Securing a data connection for communicating between two end-points
Methods and systems for securing a data connection for communicating between two end-points are described herein. One of the end-points may be a server and the other of the end-points may be a client that wants to communicate with the server. The data connection may be secured based on a previously-established secure connection and/or a self-signed or self-issued certificate. In some variations, by using the previously-established secure connection and/or a self-signed or self-issued certificate, the secure communication between the server and the client may be conducted without using a third-party authentication service and without requiring a third-party CA to issue a certificate for the server.
1. A method comprising:
receiving, by a client device, first data from a computing device, the first data including a certificate of a server and at least one parameter of a communications channel between the client device and the server;
establishing, by the client device, the communications channel with the server based on the at least one parameter of the first data, the channel configured to transmit data between the client device and the server;
determining, by the client device, that credentials received from the server via the communications channel are valid based on a comparison of the received credentials with that of the certificate of the first data; and
sending, by the client device, second data via the communications channel to access a resource of the server in response to validation of the credentials received from the server via the communications channel.
2. The method of claim 1 , wherein the communications channel is for a session of a remote desktop service.
3. The method of claim 2 , wherein the first data comprises an Independent Computing Architecture (ICA) file associated with the session of the remote desktop service.
4. The method of claim 2 , wherein the server is a virtual delivery agent associated with the session of the remote desktop service.
5. The method of claim 1 , wherein the communications channel is a confidentiality- and integrity-protected connection.
6. The method of claim 5 , wherein the communications channel is a Transport Layer Security (TLS) connection.
7. The method of claim 5 , wherein the first data is received via an integrity-protected connection.
8. The method of claim 1 , wherein the credentials received from the server include a self-signed or self-issued certificate for the server, and wherein determining that credentials received from the server via the communications channel are valid is performed based on determining that the self-signed or self-issued certificate for the server matches the certificate of the first data.
9. An apparatus comprising:
one or more processors; and
memory storing executable instructions that, when executed by the one or more processors, cause the apparatus to:
receive, from a computing device, first data that includes a certificate of a server and at least one parameter of a communications channel between the apparatus and the server;
establish the communications channel with the server based on the at least one parameter of the first data, the channel configured to transmit data between the apparatus and the server;
determine that credentials received from the server via the communications channel are valid based on a comparison of the received credentials with that of the certificate of the first data; and
send second data via the communications channel to access a resource of the server in response to validation of the credentials received from the server via the communications channel.
10. The apparatus of claim 9 , wherein the communications channel is for a session of a remote desktop service.
11. The apparatus of claim 10 , wherein the first data comprises an Independent Computing Architecture (ICA) file associated with the session of the remote desktop service.
12. The apparatus of claim 10 , wherein the server is a virtual delivery agent associated with the session of the remote desktop service.
13. The apparatus of claim 9 , wherein the communications channel is a confidentiality- and integrity-protected connection.
14. The apparatus of claim 13 , wherein the communications channel is a Transport Layer Security (TLS) connection.
15. The apparatus of claim 13 , wherein the first data is received via an integrity-protected connection.
16. The apparatus of claim 9 , wherein the credentials received from the server include a self-signed or self-issued certificate for the server, and wherein the executable instructions that, when executed by the one or more processors, cause the apparatus to determine that credentials received from the server via the communications channel are valid based on determining that the self-signed or self-issued certificate for the server matches the certificate of the first data.
17. A computing device comprising:
one or more processors; and
a memory storing second executable instructions that, when executed by the one or more processors, cause the computing device to:
establish a connection between the computing device and a server;
authenticate, based on a comparison of a first copy of a self-signed or self-issued certificate and a second copy of the self-signed or self-issued certificate, the server, the second copy of the self-signed or self-issued certificate being received from the server via the connection; and
provide, by the computing device and to the server via the connection, data associated with a session of a remote desktop service so as to enable a client device to access a resource executable on the server.
18. The computing device of claim 17 , wherein the server is a virtual delivery agent associated with the session of the remote desktop service.
19. The computing device of claim 17 , wherein the connection is a confidentiality- and integrity-protected connection, and wherein the executable instructions, when executed by the one or more processors, cause the computing device to:
based on establishing the connection, receive, from the server and based on one or more confidentiality- and integrity-protected messages, the second copy of the self-signed or self-issued certificate.
20. The computing device of claim 17 , wherein the communications channel is a Transport Layer Security (TLS) connection.