METHOD AND SYSTEM FOR CONTROLLING REMOTE SESSION ON COMPUTER SYSTEMS USING A VIRTUAL CHANNEL

• US 20170201491A1
• Filed: 01/12/2016
• Published: 07/13/2017
• Est. Priority Date: 01/12/2016
• Status: Active Grant

• Current Assignee: Jens Schmidt, Jonathan Allsop, Sascha Goeckel
• Original Assignee: Jens Schmidt, Jonathan Allsop, Sascha Goeckel
• Inventors: Allsop, Jonathan, Schmidt, Jens, Goeckel, Sascha
• Granted Patent: US 10,757,079 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 67/08 specially adapted for terminal emulation, e.g. Telnet
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70

Abstract

Method and devices are provided for controlling access of a device to a remote desktop or a remote application running on a remote desktop or application server using a remoting protocol. The method includes the following steps: setting up a connection between the device and the remote desktop or application server to establish or to an existing user session, using the remoting protocol; setting up a virtual channel within the connection using the remoting protocol; monitoring the device to determine a device state; sending the device state over the virtual channel to the application server; and determining based on the received device state if an access to the remote desktop or remote application running in the user session is allowed, and blocking the access if the access is due to the received state not allowed.

Claims

1. A method for controlling the access of a device to a remote desktop or a remote application running on a remote desktop or application server using a remoting protocol, comprising the following steps:

Setting up a connection between the device and the remote desktop or application server to establish or to an existing user session, using the remoting protocol;

Setting up a virtual channel within the connection using the remoting protocol;

Monitoring the device to determine a device state;

Sending the device state over the virtual channel to the remote desktop or application server;

Determining based on the received device state if an access to the remote desktop or remote application running in the user session is allowed, and block the access if the access is due to the received state not allowed.

2. The method according to the claim 1, wherein the device state comprises one or more of the following information of the device:

network information such as IP, MAC, Gateway addresses, WiFi Access Point;

network security information such as WiFi Encryption and Authentication Protocols;

network performance information, such as Bandwidth and Latency;

metadata about the running Operating System, such as the name, version, service pack level;

installed applications;

license state of installed applications or the operating system;

running applications on the device;

geographical location or elevation;

information if the device is jailbroken or hacked in some way that compromises the security of the device;

information about operating system updates, which have been applied to the device;

is an Anti-Virus installed and up to date;

security information of the logged in user, including their privileges, security group membership, domain membership.

3. The method according to the claim 2, wherein the information of the device state can be combined by operators to represent a Composite Connected Device State, which allows a fine granular access to resources of the remote desktop or remote applications by the device.

4. The method according to claim 2, wherein the received device state or a composite connected vice state is made available to other applications, by using one or more of the following steps:

the device state is made available within the Windows Registry;

the device state is made available within Environment Variables;

the Connected Device State is made available through an Application Programming Interface (API);

the Connected Device State is made available through an Application.

5. The method according to claim 1, wherein security information or privileges are added or removed from an access token assigned to the user logged into the remote session based on the received device state or composite connected device state.

6. The method according to claim 1, comprising a virtual channel plugin running on the device which is automatically activated when setting up a session, using the remoting protocol, setting up a virtual channel, and sending the device state over the virtual, which can also be collected by the virtual channel plugin, being preferably

7. The method according to claim 1, comprising a device state service which is installed on the remote desktop or application server, being preferably a system service, launching when the remote desktop or application server starts up and having preferably privileged access to an operating system, being capable of communicating with the device by the virtual channel, preferably by function calls to a remote protocol services, handling the remoting protocol on the server side, receiving updates of changes of the device state and controlling the access control.

8. The method according to claim 7, wherein the device state service launches a desktop blocking application preventing the user from viewing the Remote Desktop or Remote Application if one or more of the following conditions are fulfilled:

the device state of the device is unavailable;

insufficient to access rights for the Remote Desktop or Remote Application;

the device is a connecting device;

the device is not connected to a session;

the device state is not accepted by device state service;

9. The method according to claim 7 wherein the Device State Service persist the device state as properties within a Windows Registry or as Environment Variables for the session and/or wherein the device state service launches administrative scripts or applications when the device is connecting or connected to the remote desktop or application server, when reconnecting to an existing Session and/or upon changes to the state of the Connected Device.

10. The method according to claim 7 wherein when the Device State Service is notified of a new Session or of a reconnect to an existing Session, then the device state service immediately launches the desktop blocking application which prevents a user from being able to view any running applications or files until the device state of the connected Device is known and sufficient for the user to access the Remote Desktop or Remote Application.

11. A system for controlling access of a device to a remote desktop or a remote application running on a remote desktop or application server using a remoting protocol, comprising:

a device with a network interface, configured to set up a connection between the device and remote desktop or application server to establish or to an existing user session, using the remoting protocol;

the device and the remote desktop or application server are configured to set up a virtual channel within the connection using the remoting protocol;

the device is configured to monitor and to determine a device state;

the device is configured to send the device state over the virtual channel to the remote desktop or application server;

the remote desktop or application server is configured to determine based on the received device state if an access to the remote desktop or remote application running in the user session is allowed, and is configured to block the access if the access is due to the received state not allowed.

12. The system according to claim 11, wherein the device state comprises one or more of the following information of the device:

network information such as IP, MAC, Gateway addresses, Wi-Fi Access Point;

network security information such as Wi-Fi Encryption and Authentication Protocols;

network performance information, such as Bandwidth and Latency;

metadata about the running Operating System, such as the name, version, service pack level;

installed applications;

license state of installed applications or the operating system;

running applications on the device;

geographical location or elevation;

information if the device is jailbroken or hacked in some way that compromises the security of the device;

information about operating system updates, which have been applied to the device;

is an Anti-Virus installed and up to date;

security information of the logged in user, including their privileges, security group membership, domain membership.

13. The system according to claim 12, wherein the information of the device state is combinable be combined by operators to represent a Composite Connected Device State, allowing a fine granular access to resources of the remote desktop or remote applications by the device.

14. The system according to claim 11, wherein the received device state or composite connected vice state is made available to other applications, by using one or more of the following steps:

the device state is made available within the Windows Registry;

the device state is made available within Environment Variables;

the Connected Device State is made available through an Application Programming Interface (API);

the Connected Device State is made available through an Application.

15. The system according to system claim 11, wherein security information or privileges are addable or removable from an access token assigned to the user logged into the remote session based on the received device state or composite connected device state.

16. The system according to claim 11, comprising a virtual channel plugin running on the device to be automatically activated when setting up a session, using the remoting protocol, setting up a virtual channel, and sending the device state over the virtual, which can also be collected by the virtual channel plugin, being preferably

17. The system according to claim 11, comprising a device state service being installed on the remote desktop or application server, being preferably a system service, configured to be launched when the remote desktop or application server starts up and having preferably privileged access to an operating system, being capable of communicating with the device by the virtual channel, preferably by function calls to a remote protocol services, handling the remoting protocol on the server side, receiving updates of changes of the device state and controlling the access control.

18. The system according to claim 17, wherein the device state service is configured to launch a desktop blocking application preventing the user from viewing the Remote Desktop or Remote Application if one or more of the following conditions are fulfilled:

the device state of the device is unavailable;

insufficient to access rights for the Remote Desktop or Remote Application;

the device is a connecting device;

the device is not connected to a session;

the device state is not accepted by device state service.

19. The system according to claim 17 wherein the Device State Service is configured to

persist the device state as properties within a Windows Registry or as Environment Variables for the session and/or

launche administrative scripts or applications when the device is connecting or connected to the remote desktop or application server, when reconnecting to an existing Session and/or upon changes to the state of the Connected Device.

20. The system according to claim 17, wherein when the Device State Service is notified of a new Session or of a reconnect to an existing Session, then the device state service is configured to immediately launch the desktop blocking application which prevents a user from being able to view any running applications or files until the device state of the connected Device is known and sufficient for the user to access the Remote Desktop or Remote Application.