POLICY-BASED ACCESS TO VIRTUALIZED APPLICATIONS

• US 20120167159A1
• Filed: 12/27/2010
• Published: 06/28/2012
• Est. Priority Date: 12/27/2010
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Mefford, Cread Wellington Jr., Babey, Matthew Christopher, Stearns, Scott Elliot, Anderson, Angela Mele, Chardon, Alvin, Anderson, Adam Brady, de Souza, Lidiane Pereira
• Granted Patent: US 8,931,037 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

When a request is received to execute a virtualized application, an application virtualization client component evaluates an execution policy to determine if the application may be executed. If the application virtualization client component determines based on the execution policy that the virtualized application may be executed, the application virtualization client component publishes the virtualized application. The application virtualization client component publishes the application by making the virtualized application available for execution if the application is installed, and installing the virtualized application if it is not installed. The application virtualization client component also evaluates the execution policy during execution of the virtualized application. If the application virtualization client component determines that the execution policy is no longer satisfied, the application virtualization client component unpublishes the virtualized application, thereby preventing execution of the virtualized application.

Claims

1. A computer-implemented method comprising performing computer-implemented operations for:

receiving a request to execute a virtualized application;

in response to receiving the request, evaluating an execution policy for the virtualized application to determine if the virtualized application may be executed; and

publishing the virtualized application in response to determining that the virtualized application may be executed.

2. The computer-implemented method of claim 1, wherein the execution policy specifies that the virtualized application may only be executed when a device executing the virtualized application is located in a specified geographical location.

4. The computer-implemented method of claim 1, wherein the execution policy specifies that the virtualized application may only be executed for a specified duration.

5. The computer-implemented method of claim 1, wherein the execution policy specifies that the virtualized application may only be executed when computing resources utilized by a device executing the virtualized application are not limited.

6. The computer-implemented method of claim 1, further comprising:

determining whether the execution policy can be evaluated; and

unpublishing the virtualized application in response to determining that the execution policy cannot be evaluated.

7. The computer-implemented method of claim 6, wherein publishing the virtualized application comprises:

determining whether the virtualized application is installed at a device;

making the virtualized application available for execution if the virtualized application is installed at the device; and

streaming the virtualized application to the device if the virtualized application is not installed at the device.

8. The computer-implemented method of claim 7, wherein unpublishing the virtualized application comprises making the virtualized application unavailable for execution.

9. The computer-implemented method of claim 7, wherein unpublishing the virtualized application comprises removing the virtualized application from the client device.

10. The computer-implemented method of claim 7, further comprising:

evaluating the execution policy during execution of the virtualized application to determine if the virtualized application may continue to be executed; and

unpublishing the virtualized application in response to determining that the virtualized application may not continue to be executed.

3. The computer-implemented method of claim wherein the execution policy specifies that the virtualized application may only be executed during a specified period of time.

11. A computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by a computer, cause the computer to:

receive a request to execute a virtualized application;

evaluate an execution policy for the virtualized application to determine if the virtualized application may be executed in response to receiving the request; and

publish the virtualized application in response to determining that the virtualized application may be executed.

12. The computer-readable storage medium of claim 11, having further computer-executable instructions stored thereon which, when executed by the computer, cause the computer to:

evaluate the execution policy during execution of the virtualized application to determine if the virtualized application may continue to be executed; and

to

unpublish the virtualized application in response to determining that the virtualized application may not continue to be executed.

13. The computer-readable storage medium of claim 12, having further computer-executable instructions stored thereon which, when executed by the computer, cause the computer to:

determine whether the execution policy can be evaluated; and

unpublish the virtualized application in response to determining that the execution policy cannot be evaluated.

14. The computer-readable storage medium of claim 13, wherein publishing the virtualized application comprises:

determining whether the virtualized application is installed at a device;

making the virtualized application available for execution if the virtualized application is installed at the device; and

streaming the virtualized application to the device if the virtualized application is not installed at the device.

15. The computer-readable storage medium of claim 14, wherein unpublishing the virtualized application comprises making the virtualized application unavailable for execution.

16. The computer-readable storage medium of claim 14, wherein unpublishing the virtualized application comprises removing the virtualized application from the client device.

17. The computer-readable storage medium of claim 16, wherein the execution policy specifies that the virtualized application may only be executed when a device executing the virtualized application is located in a specified geographical location.

18. The computer-readable storage medium of claim 16, wherein the execution policy specifies that the virtualized application may only be executed during a specified period of time or that the virtualized application may only be executed for a specified duration.

19. The computer-readable storage medium of claim 16, wherein the execution policy specifies that the virtualized application may only be executed when computing resources utilized by a device executing the virtualized application are not limited.

20. A computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by a computer, cause the computer to:

receive a request to execute a virtualized application on a device;

in response to receiving the request, attempting to evaluate an execution policy for the virtualized application to determine if the virtualized application may be executed on the device;

determine whether the execution policy can be evaluated;

unpublish the virtualized application from the device by removing the virtualized application from the device in response to determining that the execution policy cannot be evaluated; and

to

publish the virtualized application by streaming the virtualized application to the device in response to determining that the execution policy can be evaluated and that the virtualized application may be executed, and wherein the execution policy specifies that the virtualized application may only be executed when the device is located in a specified geographical location.