Providing domain-joined remote applications in a cloud environment

• US 10,079,818 B2
• Filed: 04/01/2016
• Issued: 09/18/2018
• Est. Priority Date: 06/14/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Hussain, Amjad, Hoover, Jonathan Austin, Scott, Tristan William, Ben-Shachar, Ido Miles, London, Kevin Scott
• Primary Examiner(s): Jhaveri, Jayesh M
• Application Number:
  US15/088,434
• Publication Number:
  US 20160373424A1
• Time in Patent Office: 900 Days
• CPC Class Codes: G06F 2009/45562 Creating, deleting, cloning virtual machine instances
• CPC Class Codes: G06F 2009/45566 Nested virtual machines
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 2009/45575 Starting, stopping, suspending or resuming virtual machine instances
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]
• CPC Class Codes: G06F 9/5072 Grid computing
• CPC Class Codes: G06F 9/5077 Logical partitioning of resources; Management or configuration of virtualized resources specific details on emulation or internal functioning of virtual machines G06F9/455
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

Embodiments are directed to provisioning private virtual machines in a public cloud and to managing private virtual machines hosted on a public cloud. In one scenario, a virtual network is established at a public cloud environment based on a request received from a private domain, and an authenticated session is established between the virtual network and the private domain. A virtual machine is hosted within the virtual network. The virtual machine is configured to be accessible to a user authenticated to the virtual machine, and is configured to run an application using data received from the private domain. Private data is received from the private domain over the authenticated session, and the authenticated user is provided access to the application running at the virtual machine, including providing the authenticated user access to the private data.

Claims

1. A computer-implemented method performed by one or more hardware processors executing computer-executable instructions that cause the one or more hardware processors to perform the computer-implemented method, which comprises:

based on receiving a request that originated from within a private domain that is not publicly accessible, establishing a virtual network at a public cloud environment;

establishing an authenticated session between the virtual network and the private domain;

hosting a virtual machine within the virtual network, wherein the virtual machine;

is configured to be accessible to a user authenticated to the virtual machine; and

is configured to run an application using data received from the private domain;

receiving private data from the private domain over the authenticated session; and

providing the authenticated user access to the application running at the virtual machine, including providing the authenticated user access to the private data.

2. The computer-implemented method of claim 1, wherein the authenticated session provides encrypted communications between the virtual network and the private domain.

3. The computer-implemented method of claim 1, wherein the virtual machine is configured to run a virtual desktop that is accessible to the authenticated user.

4. The computer-implemented method of claim 1, further comprising load balancing requests made through the authenticated session.

5. The computer-implemented method of claim 1, further comprising provisioning the virtual machine.

6. The computer-implemented method of claim 5, wherein provisioning the virtual machine comprises provisioning the virtual machine according to one or more of settings or a policy provided by the private domain.

7. The computer-implemented method of claim 5, wherein provisioning the virtual machine comprises receiving a virtual machine image from the private domain.

8. The computer-implemented method of claim 1, wherein the request received from the private domain includes one or more of:

authentication information authenticating the private domain to the public cloud environment;

a request that the virtual network be established at the public cloud environment;

or

a request that the virtual machine be provisioned at the public cloud environment.

9. The computer-implemented method of claim 8, wherein establishing the authenticated session between the public virtual network and the private domain comprises establishing the authenticated session using the authentication information.

10. The computer-implemented method of claim 1, further comprising receiving from the private domain a request to perform one or more management actions, including at least one of creating a new virtual machine, deleting an existing virtual machine, moving an existing virtual machine to another computer system or private network, or updating software at an existing virtual machine.

11. The computer-implemented method of claim 1, further comprising one of receiving the application from the private domain, or obtaining the application from the public cloud environment.

12. The computer-implemented method of claim 1, wherein providing the authenticated user access to the application running at the virtual machine comprises providing the authenticated user access through a session separate from the authenticated session.

13. A computer system, comprising:

one or more processors; and

one or more computer-readable hardware storage media having stored thereon computer-executable instructions that, when executed by the one or more processors, cause the computer system to perform at least the following;

based on receiving a request that originated from within a private domain that is not publicly accessible, establish a virtual network at a public cloud environment;

host a virtual machine within the virtual network, wherein the virtual machine;

is configured to be accessible to a user authenticated to the virtual machine; and

is configured to run an application using data received from the private domain;

establish an authenticated session between the virtual network and the private domain;

receive private data from the private domain over the authenticated session; and

provide the authenticated user access to the application running at the virtual machine, including providing the authenticated user access to the private data.

14. The computer system of claim 13, wherein the virtual machine is configured to run a virtual desktop that is accessible to the authenticated user.

15. The computer system of claim 13, wherein the computer-executable instructions, when executed by the one or more processors, also cause the computer system to provision the virtual machine according to one or more of settings or a policy provided by the private domain.

16. The computer system of claim 13, wherein the computer-executable instructions, when executed by the one or more processors, also cause the computer system to provision the virtual machine based on a virtual machine image received from the private domain.

17. The computer system of claim 13, wherein the computer-executable instructions, when executed by the one or more processors, also cause the computer system to receive from the private domain a request to perform one or more management actions, including at least one of creating a new virtual machine, deleting an existing virtual machine, moving an existing virtual machine to another computer system or private network, or updating software at an existing virtual machine.

18. The computer system of claim 13, wherein the application is received from the private domain.

19. The computer system of claim 13, wherein the application exists at the public cloud environment.

20. A computer program product, comprising one or more computer-readable hardware storage devices having stored thereon computer-executable instructions that, when executed by one or more processors, cause a computer system to perform at least the following:

based on receiving a request that originated from within a private domain that is not publicly accessible, establish a virtual network at a public cloud environment;

establish an authenticated session between the virtual network and the private domain;

host a virtual machine within the virtual network, wherein the virtual machine;

is configured to be accessible to a user authenticated to the virtual machine; and

is configured to run an application using data received from the private domain;

receive private data from the private domain over the authenticated session; and

provide the authenticated user access to the application running at the virtual machine, including providing the authenticated user access to the private data.