Independent Access to Virtual Machine Desktop Content

• US 20110184993A1
• Filed: 01/27/2010
• Published: 07/28/2011
• Est. Priority Date: 01/27/2010
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: CHAMCHAM, Jad, CHAWLA, Puneet
• Granted Patent: US 9,274,821 B2
• Time in Patent Office: Days
• US Class Current: 707/802
• CPC Class Codes: G06F 16/182 Distributed file systems
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

Methods, systems, and techniques for facilitating access to content stored remotely, for example, as part of a virtual machine infrastructure or elsewhere in a networked environment, using a uniform mechanism are provided. Example embodiments provide an Enhanced Virtual Desktop Management Server/System with a Content Abstraction Layer which enables users to access their data stored as part of a virtual machine environment, or replicated otherwise on a network, using a generic API. The API can be incorporated into a web browser or other third party interface to provide access to the users'"'"' data without needing to remote a bitmap representation of a virtual desktop display. Accordingly, users can access their data, applications, and settings regardless of the type of access device and regardless of whether the corresponding virtual desktop is running in the data center, provisioned in the datacenter but running on a client device, or not running at all.

Claims

1. A virtual desktop management server computing system comprising:

a memory;

a computer processor;

an API handler stored in the memory and configured, when executed on the computer processor, to receive and respond to a client application request from a client device for user data that has been stored as on a virtual disk as part of a virtual machine associated with an identified user, the virtual disk stored remote from the client device in a centralized datastore communicatively coupled to the server computing system; and

a content abstraction layer component comprising logic instructions stored in the memory that are configured, when executed in response to a request from the API handler, to cause a connection to a control virtual machine that has access to the virtual disk associated with the requested user data and to cause the control virtual machine to mount the virtual disk when the virtual disk is not already accessible to the identified user through a running virtual desktop, thereby enabling the content abstraction layer to obtain the requested data from the virtual disk storage and return the requested data to the API handler to respond to the client application request.

2. The server computing system of claim 1 wherein the centralized datastore is a part of an enterprise virtualization infrastructure.

3. The server computing system of claim 1 wherein the centralized datastore is a shared network repository.

4. The server computing system of claim 1 wherein the user data is a data file, an application, or settings associated with the identified user.

5. The server computing system of claim 1, further comprising:

an identity management component comprising logic instructions stored in the memory that are configured, when executed, to assess whether the identified user has authority to access the requested user data; and

wherein the content abstraction layer component further comprises logic instructions that are configured, when executed, to invoke the identity management component to verify that the identified user as authority to access the requested user data before invoking the control virtual machine to access the user data.

6. The server computing system of claim 1, further comprising:

a policy database configured to store rules defining which users have access to which data; and

wherein the content abstraction layer component further comprises logic instructions that are configured, when executed, to use the policy database to determine whether the identified user has legitimate access to the requested user data before causing the control virtual machine to access the user data.

7. The server computing system of claim 1, further comprising:

an audit database configured to track accesses to user data; and

wherein the API handler further comprises logic instructions that are configured, when executed, to cause the audit database to track the request for the requested user data before invoking the control virtual machine to access the user data.

8. A virtual desktop management server comprising:

a memory;

a computer processor;

an API handler stored in the memory and configured, when executed on the computer processor, to receive and respond to a client application request from a client device for user data that is stored in a remote location from the client device; and

a content abstraction layer component comprising logic instructions stored in the memory that are configured, when executed in response to a request from the API handler, to;

determine the remote location of the stored user data being requested;

when the remote location of the requested user data is a user profile on a network share, communicate using a mechanism associated with the network share to obtain the user profile and return the obtained user profile in response to the request from the API handler;

when the remote location of the requested user data is data on a virtual disk that is part of a running virtual desktop, send a message to the virtual machine associated with the running virtual desktop to obtain and return the requested user data from the virtual disk associated with the running virtual desktop in response to the request from the API handler; and

when the remote location of the requested user data is a data on a target virtual disk that is associated with a virtual desktop of a virtual machine that is not running and/or not associated with a user, invoke a control virtual machine that has access to the target virtual disk, and cause the control virtual machine to mount the target virtual disk, thereby enabling the content abstraction layer to obtain and return the requested data from the mounted virtual disk to the API handler for response to the client application request.

9. The virtual desktop management server of claim 8 wherein the control virtual machine is a virtual machine running on a hypervisor having access to a datastore that provides storage for data of the target virtual disk.

10. The virtual desktop management server of claim 8 wherein the user data of the target virtual disk is stored on external network storage and the control virtual machine is configured to retrieve the requested user data from the external network storage.

11. The virtual desktop management server of claim 8 wherein the user data that is the user profile on the network share, the data on the virtual disk that is part of the running virtual desktop, or the data on the target virtual disk can be physically stored on different types of backend storage repositories including NFS, SAN, VNFS, or cloud storage.

12. The virtual desktop management server of claim 8 wherein the user data is a file that contains an application.

13. The virtual desktop management server of claim 8 wherein the API handler is further configured to generate a view of the obtained user data that is presentable in a web browser.

14. The virtual desktop management server of claim 8 wherein the API handler is further configured to pass the obtained user data without any presentation mark up to the requesting client application.

15. The virtual desktop management server of claim 8, further comprising:

an identity management component comprising logic instructions stored in the memory that are configured, when executed, to assess whether an identified user associated with the requested user data has authority to access the requested user data; and

wherein the content abstraction layer component further comprises logic instructions that are configured, when executed, to invoke the identity management component to verify that the identified user as authority to access the requested user data before determining the remote location of the stored user data being requested.

16. The virtual desktop management server of claim 8, further comprising:

a policy data repository configured to store rules defining which users have access to which data; and

wherein the content abstraction layer component further comprises logic instructions that are configured, when executed, to invoke the policy data repository to determine whether an identified user associated with the requested user data has legitimate access to the requested user data before determining the remote location of the stored user data being requested.

17. The virtual desktop management server of claim 8, further comprising:

an audit data repository configured to track accesses to user data; and

wherein the API handler further comprises logic instructions that are configured, when executed, to invoke the audit data repository to track the request for the requested user data before invoking the content abstraction layer to obtain the requested user data.

18. The virtual desktop management server of claim 8 wherein the network share is one of cloud storage, an external network share, or a shared network share in an enterprise repository.

19. The virtual desktop management server of claim 8 wherein the API handler is a REST interface based web server.

20. A computer-readable storage medium containing instructions configured to control a computer processor in a computing system to perform a method comprising:

receiving an indication of a request from client device of an identified user for user data that is stored remotely from the client device;

determining whether the identified user has authorization to make the request;

forwarding the request to a content abstraction layer logic to cause the content abstraction layer to obtain the user data in a manner transparent to the requesting client device by determining whether the requested data is in an application repository, on network storage, in a virtual desktop associated with a running virtual machine, or on a virtual disk associated with a non-running machine, and using a corresponding mechanism to retrieve the requested data; and

returning the requested user data to the client device in response to the request.

21. The computer-readable storage medium of claim 20 wherein the method further comprises:

recording the request for user data in an audit data repository.

22. The computer-readable storage medium of claim 20 wherein the method further comprises:

accessing rules from a policy datastore to determine whether the identified user is authorized to have access to the requested data.

23. The computer-readable storage medium of claim 20, wherein the forwarding the request to a content abstraction layer logic to cause the content abstraction layer to obtain the user data in a manner transparent to the requesting client device determines that the requested data is in a virtual desktop associated with a non-running virtual machine, and wherein the using the corresponding mechanism to retrieve the requested data causes a control virtual machine to temporarily mount the virtual disk associated with the non-running virtual machine in order to access the requested data.

24. The computer-readable storage medium of claim 20, the requested user data being an application.

25. The computer-readable storage medium of claim 20 wherein the request is at least one to list a file in a folder, get file metadata, download a file, or upload a file.

26. The computer-readable storage medium of claim 20 wherein the storage medium is computer memory in a computer system.