VIRTUAL DESKTOPACCESS CONTROL

• US 20160373459A1
• Filed: 03/04/2015
• Published: 12/22/2016
• Est. Priority Date: 03/04/2014
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hangzhou H3C Technologies Co Ltd (Tsinghua Holdings Co., Ltd.)
• Inventors: ZHENG, Xiongkai
• Granted Patent: US 10,270,782 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

A virtual desktop access control is disclosed. A gateway apparatus receives a virtual desktop access request from a client, obtains a virtual desktop access policy according to a source address of the virtual desktop access request, and determines a virtual switch according to a destination address of the virtual desktop access request, wherein the destination address is an address of a virtual desktop that is connected to the virtual switch. The gateway apparatus sends the virtual desktop access policy to the virtual switch, such that the virtual switch is allowed to control a level of access which the virtual desktop has to access network resources. The gateway apparatus forwards the virtual desktop access request to the virtual desktop, receives a response to the virtual desktop access request from the virtual desktop, and forwards the response to the client.

Claims

1. A virtual desktop access method, applied in a gateway apparatus, comprising:

receiving a virtual desktop access request from a client, obtaining a virtual desktop access policy according to a source address of the virtual desktop access request, and determining a virtual switch according to a destination address of the virtual desktop access request, wherein the destination address is an address of a virtual desktop that is connected to the virtual switch;

sending the virtual desktop access policy to the virtual switch, such that the virtual switch is allowed to control a level of access which the virtual desktop has to access network resources; and

forwarding the virtual desktop access request to the virtual desktop, receiving a first response to the virtual desktop access request from the virtual desktop, and forwarding the first response to the client.

2. A method according to claim 1, wherein the virtual desktop access request is forwarded to the virtual desktop after receiving a confirmation that the virtual switch has received the virtual desktop access policy.

3. A method according to claim 1, further comprising:

receiving a virtual desktop disconnection request from the client;

sending a virtual desktop default access policy of the virtual desktop to the virtual switch; and

forwarding the virtual desktop disconnection request to the virtual desktop, receiving a second response to the virtual desktop disconnection request from the virtual desktop, and forwarding the second response to the client.

4. A method according to claim 3, wherein the virtual desktop access request comprises:

a RDP connection request or a SPICE connection request; and

the virtual desktop disconnection request comprises;

a RDP disconnection request or a SPICE disconnection request.

5. A method according to claim 1, wherein the source address of the virtual desktop access request comprises:

a source IP address and/or a source MAC address.

6. A method according to claim 1, wherein the virtual switch is included in a server where the virtual desktop is located.

7. A method according to claim 1, wherein the source address of the virtual desktop access request is an IP address, and IP addresses in the same network segment correspond to the same virtual desktop access policy.

8. A computer readable storage medium on which is stored machine readable instructions that when executed by a processor cause the processor to:

receive a virtual desktop access request from a client, obtain a virtual desktop access policy according to a source address of the virtual desktop access request, and determine a virtual switch according to a destination address of the virtual desktop access request, wherein the destination address is an address of a virtual desktop that is connected to the virtual switch;

send the virtual desktop access policy to the virtual switch, such that the virtual switch is allowed to control a level of access which the virtual desktop has to access network resources; and

forward, the virtual desktop access request to the virtual desktop, receive a first response to the virtual desktop access request from the virtual desktop, and forward the first response to the client.

9. The computer readable storage medium according to claim 8, wherein the machine readable instructions are further to cause the processor to:

forward the virtual desktop access request to the virtual desktop after receiving a confirmation that the virtual switch has received the virtual desktop access policy.

10. The computer readable storage medium according to claim 8, wherein the machine readable instructions are further to cause the processor to:

receive a virtual desktop disconnection request from the client;

send a virtual desktop default access policy of the virtual desktop to the virtual switch; and

forward the virtual desktop disconnection request to the virtual desktop, receive a second response to the virtual desktop disconnection request from the virtual desktop, and forward the second response to the client.

11. The computer readable storage medium according to claim 10, wherein the virtual desktop access request comprises:

a RDP connection request or a SPICE connection request; and

the virtual desktop disconnection request comprises;

a RDP disconnection request or a SPICE disconnection request.

12. The computer readable storage medium according to claim 8, wherein the source address of the virtual desktop access request comprises:

a source IP address and/or a source MAC address.

13. The computer readable storage medium according to claim 8, wherein the virtual switch is included in a server where the virtual desktop is located.

14. The computer readable storage medium according to claim 8, wherein the source address of the virtual desktop access request is an IP address, and the IP addresses in the same network segment correspond to the same virtual desktop access policy.