Cached credentials for offline domain join and login without local access to the domain controller

• US 10,419,426 B2
• Filed: 07/06/2018
• Issued: 09/17/2019
• Est. Priority Date: 11/22/2016
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: Bakshan, Igal, Yogev, Yair, Halperin, Nohar
• Primary Examiner(s): Abrishamkar, Kaveh
• Application Number:
  US16/029,318
• Publication Number:
  US 20180332025A1
• Time in Patent Office: 438 Days
• Field of Search: None
• CPC Class Codes: G06F 16/128 Details of file system snapshots on the file-level, e.g. snapshot creation, administration, deletion use of snapshots for error detection or correction G06F11/14, G06F11/16
• CPC Class Codes: G06F 2009/45562 Creating, deleting, cloning virtual machine instances
• CPC Class Codes: G06F 9/4405 Initialisation of multiprocessor systems
• CPC Class Codes: G06F 9/442 Shutdown
• CPC Class Codes: G06F 9/452 Remote windowing, e.g. X-Window System, desktop virtualisation protocols for virtual reality H04L67/131
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 61/3015 Name registration, generation or assignment
• CPC Class Codes: H04L 61/457 containing identifiers of data entities on a computer, e.g. file names
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 67/131 Protocols for games, networked simulations or virtual reality

Abstract

Techniques are described for performing an offline domain join and login on behalf of a computing device in order to enable the device to access corporate resources without local access to the domain controller. A slave service is described that can start a virtual machine on a local network of the enterprise, perform an offline domain join of the virtual machine, perform a first login to the virtual machine using credentials of a remote user and then capture the changes made on the virtual machine and deliver those changes to the remote user'"'"'s device. These changes can then be applied on the user'"'"'s device to add the credentials and configuration changes necessary for the user to access the private enterprise resources remotely.

Claims

1. A method for performing an offline domain join of a virtual machine, the method comprising:

in response to a request for a virtual machine received from a client computing device,

performing a domain join of the virtual machine with an active directory service on a local network;

capturing a post-domain-join snapshot of the virtual machine and producing a delta that contains one or more changes to the virtual machine that were made during the domain join; and

transmitting the delta to the client computing device to be applied to a copy of the virtual machine executed on the client computing device.

2. The method of claim 1, further comprising:

receiving a user name and password from the client computing device;

performing a first login to the virtual machine with a domain controller of the local network using the received user name and password, wherein performing the first login to the virtual machine causes a set of encrypted credentials to be stored on the virtual machine.

3. The method of claim 1, wherein performing the domain join of the virtual machine with the active directory service produces a binary blob that is supplied to the virtual machine.

4. The method of claim 1, further comprising:

in response to the request for the virtual machine, starting a slave service that acts as a user of the virtual machine on the local network, the slave service configured to;

power on the virtual machine with a local user account;

execute a domain join process of an operating system of the virtual machine and receive a blob file from the active directory service;

apply the blob file on the virtual machine and restart the virtual machine;

perform a login to the virtual machine as a domain user using a username and password received from the client computing device; and

power off the virtual machine.

5. The method of claim 1, further comprising:

receiving the delta on the client computing device;

applying the delta to the copy of the virtual machine executed on the client computing device, wherein the copy of the virtual machine is based on a virtual disk downloaded by the client computing device;

wherein applying the delta to the copy of the virtual machine enables the virtual machine to access one or more private resources residing on the local network located behind a secure firewall.

6. The method of claim 1, further comprising:

capturing a pre-domain-join snapshot of the virtual machine prior to the domain join;

capturing the post-domain-join snapshot of the virtual machine after the domain join; and

producing the delta based on the pre-domain-join snapshot and the post-domain-join snapshot.

7. The method of claim 1, wherein performing the domain join of the virtual machine is performed during a download of a virtual disk by the client computing device.

8. A computing device, comprising:

one or more processors; and

memory storing instructions that when executed by the one or more processors, cause the computing device to;

in response to a request for a virtual machine received from a client computing device,

perform a domain join of the virtual machine with an active directory service on a local network;

capture a post-domain-join snapshot of the virtual machine and produce a delta that contains one or more changes to the virtual machine that were made during the domain join; and

transmit the delta to the client computing device to be applied to a copy of the virtual machine executed on the client computing device.

9. The computing device of claim 8, the memory further comprising instructions that when executed by the one or more processors, cause the computing device to:

receive a user name and password from the client computing device; and

perform a first login to the virtual machine with a domain controller of the local network using the received user name and password, wherein performing the first login to the virtual machine causes a set of encrypted credentials to be stored on the virtual machine.

10. The computing device of claim 8, wherein performing the domain join of the virtual machine with the active directory service produces a binary blob that is supplied to the virtual machine.

11. The computing device of claim 8, the memory further comprising instructions that when executed by the one or more processors, cause the computing device to:

in response to the request for the virtual machine, start a slave service that acts as a user of the virtual machine on the local network, the slave service configured to;

power on the virtual machine with a local user account;

execute a domain join process of an operating system of the virtual machine and receive a blob file from the active directory service;

apply the blob file on the virtual machine and restart the virtual machine;

perform a login to the virtual machine as a domain user using a username and password received from the client computing device; and

power off the virtual machine.

12. The computing device of claim 8, the memory further comprising instructions that when executed by the one or more processors, cause the computing device to:

capture a pre-domain-join snapshot of the virtual machine prior to the domain join;

capture the post-domain-join snapshot of the virtual machine after the domain join; and

produce the delta based on the pre-domain-join snapshot and the post-domain-join snapshot.

13. The computing device of claim 8, wherein performing the domain join of the virtual machine is performed during a download of a virtual disk by the client computing device.

14. The computing device of claim 8, wherein performing the domain join of the virtual machine further comprises:

applying one or more security policies of the local network to the virtual machine.

15. A non-transitory computer readable storage medium comprising one or more sequences of instructions, the instructions when executed by one or more processors causing the one or more processors to execute the operations of:

in response to a request for a virtual machine received from a client computing device,

performing a domain join of the virtual machine with an active directory service on a local network;

capturing a post-domain-join snapshot of the virtual machine and producing a delta that contains one or more changes to the virtual machine that were made during the domain join; and

transmitting the delta to the client computing device to be applied to a copy of the virtual machine executed on the client computing device.

16. The non-transitory computer readable storage medium of claim 15, further comprising instructions executed by one or more processors causing the one or more processors to execute the operations of:

receiving a user name and password from the client computing device;

performing a first login to the virtual machine with a domain controller of the local network using the received user name and password, wherein performing the first login to the virtual machine causes a set of encrypted credentials to be stored on the virtual machine.

17. The non-transitory computer readable storage medium of claim 15, wherein performing the domain join of the virtual machine with the active directory service produces a binary blob that is supplied to the virtual machine.

18. The non-transitory computer readable storage medium of claim 15, further comprising instructions executed by one or more processors causing the one or more processors to execute the operations of:

in response to the request for the virtual machine, starting a slave service that acts as a user of the virtual machine on the local network, the slave service configured to;

power on the virtual machine with a local user account;

execute a domain join process of an operating system of the virtual machine and receive a blob file from the active directory service;

apply the blob file on the virtual machine and restart the virtual machine;

perform a login to the virtual machine as a domain user using a username and password received from the client computing device; and

power off the virtual machine.

19. The non-transitory computer readable storage medium of claim 15, further comprising instructions executed by one or more processors causing the one or more processors to execute the operations of:

receiving the delta on the client computing device;

applying the delta to the copy of the virtual machine executed on the client computing device, wherein the copy of the virtual machine is based on a virtual disk downloaded by the client computing device;

wherein applying the delta to the copy of the virtual machine enables the virtual machine to access one or more private resources residing on the local network located behind a secure firewall.

20. The non-transitory computer readable storage medium of claim 15, further comprising instructions executed by one or more processors causing the one or more processors to execute the operations of:

capturing a pre-domain-join snapshot of the virtual machine prior to the domain join;

capturing the post-domain-join snapshot of the virtual machine after the domain join; and

producing the delta based on the pre-domain-join snapshot and the post-domain-join snapshot.