Multi-Hop Virtual Session Leasing via Endpoint Key Binding

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In multi-level connection or 'hop' virtualization scenarios, connection leases and long-lived authentication tokens are user and device specific, making secure authentication challenging, especially when multiple connections are required from an endpoint device to virtual desktops and additional published apps/desktops.

Innovation Solution

The system binds second and higher-level connection leases and authentication tokens to an endpoint device using its private/public key pair, allowing downstream computing devices to operate in pass-through mode, authenticating requests using the endpoint private key without exposing it, through extended connection lease exchange protocols or virtual smart cards.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If connection leases are made user and device specific for secure authentication, then authentication security is improved, but the ability to establish multiple connections from an endpoint device deteriorates

Engineering Contradiction:

Improveauthentication securityVSAvoidmulti-connection capability

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system segments the connection authentication process by introducing intermediate computing appliances that act as separate authentication entities. Each appliance can independently authenticate connections using its own credentials while representing the endpoint device, allowing multiple simultaneous connections without compromising the endpoint's private key security.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Intermediate computing appliances serve as mediators between the endpoint device and virtual desktops. These appliances hold authentication tokens and connection leases that enable them to establish multiple connections on behalf of the endpoint device, resolving the contradiction between secure authentication and multi-connection capability.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If the endpoint private key is used for authentication in multiple connections, then connection security is improved, but the risk of private key exposure increases

Engineering Contradiction:

Improveconnection securityVSAvoidprivate key exposure risk

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system extracts the private key from the authentication process by having intermediate computing appliances use their own authentication tokens and connection leases to establish connections. The endpoint device's private key remains securely stored and is never transmitted or exposed during the connection establishment process.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The intermediate computing appliances create cryptographic copies or representations of the endpoint device's identity through authentication tokens and connection leases. These copies enable authentication without requiring the actual private key to be present or transmitted during connection establishment.

Inventive Principle:

Principle #26Copying

3Adaptability or versatility

If downstream computing devices operate in pass-through mode with extended connection lease exchange protocols, then multi-hop connection capability is improved, but system complexity increases

Engineering Contradiction:

Improvemulti-hop connection capabilityVSAvoidprotocol complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The intermediate computing appliances are designed with multi-functionality, serving as both endpoints for incoming connections and as proxies for outgoing connections to virtual desktops. This universal design simplifies the overall system architecture by reducing the need for specialized components for each connection type.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The connection architecture implements a nested structure where intermediate computing appliances are nested within the endpoint device's authentication context, which is in turn nested within the virtual desktop connection framework. This nested organization allows complex multi-hop connections to be managed through layered, manageable protocols at each level.

Inventive Principle:

Principle #7Nested doll (Nesting)

Data Source

PatentUS12126723B2Computing system and related methods providing multiple endpoint connections based upon connection leases

Publication Date: 2024.10.22 CITRIX SYSTEMS INC

AI summary

A computing appliance may include a memory and a processor configured to cooperate with the memory to establish a first virtual session for an endpoint device over a first network connection. The endpoint device may have an endpoint public/private key pair associated therewith and configured to store a plurality of connection leases generated based upon the endpoint public key, and the first virtual session may be established responsive to a first one of the connection leases and authentication based upon the endpoint private key. The processor may further establish a second virtual session for the endpoint device to access through the first virtual session with another computing appliance over a second network connection responsive to a second one of the connection leases and authentication based upon the endpoint private key.