APPLICATION DELIVERY AGENTS ON VIRTUAL DESKTOP INSTANCES

• US 20160132214A1
• Filed: 11/11/2014
• Published: 05/12/2016
• Est. Priority Date: 11/11/2014
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: KUMAR, ROHIT KRISHNA, KARAPETYAN, GEVORG, KOUSHIK, SHESHADRI SUPREETH, LIN, YANG
• Granted Patent: US 10,152,211 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/452 Remote windowing, e.g. X-Window System, desktop virtualisation protocols for virtual reality H04L67/131
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display

Abstract

A service provider system may include an application fulfillment platform that delivers desktop applications to end users (e.g., to physical computing devices or virtual desktop instances). An application delivery agent installed on an end user'"'"'s device may send requests to access platform control plane services on behalf of the agent or the end user (along with security credentials) and may retrieve messages directed to the device from a queue on the platform. Messages may be placed in the queue by control plane services in response to agent requests. Messages may include instructions for the agent to perform installing, uninstalling, updating, or reinstalling a virtualized desktop application package on the device. The agent may request and retrieve (from the queue) information about the intended (or assumed) installation state of applications on the device, compare it to locally stored information about the actual state, and initiate corrective action, if needed.

Claims

1. A system, comprising:

a plurality of computing nodes that collectively provide virtual computing services to one or more clients of a service provider, each of the computing nodes comprising at least one processor and a memory; and

a virtualized computing resource instance executing on one of the computing nodes;

wherein the virtualized computing resource instance implements a virtual desktop instance on behalf of a given end user that receives services from the service provider, and wherein an application delivery agent is installed on the virtual desktop instance;

wherein one or more of the plurality of computing nodes implement an application fulfillment platform, wherein the application fulfillment platform implements a plurality of control plane services, and wherein the application fulfillment platform comprises an outbound queue from which the application delivery agent can retrieve messages;

wherein the application delivery agent is configured to;

send, to the application fulfillment platform, a request to access a control plane service implemented on the application fulfillment, wherein the request includes a security token, and wherein the security token included in the request is dependent on the type of the service to which access is requested or the entity on whose behalf the request was submitted by the application delivery agent; and

retrieve, from the outbound queue of the application fulfillment platform, a message directed to the virtual desktop instance, wherein the message includes a response to the request that was placed in the outbound queue by the control plane service.

2. The system of claim 1,

wherein the application delivery agent is further configured to:

send, to the application fulfillment platform, a request to register the virtual desktop instance with the application fulfillment platform as a device, wherein the request includes a device identity ticket; and

receive the security token for the device from the application fulfillment platform;

wherein the request to access a control plane service was submitted by the application delivery agent on behalf of the application delivery agent; and

wherein the request for service comprises an identifier of the device and the security token for the device.

3. The system of claim 1,

wherein the application delivery agent is further configured to:

send, to the application fulfillment platform, a request to register the given end user with the application fulfillment platform, wherein the request includes a user identity ticket received from an active directory service; and

receive the security token for the given end user from the application fulfillment platform;

wherein the request was submitted by the application delivery agent on behalf of the given end user; and

wherein the request to access a control plane service comprises an identifier of the given end user and the security token for the given end user.

4. The system of claim 1,

wherein the response comprises instructions for performing, by the application delivery agent, one or more of:

installing a virtualized application package for a desktop application on the virtual desktop instance that was not previously installed on the virtual desktop instance;

uninstalling a virtualized application package for a desktop application from the virtual desktop instance;

updating a virtualized application package for a desktop application that was previously installed on the virtual desktop instance;

or

reinstalling a virtualized application package for a desktop application on the virtual desktop instance that was previously uninstalled from the virtual desktop instance.

5. A method, comprising:

performing, by an application delivery agent installed on a computing resource instance;

accessing a queue on an application fulfillment platform, wherein the application fulfillment platform is implemented on resources of a service provider, wherein the queue stores messages directed to the computing resource instance, and wherein accessing the queue comprises presenting a security credential for the computing resource instance that was previously generated by the application fulfillment platform;

retrieving a message from the queue, wherein the message comprises instructions for performing a task on the computing resource instance; and

performing the task on the computing resource instance.

6. The method of claim 5,

wherein the method further comprises:

sending, by the application delivery agent to the application fulfillment platform prior to said accessing, a request to access a control plane service implemented on the application fulfillment platform; and

wherein the message was placed in the queue by the control plane service in response to the request to access the control plane service.

7. The method of claim 5,

wherein the security credential comprises one or more of:

a unique identifier of the computing resource instance;

a security token for the computing resource instance;

a unique identifier of an end user of a service provider customer on whose behalf the computing resource was provisioned;

or

a security token for the end user of a service provider customer on whose behalf the computing resource was provisioned; and

wherein the method further comprises;

storing, on the computing resource instance by the application delivery agent prior to said accessing, the security credential, wherein said storing comprises encrypting the security credential prior to storage.

8. The method of claim 5, wherein the computing resource instance is a virtual desktop instance that is provisioned on behalf of an end user of a service provider customer.

9. The method of claim 8, wherein the message comprises instructions for performing a task to configure a recently provisioned virtual desktop instance or a recently rebuilt virtual desktop instance.

10. The method of claim 5,

wherein the message comprises instructions for performing, by the application delivery agent, one or more of:

installing a desktop application on the computing resource instance that was not previously installed on the computing resource instance;

uninstalling a desktop application from the computing resource instance;

updating a desktop application that was previously installed on the computing resource instance;

or

reinstalling a desktop application on the computing resource instance that was previously uninstalled from the computing resource instance.

11. The method of claim 5,

wherein the message comprises instructions for performing, by the application delivery agent, delivering a desktop application to the computing resource instance, wherein said delivering the desktop application to the computing resource instance comprises:

retrieving a virtualized application package for the desktop application, wherein the virtualized application package comprises a plurality of pages of virtualized program instructions that represent the desktop application; and

virtualizing the virtualized program instructions for subsequent execution on the computing resource instance.

12. The method of claim 5, wherein said accessing and said retrieving are performed by a dedicated thread of the application delivery agent that is configured to poll the queue periodically to determine whether it contains any messages that are directed to the computing resource instance.

13. The method of claim 5, further comprising:

sending, by the application delivery agent to the application fulfillment platform, a request for information about an intended installation state for applications on the computing resource instance or an assumed current installation state for applications on the computing resource instance; and

accessing the queue to retrieve a message comprising the requested information.

14. The method of claim 13, further comprising:

storing, on the computing resource instance by the application delivery agent, information reflecting an actual installation state for applications on the computing resource instance;

comparing the stored information reflecting an actual installation state for applications on the computing resource instance with the requested information;

determining one or more differences between the stored information and the requested information; and

initiating a workflow to reconcile the actual installation state for applications on the computing resource instance with the requested information.

15. The method of claim 14,

wherein said storing, said comparing, and said determining are performing by a dedicated thread of the application delivery agent that is configured to perform said storing, said comparing, and said determining periodically.

16. The method of claim 5, further comprising:

sending, by the application delivery agent to the application fulfillment platform on a pre-determined schedule, a plurality of messages specified by a heartbeat protocol.

17. The method of claim 5, further comprising:

determining, by the application delivery agent, that the computing resource instance has been or is soon will be dissociated from an end user of a service provider customer on whose behalf it was provisioned; and

in response to said determining, deleting a security credential that is associated with the end user from the computing resource instance.

18. The method of claim 5, further comprising:

determining, by the application delivery agent, that the computing resource instance is to terminated; and

in response to said determining, notifying the application fulfillment platform that the computing resources is to be terminated.

19. A non-transitory computer-readable storage medium storing program instructions that when executed on one or more computers cause the one or more computers to implement a virtual desktop instance and an application delivery agent that is installed on the virtual desktop instance;

wherein in response to initiation of the execution of the application delivery agent, the application delivery agent is configured to perform;

accessing a queue on an application fulfillment platform, wherein the queue is configured to store messages that are directed to the virtual desktop instance;

retrieving one or more messages from the queue, each message comprising instructions for performing a pending configuration task on the virtual desktop instance;

performing at least one of the pending configuration tasks included in the one or more messages, wherein the at least one pending configuration task comprises delivering a desktop application to the virtual desktop instance.

20. The non-transitory computer-readable storage medium of claim 19,

wherein delivering the desktop application to the virtualized desktop instance comprises:

retrieving a virtualized application package for the desktop application, wherein the virtualized application package comprises a plurality of pages of virtualized program instructions that represent the desktop application; and

virtualizing the virtualized program instructions for subsequent execution on the virtual desktop instance.