Enhanced QoS solution for thin client or remote access sessions
View Patent ↗Methods, apparatuses and systems directed to the application of network QoS policy to different data types multiplexed over a connection corresponding to a given session between a first host and a second host. In one implementation, the present invention includes a dual gateway architecture where a first gateway terminates the connection with a remote access client, demultiplexes the remote access session data stream into a plurality of separate streams for transmission to a second gateway. The second gateway re-multiplexes the separate data streams into a single remote access session data stream for transmission to a remote access server. The use of separate data streams between the first and second gateways allows for the application of individual policies on the components of the remote access session data flow. For example, a policy scheme can be configured that gives preference to mouse movements, transmitted in a first data stream, over printer traffic, transmitted in a second data stream. The present invention can also be applied to network application protocols, other than remote access protocols, that multiplex more than one “virtual channel” containing different traffic types over a single transport layer connection.
1. A method comprising
de-multiplexing, at a first gateway, a remote access session between a remote access server executing on a first host and a remote access client executing on a second host into a plurality of data streams, wherein de-multiplexing the remote access session comprises
receiving, over a first transport layer connection during the remote access session, from the remote access client input/output data associated with one or more input/output devices of the second host; and
separating the input/output data received from the remote access client into the plurality of data streams, each of the data streams associated with a virtual channel of the remote access session or an access priority, the input/output data separated into the plurality of data streams according to the type of input/output data;
transmitting the plurality of data streams across a network over corresponding transport layer connections to a second gateway;
monitoring a handshake between the remote access client and the remote access server; and
establishing at least one connection between the first gateway and the second gateway in response to a successful handshake between the remote access client and the remote access server.
2. The method of claim 1 further comprising
multiplexing, at the second gateway, the remote access session data received in the plurality of data streams from the first gateway.
3. The method of claim 1 further comprising
applying a QoS mechanism to the plurality of data streams.
4. The method of claim 3 wherein the applying step comprises prioritizing at least one of the plurality of data streams over at least a second data stream of the plurality of data streams.
5. The method of claim 1 wherein the remote access session between the remote access server and the remote access client utilizes a single, persistent transport layer connection.
6. The method of claim 5 further comprising
splitting, at the first gateway, the single, persistent transport layer connection; and
establishing at least one connection with a second gateway.
7. The method of claim 6 further comprising
further splitting the single, persistent transport layer connection at the second gateway.
8. The method of claim 1 further comprising
intercepting, at the first gateway, a handshake message from the remote access client; and
forwarding information relating to the handshake message to the second gateway.
9. The method of claim 8 further comprising
transmitting a second handshake message from the first gateway to the remote access client, wherein the second handshake message comprises an authentication challenge; and
forwarding information relating to an authentication response from the remote access client to the second gateway.
10. The method of claim 1 wherein at least one of the corresponding connections is a transport layer connection.
11. The method of claim 10 wherein the transport layer connection is a TCP connection.
12. The method of claim 10 wherein the transport layer connection is a XTP connection.
13. The method of claim 1 further comprising
compressing at least one of the data streams for transmission to the second gateway.
14. The method of claim 1 further comprising
encrypting at least one of the data streams for transmission to the second gateway.
15. The method of claim 1 further comprising
receiving screen update data of the remote access session from the second gateway; and
transmitting the screen update data to the remote access client over the first transport layer connection.
16. A gateway operative in a network comprising a remote access server and a remote access client, wherein the remote access client and the remote access server are operative to transmit remote session data using a remote access session protocol, the gateway, comprising
at least one network interface;
a processor;
a memory;
a data flow management application, stored in the memory, comprising instructions operable to cause the processor and the at least one network interface to
de-multiplex a remote access session between a remote access server and a remote access client into a plurality of data streams, wherein de-multiplexing the remote access session comprises
receiving, over a first transport layer connection during the remote access session, from the remote access client input/output data associated with one or more input/output devices of the second host; and
separating the input/output data received from remote access client into the plurality of data streams, each of the data streams associated with a virtual channel of the remote access session or an access priority, the input/output data separated into the plurality of data streams according to the type of input/output data;
transmit the plurality of data streams across a network over corresponding transport layer connections to a second gateway;
monitor a handshake between the remote access client and the remote access server; and
establish at least one connection between the first gateway and the second gateway in response to a successful handshake between the remote access client and the remote access server.
17. The gateway of claim 16 wherein the data flow management application further comprises instructions operable to cause the processor and the at least one network interface to
receive data streams corresponding to a remote access session from a remote gateway; and
multiplex the data streams into a remote access session protocol; and
transmit the multiplexed remote access session data over a single transport layer connection to a remote access session endpoint.
18. The gateway of claim 16 wherein the data flow management application further comprises instructions operable to cause the processor and the at least one network interface to apply a QoS mechanism to the plurality of data streams.
19. The gateway of claim 18 wherein the QoS mechanism is operative to prioritize at least one of the plurality of data streams over at least a second data stream of the plurality of data streams.
20. The gateway of claim 16 wherein the remote access session between the remote access server and the remote access client utilizes a single, persistent transport layer connection.
21. The gateway of claim 16 wherein the data flow management application further comprises instructions operable to cause the processor and the at least one network interface to
intercept a handshake message from the remote access client; and
forward information relating to the handshake message to the second gateway.
22. The gateway of claim 21 wherein the data flow management application further comprises instructions operable to cause the processor and the at least one network interface to
transmit a second handshake message from the first gateway to the remote access client, wherein the second handshake message comprises an authentication challenge; and
forward information relating to an authentication response from the remote access client to the second gateway.
23. The gateway of claim 16 wherein at least one of the corresponding connections is a transport layer connection.
24. The gateway of claim 16 wherein the data flow management application further comprises instructions operable to cause the processor and the at least one network interface to compress at least one of the data streams for transmission to the second gateway.
25. The gateway of claim 16 wherein the data flow management application further comprises instructions operable to cause the processor and the at least one network interface to encrypt at least one of the data streams for transmission to the second gateway.
26. A method, comprising
receiving, at a first gateway, one or more meta frame packets transmitted between a remote access client and a remote access server during a remote access session, wherein each of the meta frame packets comprises one or more command packets each associated with a virtual channel of a plurality of virtual channels, wherein a first virtual channel of the plurality of virtual channels comprises keystroke input data transmitted from the remote access client to the remote access server, and wherein a second virtual channel of the plurality of virtual channels comprises mouse movement data transmitted from the remote access client to the remote access server; and
de-multiplexing, at the first gateway, the remote access session between the remote access server and the remote access client into a plurality of data streams by
extracting the command packets from the meta frame packets;
transmitting one or more of the extracted command packets across a network over a first transport layer connection to a second gateway; and
transmitting one or more of the other extracted command packets across the network over a second transport layer connection to the second gateway.
27. The method of claim 26 wherein transmitting the extracted command packets comprises
buffering the command packets on a plurality of queues, wherein each of the plurality of queues is associated with select ones of the plurality of virtual channels;
arbitrating among the plurality of queues to select command packets for transmission according to a prioritization scheme.