Remote access over internet using reverse session-origination (RSO) tunnel
A remote user sends a user request to a relay server that, in turn, forwards the user request (modified or unmodified) through a reverse session-origination (RSO) tunnel to an on-premises network client. In other words, while the user requests flow from outside the client network to the client network, the requests of the delivery protocol for the tunnel flow in the reverse direction, i.e., from the client network toward the relay server and/or the remote user. A server agent, executing client side, generates delivery-protocol requests so that the server can wrap user requests in delivery-protocol responses. In addition, the server agent unwraps user requests and forwards them to their intended destination in the client network. To minimize any time the server would have to wait for a delivery-protocol request, the server agent can generate dummy requests whenever no delivery-protocol request is pending at the server.
1. A system comprising media encoded with code that, when executed using hardware, implements a process including:
receiving or generating, by a server, a user request, said server including a management application to provide management as a service (MaaS);
determining whether or not there is a delivery-protocol request from a client network pending at the server;
utilizing a calibration response to determine a time-out period;
in the event it is determined that there is no pending delivery-protocol request from the client network at the server, repeating the determining until there is a pending delivery-protocol request from the client network at the server, and
in the event it is determined that there is a pending delivery-protocol request from the client network, wrapping the user request in a delivery-protocol response, transmitting the delivery-protocol response to the on-premises network client over a reverse session-origination (RSO) tunnel, and extracting the user request packet from the delivery-protocol response at the client network, the pending delivery-protocol request being separate from the user request;
a server agent running on the client network determining whether or not a delivery-protocol request from the client network is pending at the server; and
in response to a determination that no delivery-protocol request from the on-premises client network is pending at the server, transmitting a delivery-protocol request from the on-premises client network to the server prior to an expiration of said time-out period in order to prevent termination of a session.
2. The system of claim 1 wherein the process further includes the server agent causing a port on the on-premises client network to be forwarded to the server so as to create the RSO tunnel.
3. The system of claim 2 wherein a management application executing on the server generates inbound user requests from which the user request packet is derived, wherein the user request packet is used in managing virtual machines executing on hardware of the client network.
4. The system of claim 3 wherein the delivery protocol is the hypertext transfer protocol (HTTP) or a secure variant thereof, and the user request conforms to a transmission control protocol (TCP).
5. The system of claim 4 wherein the process further includes receiving, by the server and from a user device, virtual-machine management commands, user requests being generated in response to receipt of the virtual-machine management commands.
6. The system of claim 1 further comprising the hardware.
7. A system comprising:
an on-premise client network including hardware, a firewall, and a server agent located behind the firewall; and
a service including server hardware, an agent connection endpoint (ACE) located other than behind the firewall, and a server application executing on the server hardware;
the server agent being configured for
forwarding a client port of the client network to a server port of the server to form a reverse session-origination (RSO) tunnel through the firewall and from the on-premises client system to the server,
wrapping payload-protocol responses in delivery-protocol requests and transmitting the wrapped payload-protocol responses to the server via the RSO tunnel, and
extracting payload-protocol requests from delivery-protocol responses and forwarding the unwrapped payload-protocol requests to a destination on the client network;
the ACE being configured for
wrapping payload-protocol requests in delivery-protocol responses, and extracting payload-protocol responses from delivery-protocol requests, and
wherein the ACE is further configured for:
determining whether or not there is a delivery-protocol request from the on-premises client network pending at the server;
in the event it is determined that there is no pending delivery-protocol request from the client network pending at the server, repeating the determining until there is a pending delivery-protocol request from the client network at the server;
utilizing a calibration response to determine a time-out period; and
in the event it is determined that there is a delivery-protocol request from the client network at the server, wrapping a user request in an delivery-protocol response to the delivery-protocol request, transmitting the delivery-protocol response to the client network, and extracting the user request from the delivery-protocol response at the client network prior to an expiration of said time-out period in order to prevent termination of a session.
8. The system of claim 7 wherein the server agent is further configured to:
determine whether or not a delivery-protocol request from the client network is pending at the server; and
in response to a determination that no delivery-protocol request from the client network is pending at the server, transmitting a delivery-protocol request from the client network to the server.
9. The system of claim 8 wherein the first protocol is a Transmission Control Protocol (TCP) and the delivery-protocol is a secure Hypertext Transfer Protocol.