable storage media, such as permanent and volatile media, and transmission media. Transmission media include, for example, coaxial cables, copper wires, fiber optic cables, and carrier waves that travel through space without wires or cables, such as acoustic waves and electromagnetic waves, including radio waves, optical waves, and infrared waves. Signals exhibit human-induced, temporary variations in amplitude, frequency, phase, polarization, or other physical properties that are carried through the transmission medium.Examples of computer-readable media include a floppy disk, a flexible disk, a hard disk, magnetic tape, any other magnetic media, a Compact Disc Read Only Memory (CD-ROM), a Compact Disc, Compact Disc-Rewritable (CD-RW), a Digital Versatile Disc (DVD), Blu-ray, any other optical medium, punched cards, punched tape, optical marker slips, any other physical medium with patterns of holes or other optically detectable characters, a Random Access Memory (RAM), a Programmable Read Only Memory (PROM), an Erasable Programmable Read Only Memory (EPROM), a FLASH EPROM, any other memory chip or any cartridge, a carrier wave, or any other medium from which a computer can read. The term computer-readable storage medium is used here to refer to any computer-readable medium other than transmission media.However, it will be appreciated that when embodiments are described using a computer-readable storage medium, other types of computer-readable media may be used as a substitute or in addition to the computer-readable storage medium in alternative embodiments.

[0018] In the usage presented here, the term “circuit” refers to all of the following: (a) purely hardware-like circuit implementations, for example, implementations in purely analog and / or digital circuitry; (b) combinations of circuits and software and / or firmware, such as, where applicable: (i) a combination of processor(s) or (ii) sections of processor(s) / software, including digital signal processor(s), software, and memory(s), which interact to cause a device, for example, a terminal device, relay device, or server, to perform various functions; and (c) circuits, for example, a microprocessor or microprocessors, or a section of a microprocessor or microprocessors, which require software or firmware to operate, even if the software or firmware is not physically present.

[0019] This definition of "circuit" applies to all uses of this term in this application, including in all claims. As a further example used in this application, the term "circuit" would also cover an implementation of just one or more processors, or a section of a processor and its or their accompanying software and / or firmware. The term "circuit" would also cover, for example, and, if applicable to the particular claim element, an integrated circuit in a terminal device, relay device, server, or other network device. system

[0020] With current reference to Fig. 1 illustrated Fig. 1. A block diagram of an example system 100 to provide web-enabled access to a data center via a portal interface, for example, in a browser on an end device 102A structured desktop that would benefit from enabling the secure exchange of private keys for user authentication with respect to an RDP service, according to various embodiments of the present invention. It will be understood that the system 100 and the illustrations in other figures are each provided as an example of embodiment and should not be interpreted in any way as limiting the scope or spirit of the revelation. In this respect, the scope of the revelation includes many potential examples of embodiment in addition to those presented and described here. While Fig. Figure 1 illustrates an example of a system configuration for providing web-enabled access to a data center via a portal interface; therefore, many other configurations can also benefit from various embodiments of the present invention.

[0021] In exemplary implementations, the system can 100 a data center 120 exhibit. The data center 120 It can be configured to operate as a private cloud, a public cloud, or a combination of both. For example, a public cloud can provide services to any user, whereas a private cloud can provide services to a subset of all users, such as employees of a specific business that provides the private cloud services. The data center 120 In some cases, it may be protected by a firewall. In some implementations, the data center may be protected. 120 be located in an internal network, for example in a private Local Area Network (LAN) or the like, or the data center 120can be arranged and / or hosted remotely by a third party. In some cases, the data center 120 a combination of units and services that are available both locally and remotely.

[0022] According to some examples, the data center 120 one or more servers 122 exhibit. A server 122 A server can be configured as any type of computing device or, in some cases, implemented as a virtual server. 122 It can also be implemented as a combination of numerous computing devices. In this respect, the server can 122 For example, it can be implemented as a server cluster and / or as a distributed computing system that can be distributed across a large number of computing devices. In other embodiments, one or more servers can be used. 122 be implemented in the same computing device.

[0023] According to various embodiments, the system can 100 a demilitarized zone (DMZ) 140 exhibiting features located outside the data center 120 is arranged. In this regard, the DMZ 140 outside the data center 120 It must be arranged within a protective firewall. In exemplary configurations, the DMZ can be... 140 one or more relay devices 150 exhibit. A relay device 150 It can be implemented as any computing device, for example a server computer, such as a network web server, desktop computer, laptop computer, or the like. In other embodiments, it can be a relay device. 150 can be implemented as a virtual relay. According to some embodiments, the relay devices can 150 in the DMZ 140 and the data center 120 be implemented in the same computing device.

[0024] The system 100Depending on the example, one or more terminal devices can be used. 102 exhibit. In various embodiments, one or more terminal devices may be present. 102 outside the DMZ 140 and the data center 120 be arranged. In this regard, one or more end devices may be used. 102 outside the data center 120 be located within a protective firewall. An end device 102 can be implemented as any computing device, for example a desktop computer, laptop computer, netbook, tablet, portable digital assistant (PDA), mobile terminal, mobile computer, mobile phone, mobile communication device, smartphone, gaming device, TV set, digital video recorder, positioning device, any combination thereof and / or the like.

[0025] In certain implementation examples, the terminal device can 102 to establish a connection with at least one of the one or more relay devices150 in the DMZ 140 be configured. In some implementation examples, an end device can be 102 , which with a first relay device 150 is connected to a second relay device during the same session 150 The connection can be transmitted. For example, the connection can be established over the internet using a transport protocol such as Transmission Control Protocol (TCP), User Datagram Protocol (UDP), or similar. In these examples, the connection can also be established using an application-specific protocol such as Hypertext Transfer Protocol (HTTP), Hypertext Transfer Protocol Secure (HTTPS), or similar. In certain examples, the connection can be secure. For instance, communication can take place over the connection between the terminal device. 102 and the relay device 150The connection can be secured using Transport Layer Security (TLS), Secure Sockets Layer (SSL), or similar technologies. Data transmitted and received over the connection can be encrypted using, for example, 128-bit SSL encryption.

[0026] According to various embodiments, a relay device can 150 in the DMZ 140 to establish a connection with at least one of the one or more servers 122 in the data center 120 be configured. For example, a relay device 150 to establish a pipeline connection with a server 122 be configured. The pipeline connection can be configured in exemplary implementations to enable bidirectional communication between the relay device. 150 and the server 122to provide. For example, the pipeline connection can be a serial connection, Ethernet connection, socket connection, or the like. In some implementations, the pipeline connection can be established through one or more ports, for example, a single port in a data center. 120 protective firewall.

[0027] A relay device 150 In exemplary implementations, it can act as an intermediary between one or more terminal devices. 102 and one or more servers 122 The relay device can serve this purpose. 150 as an endpoint for all communications and requests from the terminal device 102 to the data center 120 serve. The relay device 150 can handle communications and requests from the terminal device 102 to the server 122 transmit. Similarly, the relay device can 150 via the pipeline connection to the server122 all communications to the terminal device 102 , which are from the data center 120 originate, receive, and the communications to the terminal device 102 transmit via a secure connection. In this regard, the server can 122 for communicating with the applications, file systems and databases within the data center 120 be configured.

[0028] According to various embodiments, the combination of the relay device 150 and the server 122 a two-tier architecture for securing the data center 120 make available to external users, for example a user on an end device 102 In this regard, the relay device 150 a first level of security for the data center 120 provide while the server 122 a second level of security for the data center 120can provide. In other implementation examples, an end device can be used to connect directly to the server. 122 be configured to form a single-level architecture.

[0029] According to various implementation examples, the data center 120 to provide information and services to one or more end devices 102 be configured via the architecture described above. Examples of information and services provided through the data center. 120 Examples of how certain implementations can be provided are described in more detail below.

[0030] In some implementation examples, the data center 120 to provide operating system-specific services 124 be configured. For example, the data center 120 Windows TM -applications, for example Word TM , Excel TM PowerPoint TMor provide something similar. An operating system-specific service. 124 In certain implementation examples, this can be provided via a publishing procedure. In this regard, the operating system-specific service can be used. 124 remotely from a terminal server, for example Microsoft ® -Terminal Server, which is located within the data center 120 It is running. In other implementation examples, an operating system-specific service may be used. 124 They are supplied via an application virtualization process. In this regard, the operating system-specific service can be used. 124 bundled into an executable file and dynamically sent to an end device 102 distributed for local processing. In other implementations, an operating system-specific service may be used. 124 refer to a service or application that is installed locally on the end device and accessed via the data center120 is carried out.

[0031] In some implementation examples, the data center 120 for deploying internally hosted web applications 126 be configured. In this regard, the internal web application can be configured. 126 natively in the data center 120 be integrated. For example, the internal web application can be 126 Web applications include those configured to run over HTTP, HTTPS, or other similar protocols, such as web servers like Apache or IIS, and web portals like Microsoft SharePoint. ® , BEA Weblogic ® , IBM Websphere ® Oracle PeopleSoft ® Oracle Financials ® Content management systems, web consoles, and / or similar systems. In some implementations, internal web applications may be used. 126 developed internally or by third-party vendors.

[0032] According to various implementation examples, the data center 120 for deploying externally hosted web applications 128 be configured. The external web applications 128 These can include, for example, Software as a Service (SaaS) applications. In certain implementations, an external web application may be used. 128 be hosted by a third party, for example in a remote data center. For example, the external web applications 128 Applications include those powered by Salesforce.com TM , Google Apps TM , Microsoft Live TM , Zoho TM , Moodle TM and / or similar services are offered. An external web application 128 can access the data center 120must be provided via a trusted connection, for example using Security Assertion Markup Language (SAML), delegated authentication, and / or similar methods. In this regard, the external web applications 128 for supplying the end devices 102 via the servers 122 and in certain embodiments, the relay devices 150 into the data center 120 be integrated.

[0033] In some implementation examples, the data center 120 to provide private services 130 , such as cloud services, may be configured. In this regard, the private services can 130These may include file services, data services, or similar services. In certain implementations, the file services may provide access to one or more network file systems, such as shared directories, home directories, public directories, and / or the like. In other implementations, the data services may provide access to one or more databases. In some cases, the databases may be any Open Database Connectivity (ODBC) or Java Database Connectivity (JDBC) database, such as a Microsoft SQL (Structured Query Language) server. ® , MySQL TM Oracle Database ® IBM DB2 ® , Microsoft Access ® and / or the like. The databases may be accessible, for example, via web reporting, electronic web forms, and / or the like.

[0034] According to various implementation examples, the information and services of the data center can be 120 a user of a terminal device 102 presented via a desktop created in a browser. In this regard, the end device can 102 be configured in such a way as to provide a user with access to a web-enabled browser, such as Microsoft Internet Explorer ® , Mozilla Firefox ® , Google Chrome ® Opera ® Apple Safari ® and / or the like. In exemplary implementations, the user may be able to access a desktop using the browser of the terminal device 102. In exemplary implementations, the desktop may be based on web technologies, for example Ajax, Comet and / or the like, and natively displayed in the browser on the terminal device. 102It may be generated. In this respect, the desktop created in a browser can have features similar to a traditional desktop, such as menus, taskbars, desktop icons and background, custom settings, keyboard shortcuts, a notification area, and / or the like. The desktop provided in the browser may differ from a conventional desktop created by the operating system on the end device. 102 The running operating system is provided. Additionally, the desktop created in a browser can differ from a virtual presentation of a traditional desktop running at an external location, for example, within a data center. 120 In some implementation examples, the information and services of the data center can be used. 120 a user of a terminal device 102presented via other portal interfaces, such as a dashboard, a mobile interface, a tablet interface, or any other portal interface that provides access to one or more data centers 120 and / or cloud services. In certain implementations, services and information can be delivered directly to a user without the use of a portal interface. terminal device

[0035] With current reference to Fig. 2 represents Fig. 2. A block diagram of a terminal device 102 according to one exemplary embodiment. In this embodiment, the terminal device comprises 102 Various components are used to perform the different functions described here, including hosting a remote desktop client session. These components can be one or more components powered by a single processor. 210 , a storage 212, a communication interface 214 , a user interface 216 or an RDP service request circuit 218 include the components of the terminal device described herein. 102 They can be implemented, for example, as circuits, hardware elements (such as a suitably programmed processor, a combinational logic circuit, and / or the like), or as a computer program product containing computer-readable program instructions (such as software or firmware) stored in a computer-readable medium (such as memory). 212 , are stored, and this is done using a suitably configured computing device, for example the processor 210 , is executable, or some combination thereof.

[0036] In some embodiments, one or more of the features described in Fig. The two components shown can be implemented as a single chip or chipset. In other words, the end device can be102 A system comprises one or more physical assemblies, such as chips, including materials, components, and / or wires on a structural assembly, such as a socket. The structural assembly can provide physical strength, size retention, and / or limitation of electrical interaction for a component circuit it encompasses. In this regard, the processor may 210 , the storage 212 , the communication interface 214 , the user interface 216 and / or the RDP service request circuit 218 It can be implemented as a chip or chipset. The end device 102 Therefore, in some embodiments, it can be configured such that it implements embodiments of the present invention on a single chip or as a single "system on a chip". As a further example, the terminal device 102In some embodiments, a component or components are configured to implement embodiments of the present invention on a single chip or as a single "system on a chip". Therefore, in some cases, a chip or chipset may form components for performing one or more operations to provide the functionalities described herein and / or to enable user interface navigation with respect to the functionalities and / or services described herein.

[0037] The processor 210It can, for example, be implemented in the form of different components, including one or more microprocessors, one or more processors, one or more coprocessors, one or more multi-core processors, one or more controllers, a processing circuit, one or more computers, various other processing elements, including integrated circuits, or some combination thereof. Although in Fig. 2 represented as a single processor, therefore the processor comprises 210 In some embodiments, a multitude of processors are used. These multiple processors can communicate operationally with each other and can be collectively configured to perform one or more functionalities of the terminal device described here. 102to execute. The multitude of processors can be implemented on a single computing device or distributed across a multitude of computing devices that are collectively designed to act as the end device. 102 to function. In some implementation examples, the processor can 210 be trained to execute instructions stored in the memory 212 stored or otherwise transferred to the processor 210 are accessible. These instructions, when executed by the processor, 210 , can the terminal 102 to cause one or more of the functionalities of the terminal device described here to be used 102 to execute. Therefore, the processor can 210, whether configured by hardware or software methods or by a combination thereof, comprise a unit capable of performing operations according to exemplary embodiments of the present invention, if configured accordingly. If the processor 210 is trained as an executor of instructions, for example in the memory 212 Instructions for the processor, for example, can be stored and thus be stored. 210 configure it specifically so that it can execute one or more of the algorithms and operations described here.

[0038] The storage 212 For example, it can have volatile memory, permanent memory, or some combination thereof. In this respect, the memory can 212 comprise one or more tangible and / or non-volatile computer-readable storage media, which may have volatile or permanent storage. Although in Fig. 2 represented as a single memory, the memory can 212 They have a multitude of storage devices. This multitude of storage devices can be implemented on a single computing device or distributed across a multitude of computing devices that are collectively configured to act as the end device. 102 to function. In various implementation examples, the memory can 212 A hard disk, a read / write memory, a cache memory, a flash memory, a compact disc read-only memory (CD-ROM), a digital versatile disc read-only memory (DVD-ROM), an optical disc, a circuit configured to store information, or some combination thereof. The memory 212 can be used to store information, data, applications, instructions, or the like to enable the terminal device. 102It may be configured to perform various functions according to different implementation examples. In some implementation examples, the memory 212 for example, trained to process input data for processing by the processor 212 to buffers. Additionally or alternatively, the storage can 212 be trained to execute program instructions for the processor 210 to store. The storage 212 It can store information in the form of static and / or dynamic information. This stored information can be accessed through the RDP service request circuit. 218 stored and / or used during the execution of their functionalities.

[0039] The communication interface 214can be implemented as any device or component that is in a circuit, in hardware, in a computer program product that contains computer-readable program instructions stored in a computer-readable medium, for example, memory 212 , are stored and are processed by a processing device, for example the processor 210 It is implemented, or in a combination thereof, and is configured to receive and / or transmit data to / from another computing device. In one embodiment, the communication interface is... 214 at least partially through the processor 210 realized or otherwise by the processor 210 controlled. In this regard, the communication interface 214 with the processor 210 be in communication, for example via a bus. The communication interface 214For example, a network card (wired or wireless) may include an antenna, a transmitter, a receiver, and / or supporting hardware or software to enable communication with one or more remote computing devices. The communication interface 214 It can be configured to receive and / or transmit data using any protocol that can be used for communication between computing devices. In this regard, the communication interface can be configured 214 be configured to receive and / or transmit data using any protocol that can be used to transmit data over a wireless network, a wired network, some combination thereof, or the like, thereby enabling the terminal device 102 and one or more computing devices or computing resources can be in communication. For example, the communication interface214 be configured to establish communication between the terminal device 102 and to enable other devices, for example a relay device 150 or a server 122 The communication interface 214 can also be used with the memory 212 , the user interface 216 and / or the RDP service request circuit 218 , for example, via a bus, to be in communication.

[0040] The user interface 216 can be used with the processor 210 It must be in communication to receive a display of user input and / or provide an audible, visual, mechanical, or other output to a user. Therefore, the user interface can 216For example, a keyboard, mouse, joystick, display, touchscreen display, microphone, speaker, and / or other input / output mechanisms. In embodiments where the user interface 216 has a touchscreen display, the user interface 216 Additionally, it can be configured to detect and / or receive a touch gesture or other input to the touchscreen display. The user interface 216 can be used with the memory 212 , the communication interface 214 and / or the RDP service request circuit 218 , for example, via a bus, to be in communication.

[0041] The RDP service request circuit 218It can be implemented in the form of various components, for example as a circuit, hardware, computer program product, which contains computer-readable program instructions stored in a computer-readable medium, for example memory. 212 , are stored and are processed by a computing device, for example the processor 210 , are executed, or some combinations thereof, and in some embodiments is carried out by the processor 210 realized or otherwise by the processor 210 controlled. In exemplary implementations where the RDP service request circuit 218 separate from the processor 210 Once implemented, the RDP service request circuit can 218 with the processor 210 be in communication. The RDP service request circuit 218 can also be used with one or more of the memory 212 , the communication interface 214or the user interface 216 , for example, via a bus, to be in communication.

[0042] The RDP service request circuit 218 can be configured to perform or initiate the performance of any of the steps associated with the terminal device 102 are connected as described below in the RDP encryption section. Server network device

[0043] With current reference to the Fig. 3, represents the Fig. 3. A block diagram of a server network device 104 according to one embodiment. In this embodiment, the server network device comprises 104 Various components are used to perform the different functions described here. These components can be one or more components of a processor. 310 , from a storage device 312 , from a communication interface 314or from an RDP password encryption circuit 316 exhibit the components of the server network device. 104 , as described herein, can be, for example, a circuit, hardware elements such as a suitably programmed processor, a combinational logic circuit and / or the like, a computer program product comprising computer-readable program instructions, such as software or firmware, stored in a computer-readable medium, such as memory 312 , are stored, and this is done using a suitably configured computing device, for example the processor 310 , is executable, or some combination thereof is realized.

[0044] In some embodiments, one or more of the features described in Fig. The three components shown can be configured as a single chip or chipset. In other words, the server network device can be 104One or more physical arrangements, such as chips, comprising materials, components, and / or wires mounted on a structural assembly, such as a baseboard. The structural assembly can provide physical strength, size retention, and / or limitation of electrical interaction for a component circuit assembled upon it. In this regard, the processor 310 , the storage 312 , the communication interface 314 and / or the RDP password encryption circuit 316 It can be implemented as a chip or chipset. The server network device 104 Therefore, in some embodiments, it can be configured to implement embodiments of the present invention on a single chip or as a single "system on a chip". As another example, the server network device 104In some embodiments, the invention comprises a component or components configured to implement embodiments of the present invention on a single chip or as a single “system on a chip”. Therefore, in some cases, a chip or chipset may form components for performing one or more operations to provide the functionalities described herein.

[0045] The processor 310 It can, for example, be implemented in the form of various components, including one or more microprocessors, one or more processors, one or more coprocessors, one or more multi-core processors, one or more controllers, process circuits, one or more computers, various other process elements, including integrated circuits, or some combinations thereof. Although in Fig. 3, represented as a single processor, consequently comprises in some embodiments the processor 310 A multitude of processors. These multiple processors can communicate operationally with each other and can be collectively configured to perform one or more functionalities of the server network device. 104 – as described herein – to execute. The multitude of processors can be implemented on a single computing device or distributed across a multitude of computing devices that are collectively configured to act as the server network device. 104 to function. In some implementation examples, the processor 310 configured to execute instructions stored in memory 312 are stored or the processor 310 are accessible in other ways. These instructions can be used to access the server network device. 104to cause one or more of the functionalities of the server network device described herein to be used 104 to execute when performed by the processor 310 to be executed. Regardless of whether it is configured by hardware or software methods, or by a combination of both, the processor can 310 Therefore, it comprises a unit capable of performing operations according to exemplary embodiments of the present invention when configured accordingly. If the processor 310 for example, it is implemented as an executor of instructions that are stored, for example, in the memory 312 Instructions can therefore be stored and thus the instructions can be sent to the processor. 310 configure specifically to execute one or more of the algorithms and operations described here.

[0046] The storage 312It can, for example, have volatile memory, permanent memory, or combinations thereof. In this respect, the memory can 312 comprise one or more tangible and / or non-volatile computer-readable storage media, which may contain volatile and / or non-volatile memory. Although in Fig. 3 represented as a single memory, the memory can 312 They have a multitude of storage devices. This multitude of storage devices can be implemented in a single computing device or distributed across a multitude of computing devices that are collectively configured to act as the server network device. 104 to function. In various implementation examples, the memory can 312A hard disk, a read / write memory, a cache memory, a flash memory, a compact disc read-only memory (CD-ROM), a digital versatile disc read-only memory (DVD-ROM), an optical disc, a circuit configured to store information, or some combination thereof. The memory 312 It can be configured to store information, data, applications, instructions, or the like, to serve the server network device 104 to enable the execution of various functions according to different implementation examples. For example, the memory 312 In some embodiments, input data is buffered for processing by the processor. 310 configured. Additionally or alternatively, the storage can be configured. 312 for storing program instructions for execution by the processor 310 be configured. The storage 312It can store information in the form of static and / or dynamic information. This stored information can be protected by the RDP password encryption circuit. 316 stored and / or used during the execution of their functionalities.

[0047] The communication interface 314 can be implemented as any device or component that is part of a circuit, hardware, or computer program product containing computer-readable program instructions stored in a computer-readable medium, such as memory. 312 , are stored, and by means of a processing device, for example the processor 310 , or a combination thereof, which is configured to receive and / or transmit data to / from another computing device. In one embodiment, the communication interface 314 at least partially through the processor 310realized or otherwise by the processor 310 controlled. In this regard, the communication interface 314 with the processor 310 be in communication, for example via a bus. The communication interface 314 For example, it may include a network card (wired or wireless), an antenna, a transmitter, a receiver, and / or supporting hardware or software to enable communication with one or more remote computing devices. The communication interface 314 It can be configured to receive and / or transmit data using any protocol that can be used for communication between computing devices. In this regard, the communication interface can be configured 314be configured to receive and / or transmit data using any protocol that can be used to transmit data over a wireless network, wired network, some combination thereof, or the like, through which the server network device 104 and one or more computing devices or one or more computing resources can be in communication. For example, the communication interface 314 to enable communication between the server network device 104 and be configured with another device, for example a relay device 150 or a terminal device 102 The communication interface 314 can also be used with the memory 312 and / or the RDP password encryption circuit 316 be in communication, for example via a bus.

[0048] The RDP password encryption circuit 316It can be implemented in the form of various components, for example a circuit, hardware, a computer program product that contains computer-readable program instructions stored in a computer-readable medium, for example memory. 312 , are stored, and by means of a computing device, for example the processor 310 , are executed, or some combinations thereof, and in some embodiments is carried out by the processor 310 realized or otherwise by the processor 310 controlled. In exemplary implementations where the RDP password encryption circuit 316 separate from the processor 310 Once implemented, the RDP password encryption circuit can be used. 316 with the processor 310 be in communication. The RDP password encryption circuit 316 can also be used with one or more of the memory 312 and / or from the communication interface314 be in communication, for example via a bus. According to various implementation examples, the RDP password encryption circuit can be... 316 with a server network device 104 be connected, which acts as a relay device 150 , Server 122 or another network unit (for example, a router or a switch).

[0049] The RDP password encryption circuit 316 can be configured to perform or cause the performance of any of the steps associated with the server network device 104 are connected as described below in the RDP encryption section. RDP encryption

[0050] According to various examples, a user may wish to communicate via a terminal device. 102 to connect to a portal environment system. In this respect, the end device can 102A request is received to access a specific portal environment system, such as a web-based portal, to gain access to, for example, a data center. The portal interface can be, for example, a desktop in a browser (also known as a web desktop or webtop), a dashboard, a mobile interface, a tablet interface, or any other portal interface configured to provide access to one or more data centers and / or cloud services. In some implementations, the portal environment system can provide access to one or more data centers and / or cloud services via a Remote Desktop Protocol (RDP) server, such as a terminal server. The RDP session can, in some cases, provide access to a single service (such as an application), or in other cases, provide access to multiple services (such as remote desktop access).

[0051] In other embodiments, the terminal device can 102 A request is received from a user to connect directly to an RDP server. In this case, the user can request that a specific service or application be accessed on the endpoint. 102 The service is delivered via a server that operates according to RDP principles, for example, a terminal server. In various implementations, the user might not be aware that the requested service is being delivered via an RDP server instead of locally by the end device. 102 is provided.

[0052] In some implementation examples, the terminal device 102 The portal environment system can be accessed via a web browser. According to these examples, the user can request that the end device 102 opens a browser and navigates to a login page or homepage for the portal environment system. In other implementation examples, the end device can 102without using a web browser to access the portal environment system. For the sake of clarity and simplicity, the remainder of this disclosure will focus on embodiments where the portal environment system is provided via a web browser; however, it should be understood that the invention can be implemented in many different ways and should not be interpreted as limited to the embodiments associated with portal environment systems provided via a web browser, as explained below.

[0053] In some implementation examples, the portal environment system can be accessed via the terminal device. 102 Accessible via HTTP and / or HTTPS websites. The login page of the portal environment system may require a username and a password associated with that user. In certain implementations, the user can enter the username and password and then log in to the terminal device.102 for transferring the username and password to a server network device 104 (for example, the server) 122 ), which is connected to the portal environment system, ensure, for example via the relay device 150 In other embodiments, the terminal device can 102 Transmit previously saved login information for the user to the portal environment system without requesting input from the user.

[0054] According to various implementation examples, the server network device 104 the login request and the username and password of the user to log in to the portal environment system from the end device 102 received by the server network device 104 In certain cases, it can authenticate the user's username and password. In some implementations, the server network device can 104Generate session information associated with the user's portal environment system session. This session information (also called a session token) can be, for example, a browser cookie or a specific bytecode of a certain length, such as a string of N random characters. In this respect, the session information can identify the user and the end device. 102 and / or specifically identify the portal environment system session.

[0055] According to exemplary implementations, the server network device 104 Provide local storage of session information. The server network device 104 In some implementation examples, a copy of the session information can be transmitted to the terminal device. 102 provide. In implementation examples, the server network device can 104 the installation of session information on the end device 102cause, for example, a cookie that is associated with the browser used to access the portal environment system on the end device 102 is used. The session information can be displayed to the user on the end device. 102 enable access to the portal environment system, for example via the server network device 104 .

[0056] In some implementations, the portal environment system can be configured to operate as a single sign-on (SSO) system. Once a user logs into the portal environment system, they will not be prompted again to provide a username or password to access one or more of the applications or services provided by the system. In this regard, the server network device 104 for accessing an SSO repository 132It must be configured to determine the appropriate username and password pair associated with the user for a requested application or service. In various implementations, the server network device can 104 Use session information to simplify a user's SSO, which is described in more detail below.

[0057] In various implementations, the portal environment system can include one or more applications and / or services provided via Remote Desktop Protocol (RDP), for example, services provided via a terminal server. According to these implementations, the user can access the terminal equipment at the endpoint. 102Select one of the RDP applications or services from the portal environment system. For example, the user can select a link to a web service in the portal environment system that can be accessed via the web browser using RDP. In some implementation examples, the endpoint can 102 a request to the server network device regarding the requested RDP application or service 104 transmit. In some cases, the request may automatically include a copy of the session information. For example, the web browser may automatically send a cookie to the server network device along with the request. 104 lead.

[0058] According to exemplary implementations, the server network device 104 the request for the RDP service together with the user's session information from the end device 102 received by the server network device 104can the portal environment session, the end device 102 and / or determine the user associated with the session information. For example, the server network device 104 perform a hash or lookup on the session information in a user or session database connected to the server network device 104 is connected.

[0059] In some implementation examples, the server network device 104 which use user information derived from the session information to retrieve a username and / or password associated with the user of the requested RDP service. For example, the server network device 104 the username and / or password in the SSO repository 132 to read, which is based on specific user information. In other implementation examples, the server network device 104the username and / or password using the session information or a function of the session information (for example, a hash) directly from the SSO repository 132 win. The username and password for the RDP service can be the same as the username and password used to log in to the portal environment system, or in other implementations, the username and / or password can be different. In some implementations, the server network device 104 First, look up the username, and then use that username to perform a second lookup for the corresponding password. In certain implementations, the password may be unencrypted.

[0060] According to various implementation examples, the server network device 104It must be configured to assign a validity period to the obtained RDP service password. In some implementations, this period can be defined by a start time and a stop time. For example, the server network device 104 The start time can be represented by a first byte string (for example, a string of eight bytes) and the stop time by a second byte string (for example, another string of eight bytes). In other implementations, the time period can be represented by a start time and a duration. For example, the server network device 104 The start time is represented by a first byte string (for example, a string of eight bytes), and the duration by a second byte string (for example, a string of four bytes). The server network device 104 In some implementation examples, it may indicate that no validity period exists. For example, the server network device 104To indicate that the password is not yet valid. It should be understood that other methods can be used to represent a time period instead of the examples above.

[0061] In some implementation examples, the server network device 104 It must be configured to encrypt the password and the time period. For example, the server network device 104 Combine the password and the time period into a single packet and encrypt the packet. Various methods for encrypting the password and the time period are described in the following examples.

[0062] According to various implementation examples, the server network device 104Generate an initial secret encryption code or key, where the terms "encryption code" and "key" are used synonymously below. The initial secret encryption code can be based on both the server network device 104 as well as the terminal device 102 known and / or accessible information can be used to generate the initial secret encryption key. For example, the information used to generate the initial secret encryption key may be based on a software license of the user and / or the company that owns the end device. 102 , which is used to access the RDP service or is connected to the portal environment system. The information (e.g., software license) can be specific to the user and / or the company. In other implementations, the information used to generate the first secret key can be provided by the server network device. 104 to the terminal device 102will be provided when the last encrypted packet has been transmitted, which is discussed in more detail below.

[0063] In some implementation examples, the server network device 104 Generate or retrieve a cryptographic salt or seed value. For example, the salt can be a string of random digits and / or characters, such as a random eight-byte numeric string. In some implementations, the salt can be configured to change after a certain period of time or every time it is accessed. The server network device 104 It can use the salt and the first secret key or encryption code to generate a second secret key or encryption code. In various implementations, the server network device can 104Use the second secret encryption key to encrypt the password and the time period. For example, the encrypted password can be in a printable text format (i.e., non-binary), such as Base64-encrypted. The server network device 104 In certain implementation examples, the salt can be appended to the encrypted password and the encrypted time period in an unencrypted format.

[0064] According to various implementation examples, the server network device 104 for the transmission of the obtained username (in some cases unencrypted) as well as the encrypted password and the encrypted time period to the terminal device 102This ensures that, for example, the unencrypted username, the encrypted password, and the encrypted time period can be transmitted as parameters (e.g., applet parameters) in a website (e.g., an HTML page) that is sent to the end device. 102 is sent. In certain implementations, the server network device 104 this information to the terminal device 102 Transmit via a secure connection, such as an SSL connection. The server network device 104 It can also handle the transmission of the RDP service software, which is sent through the end device. 102 to be executed. For example, the server network device 104 a Java TM -Applet submission, in some cases in a Java TM -Archive (JAR) file. In implementation examples where the end device 102If the server network device does not know or has no access to the information required to generate the initial secret encryption key, it may fail. 104 to ensure the transmission of the information (for example, the software license).

[0065] In exemplary implementations, the terminal device can 102 attempt to run the RDP service software, which in some cases is provided by the server network device 104 The end device may have been provided. 102 can generate the first secret encryption code using the information provided by the server network device 104 may have been provided or that may have been provided to the terminal device 102 The terminal device may have been known beforehand. 102 and the server network device 104In certain cases, the process for generating the first secret encryption key may be known in advance. In these embodiments, a third party that does not know the process may not be able to generate the first encryption key, even if the information used to generate the first secret encryption key and the information provided by the server network device are known. 104 is provided, is intercepted.

[0066] According to various implementation examples, the terminal device can 102 The salt, which is used to generate the second secret encryption key, is obtained from the encrypted password and the encrypted time period. In this respect, the terminal device can 102 Read the unencrypted salt that is appended to the encrypted password and the encrypted time period. The end device 102The salt, along with the generated first secret encryption key, can be used to generate the second secret encryption key. Again, the endpoint can 102 and the server network device 104 The specific procedure for generating the second secret encryption key from the salt and the first secret encryption key must be known beforehand. In some cases, the procedure may be a well-known encryption method. The terminal device 102 In various implementation examples, the generated second secret encryption code can be used to decrypt the password and the time period.

[0067] In exemplary implementations, the terminal device can 102 It can be configured to determine the password validity based on the time period. The end device can do this. 102Obtain the current time and determine whether it falls between the start time and the stop time, or – in other embodiments – whether it falls within the period defined by the start time and the duration. In embodiments where the terminal device 102 Determined that the password is valid based on a comparison of the current time and the decrypted time period, the terminal device can 102 Attempt to forward the received username and decrypted password to the RDP service for authentication. In certain implementations, the username and password may be encrypted before being transmitted for RDP authentication. The server network device 104and / or the RDP server can receive the username and password and authenticate the user for the RDP service. In these examples, this method can be used for SSO by the end device. 102 and the server network device 104 The provision of the service should be transparent to the user.

[0068] In exemplary implementations where the terminal device 102 If the device determines that the password is invalid based on a comparison of the current time and the decrypted time period, it can 102 The unencrypted password cannot be recovered. For example, the end device 102 destroy the password before it can be saved for further use. This way, the device can be... 102Prevent the password from being revealed if it is invalid, for example, if the current time is outside the allocated time period. In these implementations, the end device can... 102 The executed RDP service will be terminated. In other implementations, the RDP service can be continued by the user of the endpoint device. 102 You will be prompted to manually enter a valid username and password for the RDP service without relying on SSO.

[0069] According to other embodiments of the present invention, various methods described above can be modified. In some embodiments, the username and password for accessing the RDP service can be universal. That is, the username and password can be the same for all users of the RDP service, the portal environment system, and / or any subgroup of the two. In some embodiments, the universal username and password can nevertheless be determined by the server network device. 104 encrypted and sent to the end device for decryption 102transmitted as described above in various implementation examples. In some implementation examples, the salt used to encrypt the password can remain static for an extended period (e.g., one year). In other implementation examples, the username, the encrypted password, and in some cases the time period can be stored and transmitted to the end device. 102 This can be provided without having to re-encrypt the password every time the RDP service is accessed. For example, the username and encrypted password can be permanently embedded in the parameters (e.g., applet parameters) of the website (e.g., HTML page) that are sent to the end device. 102 is sent. The server network device 104 In some implementation examples, the username and unencrypted password for the terminal device may be stored. 102 transmit. In these examples, the terminal device can 102You will not be prompted to decrypt your password before providing your username and password to the RDP service for authentication. It should be noted that these modified implementations may not provide the same level of security as some of the implementations described above. Examples

[0070] The following provides a non-restrictive example of an embodiment and should not be interpreted as limiting the scope or spirit of the disclosure in any way. In this embodiment, a user attempts to log in to a desktop in a browser portal system from a laptop. The user must enter a username and password for the portal system. The laptop sends the username and password to a server in the portal system. The portal system authenticates the username and password, associates session information with the session, and returns the session information to the laptop. The portal system also provides access to the user's desktop via the desktop in a browser system.

[0071] In this example, the user attempts to open an RDP service while using the portal system. Without the user's knowledge, the laptop automatically sends the session information along with the request for the RDP service. The server receives the request and the session information, determines the user's identity, and generates the user's username and password for the RDP service from an SSO repository. 132In this example, the user's RDP service username and password have been previously provided to the server to enable SSO, and the user's RDP service username and password are different from the user's portal system username and password. According to this example, the RDP service requests a license from the user that is specific to the user's company. The server uses information from the license to generate an initial key, obtains a salt value from a random number generator, and uses the salt with the initial key to generate a second key.

[0072] In this example, the server decides to limit the password validity to one hour, thereby generating a period value that specifies the current time as the start time and the duration as one hour. The server then encrypts the RDP service password, which it retrieves from the SSO repository. 132The server uses the second generated key to create an encrypted password packet and the time period values. It then appends the unencrypted salt to the beginning of the encrypted password packet and passes it, along with the unencrypted username, as an applet parameter to an HTML webpage for the laptop. The server then sends the webpage, a JAR file containing an applet to run the requested RDP service, and a copy of the license used to generate the first key to the laptop.

[0073] In this example, the laptop receives all the information from the server without the user's knowledge. The laptop generates the first key using information from the received license, reads the salt from the beginning of the received encrypted password packet, generates the second key using the first key and the salt, and decrypts the encrypted password packet using the second key. The laptop then checks the current time to verify that it falls within the time period specified in the decrypted packet. In this example, less than a minute may have passed since the server generated the encrypted packet, and therefore the laptop determines that the password is valid. The laptop retrieves the password from the decrypted packet and the username from the applet parameters, and then attempts to run the applet contained in the received JAR file.The laptop then transmits the username and password to the RDP server connected to the RDP service, according to the RDP service protocol. The RDP server authenticates the user and begins providing the RDP service. It should be emphasized again that, from the user's perspective, the RDP service can simply be opened without any further input required after the user selects the service from the portal system.

[0074] In this example, the user might use the RDP service for a few minutes and then close it. Two hours later, the user tries to access the RDP service again. In this case, the password validity period provided by the server may have changed. Therefore, when the laptop attempts to decrypt the password, the current time is outside the password's validity period. In this case, the laptop can still run the applet in the JAR file, but without providing a username and password for the RDP service. The RDP service may then prompt the user to manually enter the username and password before granting access.

[0075] Fig. Figure 4 illustrates a flowchart according to an exemplary procedure for enabling the secure exchange of private keys for authenticating a user with respect to an RDP service, according to an implementation example. In this regard, it illustrates Fig. 4 operations that can be performed on a server network device 104 can be performed. The operations that are in Fig. 4 shown and with reference to Fig. 4 described, for example, can be achieved by, with the help and / or under the control of one or more of the processor. 310 , of the memory 312 , the communication interface 314 or the RDP password encryption circuit 316 be performed. The operation 400 This can include receiving a request from a device to grant a user access to a Remote Desktop Protocol service. The request can include session information. The processor 310, the storage 312 , the communication interface 314 or the RDP password encryption circuit 316 For example, a structure for carrying out the operation could 400 provide. The operation 410 This can include obtaining a username and password associated with the user based on session information. The processor 310 , the storage 312 , the communication interface 314 or the RDP password encryption circuit 316 For example, a structure for carrying out the operation could 410 provide. The operation 420 This can include assigning a validity period to the password. The processor 310 , the storage 312 , the communication interface 314 or the RDP password encryption circuit 316 For example, a structure for carrying out the operation could 420provide. The operation 430 This can involve generating an initial secret key, which is at least partially based on information associated with the user. The processor 310 , the storage 312 , the communication interface 314 or the RDP password encryption circuit 316 For example, a structure for carrying out the operation could 430 provide. The operation 440 This may involve generating a second secret key, which is at least partially based on the first secret key and a salt. The processor 310 , the storage 312 , the communication interface 314 or the RDP password encryption circuit 316 For example, a structure for carrying out the operation could 440 provide. The operation 450This can involve encrypting a packet containing the password and a time period specification using the second secret key. The processor 310 , the storage 312 , the communication interface 314 or the RDP password encryption circuit 316 For example, a structure for carrying out the operation could 450 provide. The operation 460 This can involve appending the unencrypted salt to the encrypted packet. The processor 310 , the storage 312 , the communication interface 314 or the RDP password encryption circuit 316 For example, a structure for carrying out the operation could 460 provide. The operation 470This may include providing the username and encrypted packet to the device to authenticate the user regarding the requested Remote Desktop Protocol service. The processor 310 , the storage 312 , the communication interface 314 or the RDP password encryption circuit 316 For example, a structure for carrying out the operation could 470 provide.

[0076] Fig. Figure 5 illustrates a flowchart according to an exemplary procedure for enabling the secure exchange of private keys for authenticating a user with respect to an RDP service, according to an implementation example. In this regard, it illustrates Fig. 5 operations that can be performed on a terminal device 102 can be performed. The operations that take place in Fig. 5 shown and with reference to Fig. 5 described, for example, can be achieved by, with the help and / or under the control of one or more of the processor. 210 , of the memory 212 , the communication interface 214 , the user interface 216 or the RDP service request circuit 218 be performed. The operation 500 This can include the provision for submitting a request to grant a user access to a Remote Desktop Protocol service. The request may contain session information. The processor 210 , the storage 212 , the communication interface 214 , the user interface 216 or the RDP service request circuit 218 For example, a structure for carrying out the operation could 500 provide. The operation 510This can include receiving data related to accessing the Remote Desktop Protocol Service. The data can include a username, an encrypted packet, and information associated with a user. The encrypted packet can include a password and a password expiration date. The encrypted packet can also include an unencrypted salt specification. The processor 210 , the storage 212 , the communication interface 214 , the user interface 216 or the RDP service request circuit 218 For example, a structure for carrying out the operation could 510 provide. The operation 520 This can include generating an initial secret key, which is at least partially based on information associated with the user. The processor 210 , the storage 212 , the communication interface 214, the user interface 216 or the RDP service request circuit 218 For example, a structure for carrying out the operation could 520 provide. The operation 530 This may involve generating a second secret key, which is at least partially based on the first secret key and the salt. The processor 210 , the storage 212 , the communication interface 214 , the user interface 216 or the RDP service request circuit 218 For example, a structure for carrying out the operation could 530 provide. The operation 540 This can involve decrypting the encrypted packet, which contains the password and the password's expiration date, using the second secret key. The processor 210 , the storage 212 , the communication interface 214 , the user interface216 or the RDP service request circuit 218 For example, a structure for carrying out the operation could 540 provide. The operation 550 This can include determining the current time. The processor 210 , the storage 212 , the communication interface 214 , the user interface 216 or the RDP service request circuit 218 For example, a structure for carrying out the operation could be provided. 550 provide. The operation 560 This may involve comparing the current time with the password's validity period to determine if the password is valid. The processor 210 , the storage 212 , the communication interface 214 , the user interface 216 or the RDP service request circuit 218 For example, a structure for carrying out the operation could 560provide. The operation 570 This may include providing a way to transmit the username and decrypted password to the Remote Desktop Protocol Service in a case where the password is valid. The processor 210 , the storage 212 , the communication interface 214 , the user interface 216 or the RDP service request circuit 218 For example, a structure for carrying out the operation could 570 provide.

[0077] The Fig. 4 and Fig.Figure 5 illustrates a flowchart of a system, a method, and a computer program product according to exemplary embodiments of the invention. It is understood that each block of the flowchart and combinations of blocks in the flowchart can be implemented by various means, for example, hardware and / or a computer program product comprising one or more computer-readable media—as opposed to a computer-readable transmission medium describing a propagating signal—which contain one or more computer program code instructions, program instructions, or executable computer-readable program code instructions stored therein. For example, one or more of the methods described herein can be implemented by computer program instructions of a computer program product.In this regard, the computer program product or products that implement the methods described herein may be implemented by means of one or more storage devices (for example, the memory . 212 or the storage 312 ) of an end device, server, relay device or other computing device, for example the end device 102 , stored and processed by a processor (for example, the processor) 210 or the processor 310) are executed in the computing device. In some embodiments, the computer program instructions comprising the computer program product or products implementing the methods described herein can be stored by means of storage devices in a plurality of computing devices. It is desirable to load any such computer program product onto a computer or other programmable device to create a machine such that the computer program product, including the instructions executed on the computer or other programmable device, generates means for implementing the functions specified in the block or blocks of the flowcharts.

[0078] Furthermore, the computer program product may have one or more computer-readable memories in which the computer program instructions can be stored, such that the one or more computer-readable memories can instruct a computer or other programmable device to function in a certain manner, so that the computer program product has a manufactured article that implements the function specified in the block or blocks of the flowcharts.The computer program instructions of one or more computer program products can also be loaded onto a computer or other programmable device to initiate a series of operations to be performed on the computer or other programmable device to create a computer-implemented process. The instructions executed on the computer or other programmable device provide operations for implementing the functions specified in the block or blocks of the flowcharts. Fetching, loading, and executing the program code instructions can be performed sequentially, so that one instruction is fetched, loaded, and executed at a time. In some embodiments, fetching, loading, and / or executing can be performed in parallel, so that multiple instructions are fetched, loaded, and / or executed together.

[0079] Consequently, executing instructions associated with the operations of the flowchart by means of a processor, or storing instructions associated with the blocks or operations of the flowchart in a computer-readable storage medium, supports combinations of operations for performing the specified functions. It is also understandable that one or more operations of the flowchart and combinations of blocks or operations in the flowchart can be implemented by means of specially designated hardware-based computer systems and / or processors that perform the specified functions, or by means of combinations of specially designated hardware and program code instructions.

[0080] The functions described above can be performed in many ways. For example, any suitable means for performing each of the functions described above can be used to carry out embodiments of the invention. In one embodiment, a suitably configured processor (for example, the processor) can be used. 210 and / or the processor 310 ) provide all or part of the elements of the invention. In another embodiment, all or part of the elements of the invention can be configured and operated by means of a computer program product. The computer program product for carrying out the methods of embodiments of the invention comprises a computer-readable storage medium, for example, the non-volatile storage medium (e.g., the memory). 212 and / or the storage 312), and computer-readable program code sections, for example, a series of computer instructions implemented in the computer-readable storage medium.

[0081] In one embodiment, a method is provided that may include receiving a request from a device to grant a user access to a Remote Desktop Protocol service. The request may contain session information. The method according to this embodiment may further include retrieving a username and password associated with the user based on the session information. The username and password of this exemplary method may be retrieved from a single sign-on repository. The method according to this embodiment may further include assigning a validity period to the password. Additionally, the method according to this embodiment may include generating an initial secret key that is based, at least in part, on information associated with the user.The method according to this embodiment can further include generating a second secret key, which is based at least partially on the first secret key and a salt. Furthermore, the method according to this embodiment can include encrypting a packet containing the password and a period specification using the second secret key. The method according to this embodiment can further include appending the unencrypted salt to the encrypted packet. Additionally, the method according to this embodiment can include providing a means of transmitting the username and the encrypted packet to the device for authenticating the user with respect to the requested Remote Desktop Protocol service.

[0082] The method according to this exemplary embodiment can further include receiving a login request from a device to log in to a portal environment system. The login request according to this exemplary method can additionally include a session username and session password associated with the user. Furthermore, the method according to this exemplary embodiment can include authenticating the user with respect to the portal environment system, based at least partially on the session username and session password. The method according to this exemplary embodiment can also include associating session information with the user. Additionally, the method according to this exemplary embodiment can include preparing the session information for transmission to the device. The Remote Desktop Protocol Service according to this exemplary method can be provided via the portal environment system.The salt of this example procedure can consist of a randomly generated string of characters. The validity period according to this procedure can include a specified start time and a specified stop time.

[0083] In another embodiment, a device is provided that includes at least one processor and at least one memory that stores computer program code. The at least one memory and the stored computer program code can be configured with the at least one processor to cause the device, according to this embodiment, to receive a request from a device to grant a user access to a Remote Desktop Protocol service. The request can include session information. The at least one memory and the stored computer program code can further be configured with the at least one processor to cause the device, according to this embodiment, to obtain a username and password associated with the user based on the session information.The username and password in this example can be obtained from a single sign-on repository. Additionally, the at least one memory and the stored computer program code can be configured with the at least one processor to cause the device of this embodiment to assign a validity period to the password. The at least one memory and the stored computer program code can also be configured with the at least one processor to cause the device of this embodiment to generate a first secret key that is based at least partially on information associated with the user.Furthermore, the at least one memory and the stored computer program code can be configured with the at least one processor to cause the device according to this embodiment to generate a second secret key, which is based at least partially on the first secret key and a salt. The at least one memory and the stored computer program code can be configured with the at least one processor to further cause the device of this embodiment to encrypt a packet containing the password and a period specification using the second secret key. Additionally, the at least one memory and the stored computer program code can be configured with the at least one processor to further cause the device according to this embodiment to append the unencrypted salt to the encrypted packet.The at least one memory and the stored computer program code can be configured with the at least one processor to further cause the device according to this embodiment to provide a transmission of the username and the encrypted packet to the device for authenticating the user with respect to the requested Remote Desktop Protocol Service.

[0084] The at least one memory and the stored computer program code can be configured with the at least one processor to further induce the device according to this embodiment to receive a login request from a device to log into a portal environment system. The login request according to this example can additionally include a session username and session password associated with the user. Additionally, the at least one memory and the stored computer program code can be configured with the at least one processor to induce the device according to this embodiment to authenticate the user with respect to the portal environment system, at least partially, based on the session username and session password.The at least one memory and the stored computer program code can be configured with the at least one processor to additionally cause the device of this embodiment to associate session information with the user. Furthermore, the at least one memory and the stored computer program code can be configured with the at least one processor to cause the device of this embodiment to provide a transmission of the session information to the device. The Remote Desktop Protocol Service of this example can be provided via the portal environment system. The salt of this example can be a randomly generated string of characters. The validity period of this example can include a specified start time and a specified stop time.

[0085] In another embodiment, a computer program product is provided. This embodiment may include at least one computer-readable storage medium containing computer-readable program instructions. The program instructions in this embodiment may include instructions configured to receive a request from a device to grant a user access to a Remote Desktop Protocol service. The request may contain session information. Furthermore, the program instructions in this embodiment may include instructions configured to obtain a username and password associated with the user based on the session information. The username and password in this example may be obtained from a single sign-on repository.Additionally, the program instructions in this embodiment can include instructions configured to assign a validity period to the password. These instructions can also include instructions configured to generate a first secret key, based at least partially on information associated with the user. Furthermore, they can include instructions configured to generate a second secret key, based at least partially on the first secret key and a salt. Finally, they can include instructions configured to encrypt a packet containing the password and a period specification using the second secret key.Additionally, the program instructions in this embodiment may include instructions configured to append the unencrypted salt to the encrypted packet. Furthermore, the program instructions in this embodiment may include instructions configured to provide the transmission of the username and the encrypted packet to the device for user authentication with respect to the requested Remote Desktop Protocol service.

[0086] The program instructions in this embodiment can include instructions configured to receive a login request from a device to log into a portal environment system. This login request can additionally include a session username and password associated with the user. Furthermore, the program instructions in this embodiment can include instructions configured to authenticate the user, at least partially, with respect to the portal environment system based on the session username and password. Finally, the program instructions in this embodiment can include instructions configured to associate session information with the user.Furthermore, the program instructions in this example can include instructions configured to provide session information to the device. The Remote Desktop Protocol Service in this example can be provided through the portal environment system. The salt in this example can be a randomly generated string of characters. The validity period in this example can include a start time and a stop time.

[0087] In one embodiment, a device is provided that may include means for receiving a request from a device to grant a user access to a Remote Desktop Protocol service. The request may include session information. This embodiment's device may further include means for retrieving a username and password associated with the user based on the session information. The username and password of this embodiment may be retrieved from a single sign-on repository. This embodiment's device may also include means for assigning a validity period to the password. Additionally, this embodiment's device may include means for generating an initial secret key that is based, at least in part, on information associated with the user.The device of this embodiment may further include means for generating a second secret key, which is based at least partially on the first secret key and a salt. Furthermore, the device of this embodiment may include means for encrypting a packet containing the password and a period specification using the second secret key. The device of this embodiment may further include means for appending the unencrypted salt to the encrypted packet. Additionally, the device of this embodiment may include means for transmitting the username and the encrypted packet to the device for authenticating the user with respect to the requested Remote Desktop Protocol service.

[0088] The device of this exemplary embodiment may further include means for receiving a login request from a device to log into a portal environment system. The login request of this exemplary device may additionally include a session username and session password associated with the user. Furthermore, the device of this exemplary embodiment may include means for authenticating the user with respect to the portal environment system, at least partially, based on the session username and session password. The device of this exemplary embodiment may also include means for associating session information with the user. Additionally, the device of this exemplary embodiment may include means for providing a transmission of the session information to the device. The Remote Desktop Protocol service of this exemplary device may be provided via the portal environment system.The salt of this example device can be a randomly generated string of characters. The validity period of this example device can include a start time and a stop time.

[0089] In one embodiment, a method is provided that may include providing a transmission of a request to grant a user access to a Remote Desktop Protocol service. The request may contain session information. This embodiment's method may further include receiving data relating to accessing the Remote Desktop Protocol service. The data may include a username, an encrypted packet, and information associated with the user. The encrypted packet may contain a password and a password expiration date. The encrypted packet may also contain an unencrypted salt. Additionally, this embodiment's method may include generating an initial secret key that is based, at least in part, on the information associated with the user.The method of this embodiment may further include generating a second secret key, which is based at least partially on the first secret key and the salt. Furthermore, the method of this embodiment may include decrypting the encrypted packet containing the password and the password validity period using the second secret key. The method of this embodiment may further include determining the current time. Additionally, the method of this embodiment may include comparing the current time with the password validity period to determine whether the password is valid. The method of this embodiment may further include providing a transmission of the username and the decrypted password to the Remote Desktop Protocol Service if the password is valid.

[0090] The method of this exemplary embodiment can further include providing a transmission of a request to log into a portal environment system. Additionally, the method of this exemplary embodiment can include receiving session information associated with a session concerning the portal environment system. The session information can be associated with a portal environment system session. The Remote Desktop Protocol service of this exemplary method can be accessed via the portal environment system. The salt of this exemplary method can be a randomly generated string of characters. The validity period of this exemplary method can include a specified start time and a specified stop time.

[0091] In another embodiment, a device is provided that includes at least one processor and at least one memory that stores computer program code. The at least one memory and the stored computer program code can be configured with the at least one processor to cause the device of this embodiment to transmit at least one request to grant a user access to a Remote Desktop Protocol service. The request can include session information. The at least one memory and the stored computer program code can further be configured with the at least one processor to cause the device of this embodiment to receive data associated with accessing the Remote Desktop Protocol service. The data can include a username, an encrypted packet, and information associated with a user.The encrypted packet can include a password and a password expiration period. The encrypted packet can also include an unencrypted salt. The at least one memory and the stored computer program code can be configured with the at least one processor to additionally cause the device of this embodiment to generate a first secret key based at least partially on information associated with the user. Furthermore, the at least one memory and the stored computer program code can be configured with the at least one processor to cause the device of this embodiment to generate a second secret key based at least partially on the first secret key and the salt.The at least one memory and the stored computer program code can be configured with the at least one processor to further instruct the device of this embodiment to decrypt the encrypted packet containing the password and the password validity period using the second secret key. Additionally, the at least one memory and the stored computer program code can be configured with the at least one processor to further instruct the device of this embodiment to determine the current time. The at least one memory and the stored computer program code can be configured with the at least one processor to further instruct the device of this embodiment to compare the current time with the password validity period to determine whether the password is valid.The at least one memory and the stored computer program code can be configured with the at least one processor to further cause the device of this embodiment to ensure the transmission of the username and decrypted password to the Remote Desktop Protocol Service in a case where the password is valid.

[0092] The at least one memory and the stored computer program code can be configured with the at least one processor to further instruct the device of this embodiment to transmit a request to log into a portal environment system. Additionally, the at least one memory and the stored computer program code can be configured with the at least one processor to instruct the device of this embodiment to receive session information associated with a session with the portal environment system. The session information can be associated with a portal environment system session. The Remote Desktop Protocol Service of this example can be accessed via the portal environment system. The salt of this example can be a randomly generated string of characters.The validity period of this example can include a start time and a stop time.

[0093] In another embodiment, a computer program product is provided. This embodiment may include at least one computer-readable storage medium containing computer-readable program instructions. The program instructions in this embodiment may include instructions configured to transmit a request to grant a user access to a Remote Desktop Protocol service. The request may include session information. Furthermore, the program instructions in this embodiment may include instructions configured to receive data related to accessing the Remote Desktop Protocol service. This data may include a username, an encrypted packet, and user-associated information.The encrypted packet can contain a password and a password expiration date. The encrypted packet can also contain an unencrypted salt. The program instructions in this embodiment can additionally include instructions configured to generate a first secret key based at least partially on user-associated information. Furthermore, the program instructions in this embodiment can include instructions configured to generate a second secret key based at least partially on the first secret key and a salt. Finally, the program instructions in this embodiment can include instructions configured to decrypt the encrypted packet containing the password and password expiration date using the second secret key.Additionally, the program instructions in this embodiment may include instructions configured to determine the current time. These instructions may also include instructions configured to compare the current time with the password's validity period to determine if the password is valid. Furthermore, if the password is valid, the instructions in this embodiment may include instructions configured to send the username and decrypted password to the Remote Desktop Protocol Service.

[0094] The program instructions in this example may include instructions configured to send a request to log in to a portal environment system. Additionally, the program instructions in this example may include instructions configured to receive session information associated with a session to the portal environment system. The session information may be associated with a portal environment system session. The Remote Desktop Protocol Service in this example can be accessed through the portal environment system. The salt in this example may be a randomly generated string of characters. The validity period in this example may include a start time and a stop time.

[0095] In one embodiment, a device is provided that may include means for transmitting a request to grant a user access to a Remote Desktop Protocol service. The request may include session information. This embodiment's device may further include means for receiving data associated with accessing the Remote Desktop Protocol service. The data may include a username, an encrypted packet, and information associated with the user. The encrypted packet may contain a password and a password expiration date. The encrypted packet may also contain an unencrypted salt. Additionally, this embodiment's device may include means for generating a first secret key that is based, at least in part, on the information associated with the user.The device of this embodiment may further include means for generating a second secret key, which is based at least partially on the first secret key and the salt. Furthermore, the device of this embodiment may include means for decrypting the encrypted packet containing the password and the password validity period using the second secret key. The device of this embodiment may also include means for determining the current time. Additionally, the device of this embodiment may include means for comparing the current time with the password validity period to determine whether the password is valid.The device of this example may further include means for providing a transmission of the username and decrypted password to the Remote Desktop Protocol Service in a case where the password is valid.

[0096] The device of this exemplary embodiment may further include means for providing a transmission of a request to log into a portal environment system. Additionally, the device of this exemplary embodiment may include means for receiving session information associated with a session with the portal environment system. The session information may be associated with a portal environment system session. The Remote Desktop Protocol Service of this exemplary device can be accessed via the portal environment system. The salt of this exemplary device may be a randomly generated string of characters. The validity period of this exemplary device may include a start time and a stop time.

[0097] Many modifications and other embodiments of the inventions shown herein will be obvious to a person skilled in the art to whom these inventions relate, exhibiting the advantages of the teachings presented in the preceding descriptions and the accompanying drawings. Therefore, it is understandable that the inventions are not limited to the specific embodiments disclosed herein and that modifications and further embodiments within the scope of the appended claims are included herein. Although the preceding descriptions and the accompanying drawings describe embodiments in the context of certain exemplary combinations of elements and / or functions, it is also desirable that various combinations of elements and / or functions be provided by alternative embodiments without departing from the scope of the appended claims.In this regard, for example, various combinations of elements and / or functions not explicitly described above are considered as if they were specified in some of the appended claims. Although specific terms are used here, they are used in a general and purely descriptive sense and not for the purpose of limitation.

Claims

[1] A key-sharing method for enabling remote desktop access to a service by a client, the method comprising: Receiving a request from an endpoint device to grant a user access to a remote desktop service, where the request includes session information; Retrieving a username and password associated with the user based on session information; Assigning a validity period to the password; Generating an initial secret key that is at least partially based on information associated with the user or the terminal device; Generating a second secret key that is at least partially based on the first secret key and a salt; Encrypting a packet containing the password and a time period specification, using the second secret key; Appending the salt to the encrypted packet; and Transmitting the username, encrypted packet, and attached salt to the terminal to authenticate the user to access the requested remote desktop service. [2] A key-sharing method for enabling remote desktop access to a service by a client according to claim 1, wherein the step of obtaining the username and password further comprises obtaining the username and password from a single sign-on repository. [3] A key-sharing method for enabling remote desktop access to a service by a client according to claim 1, wherein the step of receiving a request from the terminal further comprises receiving a session username and session password associated with the user. [4] A key-sharing method for enabling remote desktop access to a service by a client according to claim 3, wherein the session information is based at least partially on the session username and session password. [5] A key-sharing method for enabling remote desktop access to a service by a client according to claim 1, wherein the salt comprises a randomly generated string of characters. [6] A key-sharing method for enabling remote desktop access to a service by a client according to claim 1, wherein the appending step comprises appending the salt in an unencrypted form. [7] A key-sharing method for enabling remote desktop access to a service by a client according to claim 1, wherein the validity period includes a specification of a start time and a specification of a stop time. [8] A key-sharing device for enabling remote desktop access to a service by a client, the device comprising: at least a processor and at least one memory that stores computer program code, wherein the at least one memory and the stored computer program code are configured with the at least one processor to cause the device to To receive a request from an endpoint device to grant a user access to a remote desktop service, where the request includes session information, to obtain a username and password associated with the user based on the session information, to assign a validity period to the password, to generate an initial secret key that is at least partially based on information associated with the user or the terminal device, to generate a second secret key that is at least partially based on the first secret key and a salt, to encrypt a packet containing the password and a time period specification using the second secret key, to append the salt to the encrypted packet and to transmit the username, the encrypted packet and the attached salt to the terminal to authenticate the user to access the requested remote desktop service. [9] A key-sharing device for enabling remote desktop access to a service by a client according to claim 8, further comprising a single sign-on repository from which the username and password are obtained. [10] A key-sharing device for enabling remote desktop access to a service by a client according to claim 8, wherein the request from the terminal device further comprises a session username and session password associated with the user. [11] A key-sharing device for enabling remote desktop access to a service by a client according to claim 10, wherein the session information is based at least partially on the session username and session password. [12] A key-sharing device for enabling remote desktop access to a service by a client according to claim 8, wherein the salt comprises a randomly generated string of characters. [13] A key-sharing device for enabling remote desktop access to a service by a client according to claim 8, wherein the appended salt is unencrypted. [14] A key-sharing device for enabling remote desktop access to a service by a client according to claim 8, wherein the validity period includes a specification of a start time and a specification of a stop time. [15] A computer program product for key sharing to enable remote desktop access to a service by a client, wherein the computer program product comprises: at least a computer-readable storage medium containing computer-readable program instructions, wherein the program instructions are configured to To receive a request from an endpoint device to grant a user access to a remote desktop service, where the request includes session information, to obtain a username and password associated with the user based on the session information, to assign a validity period to the password, to generate an initial secret key that is at least partially based on information associated with the user or the terminal device, to generate a second secret key that is at least partially based on the first secret key and a salt, to encrypt a packet containing the password and a time period specification using the second secret key, to append the salt to the encrypted packet and to transmit the username, the encrypted packet and the attached salt to the terminal to authenticate the user to access the requested remote desktop service. [16] A computer program product for key sharing to enable remote desktop access to a service by a client according to claim 15, further comprising a single sign-on repository from which the username and password are obtained. [17] A computer program product for key sharing to enable remote desktop access to a service by a client according to claim 15, wherein the request from the terminal device further comprises a session username and session password associated with the user. [18] A computer program product for key sharing to enable remote desktop access to a service by a client according to claim 17, wherein the session information is based at least partially on the session username and session password. [19] A computer program product for key sharing to enable remote desktop access to a service by a client according to claim 15, wherein the salt comprises a randomly generated string of characters. [20] A computer program product for key sharing to enable remote desktop access to a service by a client according to claim 15, wherein the appended salt is unencrypted. [21] A computer program product for key sharing to enable remote desktop access to a service by a client according to claim 15, wherein the validity period includes a specification of a start time and a specification of a stop time.

Images