Virtual desktopaccess control

• US 10,270,782 B2
• Filed: 03/04/2015
• Issued: 04/23/2019
• Est. Priority Date: 03/04/2014
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Zheng, Xiongkai
• Primary Examiner(s): Homayounmehr, Farid
• Assistant Examiner(s): Bucknor, Olanrewaju J.
• Application Number:
  US15/122,301
• Publication Number:
  US 20160373459A1
• Time in Patent Office: 1,511 Days
• Field of Search: None
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

A virtual desktop access control is disclosed. A gateway apparatus receives a virtual desktop access request from a client, obtains a virtual desktop access policy according to a source address of the virtual desktop access request, and determines a virtual switch according to a destination address of the virtual desktop access request, wherein the destination address is an address of a virtual desktop that is connected to the virtual switch. The gateway apparatus sends the virtual desktop access policy to the virtual switch, such that the virtual switch is allowed to control a level of access which the virtual desktop has to access network resources. The gateway apparatus forwards the virtual desktop access request to the virtual desktop, receives a response to the virtual desktop access request from the virtual desktop, and forwards the response to the client.

Claims

1. A virtual desktop access method, applied in a gateway apparatus including a hardware processor, comprising:

receiving, by the gateway apparatus, a virtual desktop access request from a client;

determining, by the gateway apparatus, a location of a source address of the virtual desktop access request;

obtaining, by the gateway apparatus, a virtual desktop access policy according to the source address of the virtual desktop access request;

determining, by the gateway apparatus, a virtual switch according to a destination address of the virtual desktop access request, wherein the destination address is an address of a virtual desktop that is connected to the virtual switch;

sending, by the gateway apparatus, the virtual desktop access policy to the virtual switch, such that the virtual switch is allowed to control a level of access which the virtual desktop has to access network resources, wherein the level of access to the network resource is based on the location of the source address;

receiving, by the gateway apparatus, the level of access of the virtual desktop determined by the virtual switch;

forwarding, by the gateway apparatus, the virtual desktop access request to the virtual desktop;

receiving, by the gateway apparatus, a first response to the virtual desktop access request from the virtual desktop; and

forwarding, by the gateway apparatus, the first response to the client.

2. The method according to claim 1, wherein the virtual desktop access request is forwarded to the virtual desktop after receiving a confirmation that the virtual switch has received the virtual desktop access policy.

3. The method according to claim 1, further comprising:

receiving, by the gateway apparatus, a virtual desktop disconnection request from the client;

sending, by the gateway apparatus, a virtual desktop default access policy of the virtual desktop to the virtual switch; and

forwarding, by the gateway apparatus, the virtual desktop disconnection request to the virtual desktop, receiving a second response to the virtual desktop disconnection request from the virtual desktop, and forwarding the second response to the client.

4. The method according to claim 3, wherein the virtual desktop access request comprises:

a Remote Desktop Protocol (RDP) connection request or a Simple Protocol for Independent Computing Environment (SPICE) connection request; and

the virtual desktop disconnection request comprises;

a RDP disconnection request or a SPICE disconnection request.

5. The method according to claim 1, wherein the source address of the virtual desktop access request comprises at least one of:

a source Internet Protocol (IP) address and a source Media Access Control (MAC) address.

6. The method according to claim 1, wherein the virtual switch is included in a server where the virtual desktop is located.

7. The method according to claim 1, wherein the source address of the virtual desktop access request is an Internet Protocol (IP) address, and IP addresses in the same network segment correspond to the same virtual desktop access policy.

8. A non-transitory computer readable storage medium on which is stored machine readable instructions that when executed by a processor cause the processor to:

receive a virtual desktop access request from a client,

obtain a virtual desktop access policy according to a source address of the virtual desktop access request, and

determine a virtual switch according to a destination address of the virtual desktop access request, wherein the destination address is an address of a virtual desktop that is connected to the virtual switch;

send the virtual desktop access policy to the virtual switch, such that the virtual switch is allowed to control a level of access which the virtual desktop has to access network resources, wherein the level of access to the network resource is based on the location of the source address; and

determine the level of access of the virtual desktop by the virtual switch;

forward, the virtual desktop access request to the virtual desktop,

receive a first response to the virtual desktop access request from the virtual desktop, and

forward the first response to the client.

9. The non-transitory computer readable storage medium according to claim 8, wherein the machine readable instructions are further to cause the processor to:

forward the virtual desktop access request to the virtual desktop after receiving a confirmation that the virtual switch has received the virtual desktop access policy.

10. The non-transitory computer readable storage medium according to claim 8, wherein the machine readable instructions are further to cause the processor to:

receive a virtual desktop disconnection request from the client;

send a virtual desktop default access policy of the virtual desktop to the virtual switch; and

forward the virtual desktop disconnection request to the virtual desktop, receive a second response to the virtual desktop disconnection request from the virtual desktop, and forward the second response to the client.

11. The non-transitory computer readable storage medium according to claim 10, wherein the virtual desktop access request comprises:

a Remote Desktop Protocol (RDP) connection request or a Simple Protocol for Independent Computing Environment (SPICE) connection request; and

the virtual desktop disconnection request comprises;

a RDP disconnection request or a SPICE disconnection request.

12. The non-transitory computer readable storage medium according to claim 8, wherein the source address of the virtual desktop access request comprises:

at least one of a source Internet Protocol (IP) address and a source Media Access Control (MAC) address.

13. The non-transitory computer readable storage medium according to claim 8, wherein the virtual switch is included in a server where the virtual desktop is located.

14. The non-transitory computer readable storage medium according to claim 8, wherein the source address of the virtual desktop access request is an Internet Protocol (IP) address, and the IP addresses in the same network segment correspond to the same virtual desktop access policy.