Granted Patent B2

US 11,336,683 · App. 16/654,867 · Granted May 17, 2022

Inventors: Venkata Subba Rao Gorrepati (Bengaluru, IN); Jubin Jose (Bengaluru, IN); Ranjith Nath (Bengaluru, IN); Sathaiah Dontula (Bengaluru, IN)

Assignee: Citrix Systems, Inc.

H04L63/1466H04L63/126H04L63/1416

Abstract

Claims (64)

1. A method comprising:

receiving, by a first node in a cluster having a plurality of nodes, an indication of a node event of the cluster that causes a missed sequence number in communications between the plurality of nodes in the cluster;

accessing, by the first node, a first sequence number from a storage, the first sequence number associated with a previous communication between the plurality of nodes in the cluster;

adjusting, by the first node responsive to the node event that causes the missed sequence number in the communications between the plurality of nodes in the cluster, the first sequence number by a delta that is established based at least in part on an average number of communications between the plurality of nodes in the cluster in a determined time period to generate a second sequence number;

storing, by the first node, the second sequence number to the storage responsive to the node event; and

transmitting, by the first node, a packet including the second sequence number to the plurality of nodes in the cluster, the second sequence number used by the plurality of nodes to reset a starting sequence number for communications between the plurality of nodes to prevent replay attacks in the cluster based on the missed sequence number in the communications between the plurality of nodes in the cluster.

2. The method of claim 1 , wherein the node event includes at least one of a node reboot, a node reset, a node upgrade or a node deployment of the cluster.

3. The method of claim 1 , comprising generating the second sequence number as a nonce sequence number having a 64 bit value.

4. The method of claim 1 , comprising:

encrypting, by the first node, the packet including the second sequence number; and

transmitting, by the first node, the packet with a hash-based message authentication code to the plurality of nodes of the cluster.

5. The method of claim 1 , comprising:

receiving, by nodes of the plurality of nodes, the packet including the second sequence number; and

storing, by the nodes of the plurality of nodes and responsive to the node event, the second sequence numbers to storage of the respective nodes.

6. The method of claim 1 , comprising storing, by each node of the plurality of nodes, subsequent sequence numbers used in communication between the plurality of nodes to storage of the respective nodes at intervals corresponding to the determine time period.

7. The method of claim 1 , comprising:

determining, by the first node, the average number of communications between the plurality of nodes in the cluster in the determined time period; and

multiplying, by the first node, the average number of communications by the determined time period to generate the delta.

8. The method of claim 1 , comprising:

authenticating, by a second node of the plurality of nodes, the packet using a hash-based message authentication code, the packet including the second sequence number;

determining, by the second node, the second sequence number is greater than the threshold number; and

storing, by the second node responsive to the node event and the determination, the second sequence number to a storage of the second node.

9. The method of claim 1 , comprising:

generating, by the first node, a second packet for transmission to the plurality of nodes of the cluster independent of the node event;

accessing, by the first node, the second sequence number from the storage of the first node;

adjusting, by the first node, the second sequence number by an integer value to generate a third sequence number, the integer value less than the delta; and

transmitting, by the first node, a second packet including the third sequence number to the plurality of nodes in the cluster.

10. The method of claim 9 , comprising:

receiving, by one or more nodes of the plurality of nodes, the second packet including the third sequence number; and

comparing, by the one or more nodes, the third sequence number to the second sequence number to determine if the third sequence number is greater than the second sequence number.

11. The method of claim 10 , comprising:

accepting, by the one or more nodes, the second packet responsive to determining that the third sequence number is greater than the second sequence number.

12. The method of claim 10 , comprising:

rejecting, by the one or more nodes, the second packet responsive to determining the third sequence number is less than the second sequence number.

13. A method comprising:

receiving, by a first node in a cluster having a plurality of nodes, a packet from a second node in the cluster responsive to a node event of the cluster that causes a missed sequence number in communications between the plurality of nodes in the cluster;

identifying, by the first node, a first sequence number included within the packet;

accessing, by the first node, a second sequence number from a storage, the second sequence number indicative of a sequence number used in a previous communication between the plurality of nodes in the cluster;

adjusting, by the first node responsive to the node event that causes the missed sequence number in the communications between the plurality of nodes in the cluster, the second sequence number by a delta that is established based at least in part on an average number of communications between the plurality of nodes in the cluster in a determined time period to generate a threshold number; and

comparing, by the first node, the first sequence number to the threshold number to determine if the sequence number is greater than or less than the threshold number and process the packet at the first node when the sequence number is greater than or less than the threshold number.

14. The method of claim 13 , comprising:

accepting, by the first node, the packet responsive to determining that the first sequence number is greater than the threshold number; and

storing, by the first node responsive to the node event, the first sequence number to the storage of the first node to replace the second sequence number.

15. The method of claim 13 , comprising:

rejecting, by the first node, the packet responsive to determining the sequence number is less than the threshold number.

16. The method of claim 13 , comprising:

receiving, by multiple nodes of the plurality of nodes, the packet from the second node in the cluster responsive to the node event of the cluster, the packet including the first sequence number; and

storing, by each of the multiple nodes, the first sequence number to storage of the respective node responsive to determining that the first sequence number is greater than the threshold number at the determined time interval.

17. The method of claim 13 , comprising:

storing, by each node of the plurality of nodes, subsequent sequence numbers used in communication between the plurality of nodes to storage of the respective nodes at intervals corresponding to the determine time period.

18. A system comprising:

a first node in a cluster having a plurality of nodes, the first node comprising one or more processors coupled to memory; and

the one or more processors configured to:

receive an indication of a node event of the cluster that causes a missed sequence number in communications between the plurality of nodes in the cluster;

access a first sequence number from a storage, the first sequence number associated with a previous communication between the plurality of nodes in the cluster;

adjust, responsive to the node event that causes the missed sequence number in the communications between the plurality of nodes in the cluster, the first sequence number by a delta that is established based at least in part on average number of communications between the plurality of nodes in the cluster in a determined time period to generate a second sequence number;

store the second sequence number to the storage responsive to the node event; and

transmit a packet including the second sequence number to the plurality of nodes in the cluster, the second sequence number used by the plurality of nodes to reset a starting sequence number for communications between the plurality of nodes to prevent replay attacks in the cluster based on the missed sequence number in the communications between the plurality of nodes in the cluster.

19. The system of claim 18 , wherein the one or more processors are configured to:

encrypt the packet including the second sequence number; and

transmit the packet with a hash-based message authentication code to the plurality of nodes of the cluster.

20. The system of claim 18 , wherein the one or more processors are configured to:

determine the average number of communications between the plurality of nodes in the cluster in the determined time period; and

multiply the average number of communications by the determined time period to generate the delta.

Assignments (9)

Continuity (1)

Cited By (3)

US 12,199,995 US 12,443,439 US 12,647,486