# US 7,609,721 B2 · Systems and methods for adjusting the maximum transmission unit for encrypted communications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 7,609,721 B2 - Document ID: US7609721B2 - Status: Granted - Kind: B2 - Application number: 11/188,279 - Filed: 2005-07-22 - Published: 2006-02-23 - Granted: 2009-10-27 - Earliest claimed: 2004-07-23 - Assignees: Citrix Systems, Inc. - Inventors: Goutham P. Rao; Robert A. Rodriguez; Eric R. Brueggemann - Web page: https://patentgrep.com/patent/US7609721B2 ## CPC - H04L 1/1854: {Scheduling and prioritising arrangements} - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 41/0806: for initial configuration or provisioning, e.g. plug-and-play - H04L 41/0894: Policy-based network configuration management - H04L 43/0817: by checking functioning - H04L 45/30: Routing of multiclass traffic - H04L 47/2416: Real-time traffic - H04L 47/2433: {Allocation of priorities to traffic types} - H04L 47/2475: for supporting traffic characterised by the type of applications - H04L 47/36: by determining packet size, e.g. maximum transfer unit [MTU] - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/0272: {Virtual private networks} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 63/126: {the source of the received data} - H04L 67/14: Session management (for real-time applications in data packet communications networks H04L65/1066) - H04L 67/141: Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) - H04L 63/164: {at the network layer} - H04L 63/166: {at the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present invention is generally directed towards a remote access architecture for providing peer-to-peer communications and remote access connectivity. In one embodiment, the remote access architecture of the present invention provides a method for establishing a direct connection between peer computing devices via a third computing device, such as a gateway. Additionally, the present invention provides the following techniques to optimize peer-to-peer communications: 1) false acknowledgement of receipt of network packets allowing communications via a lossless protocol of packets constructed for transmission via a lossy protocol, 2) payload shifting of network packets allowing communications via a lossless protocol of packets constructed for transmission via a lossy protocol, 3) reduction of packet fragmentation by adjusting the maximum transmission unit (MTU) parameter, accounting for overhead due to encryption, 4) application-aware prioritization of client-side network communications, and 5) network disruption shielding for reliable and persistent network connectivity and access. ## Claims ### Claim 1 A method for adjusting the maximum transmission unit of a secure network communication to reduce network fragmentation, the method comprising the steps of: (a) establishing a session between a first computing device and a second computing device, the first computing device having a first network stack; (b) detecting, by the first computing device, a plurality of network packets of the session having encrypted payloads, at least the first network packet of the plurality of network packets of the session having a different size of encryption overhead than the one of a second network packet of the plurality of network packets of the session; (c) determining, by the first computing device, in response to the detecting, a setting for a maximum transmission unit parameter of the first network stack to reduce a maximum transmission unit size by at least a size of a largest encryption overhead of the plurality of network packets of the session; and (d) altering the maximum transmission unit parameter of the first network stack to the determined setting. ### Claim 2 (depends on 1) The method of claim 1, comprising communicating the network packet via one of a secure socket layer or a transport layer security tunnel to the second computing device. ### Claim 3 (depends on 1) The method of claim 1, wherein the payload comprises a real-time protocol. ### Claim 4 (depends on 1) The method of claim 1, further comprising altering the maximum transmission unit parameter via a network driver interface specification level mechanism of the first network stack. ### Claim 5 (depends on 1) The method of claim 1, further comprising determining the setting of the maximum transmission unit parameter dynamically per session between the first computing device and the second computing device. ### Claim 6 (depends on 1) The method of claim 1, comprising establishing the session between the first computing device and the second computing device via a gateway. ### Claim 7 (depends on 1) The method of claim 1, communicating by the first computing device one of real-time voice, audio, or data to the second computing device via the payload of the network packet. ### Claim 8 (depends on 1) The method of claim 1, comprising communicating a false acknowledgement of receipt of the network packet to one of the first computing device or the second computing device before communicating the network packet. ### Claim 9 (depends on 1) The method of claim 1, further comprising establishing the session between the first computing device and the second computing device via an agent of the first computing device. ### Claim 10 (depends on 9) The method of claim 9, comprising communicating, by the agent, via an input/output control (IOCTL) application programming interface to the first network stack to alter the maximum transmission unit parameter to the determined setting. ### Claim 11 A system for adjusting the maximum transmission unit of a secure network communication to reduce network fragmentation, the system comprising: a means for establishing a session between a first computing device and a second computing device, the first computing device having a first network stack; a means for detecting, by the first computing device, a plurality of network packets of the session having an encrypted payloads, at least the first network packet of the plurality of network packets of the session having a different size of encryption overhead than the one of a second network packet of the plurality of network packets of the session; a means for determining, in response to the detecting, by the first computing device, a setting for a maximum transmission unit parameter of the first network stack to reduce a maximum transmission unit size by at least a size of a largest encryption overhead of the plurality of network packets of the session; and a means for altering the maximum transmission unit parameter of the first network stack to the determined setting. ### Claim 12 (depends on 11) The system of claim 11, comprising a means for communicating the network packet via one of a secure socket layer or a transport layer security tunnel to the second computing device. ### Claim 13 (depends on 11) The system of claim 11, wherein the payload comprises a real-time protocol. ### Claim 14 (depends on 11) The system of claim 11, wherein the payload comprises a representation of one of real-time voice, audio, or data. ### Claim 15 (depends on 11) The system of claim 11, further comprising a means for altering the maximum transmission unit parameter of the first computing device via a network driver interface specification level mechanism of the first network stack. ### Claim 16 (depends on 11) The system of claim 11, further comprising a means for determining the setting of the maximum transmission unit parameter dynamically per session between the first computing device and the second computing device. ### Claim 17 (depends on 11) The system of claim 11, comprising a means for establishing the session between the first computing device and the second computing device via a gateway. ### Claim 18 (depends on 11) The system of claim 11, comprising a means for communicating by the first computing device one of real-time voice, audio, or data to the second computing device via the payload of the network packet. ### Claim 19 (depends on 11) The system of claim 11, comprising a means for communicating a false acknowledgement of receipt of the network packet to one of the first computing device or the second computing device before communicating the network packet. ### Claim 20 (depends on 11) The system of claim 11, wherein the network packet comprises a lossless protocol packet. ### Claim 21 (depends on 20) The system of claim 20, wherein the lossless protocol packet comprises a transport control protocol. ### Claim 22 (depends on 11) The system of claim 11, wherein the payload comprises a lossy protocol packet. ### Claim 23 (depends on 22) The system of claim 22, wherein the lossy protocol packet comprises a user datagram protocol. ### Claim 24 (depends on 11) The system of claim 11, comprising an agent of the first computing device for establishing the session between the first computing device and the second computing device. ### Claim 25 (depends on 24) The system of claim 24, wherein the agent communicates via an input/output control (IOCTL) application programming interface to the first network stack to alter the maximum transmission unit parameter to the determined setting. ### Claim 26 A method for adjusting the maximum transmission unit of a secure network communication to reduce network fragmentation for a session, the method comprising the steps of: (a) establishing, by a remote access client of a computing device, a session with a gateway, the computing device having a network stack; (b) receiving, by the remote access client, from the gateway, a plurality of networks packets of the session; (c) detecting, by the remote access client, network packets of the plurality of network packets of the session having encrypted payloads, at least a first network packet of the detected network packets having a different size of encryption overhead than the one of a second network packet of the detected network packets; (d) determining, by the remote access client, in response to the detecting, a setting for a maximum transmission unit (MTU) parameter of the network stack to reduce a MTU size by a size of a largest encryption overhead of the plurality of network packets of the session; and (e) altering, by the remote access client, the MTU parameter of the network stack to the determined setting.