Secure desktop for a network meeting

• US 8,370,431 B1
• Filed: 11/16/2005
• Issued: 02/05/2013
• Est. Priority Date: 11/16/2005
• Status: Active Grant

• Current Assignee: Pulse Secure, LLC (Ivanti Software, Inc.)
• Original Assignee: Juniper Networks Incorporated
• Inventors: Xu, Hao, Wang, Wanchun
• Primary Examiner(s): Whipple, Brian P
• Assistant Examiner(s): Emdadi, Keyvan
• Application Number:
  US11/280,511
• Time in Patent Office: 2,638 Days
• Field of Search: 707/220, 709/203, 715/778, 726/4
• US Class Current: 709/204
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 65/4038 with floor control

Abstract

A network meeting application for providing network meetings, such as web conference meetings, runs on a presenter device. In response to a request for a network meeting from an attendee device, the presenter device creates a secure desktop separate from a working desktop. The presenter may use the secure desktop to share documents, presentations, or other applications with the attendee device. The attendee device is blocked from accessing the working desktop of the presenter device. A presenter using the presenter device may switch between the working desktop and the secure desktop. Security policies, downloaded to the presenter device from a server, determine the applications the attendee may run on the secure desktop. The secure desktop thereby protects the integrity of the presenter'"'"'s working desktop during a web conference meeting, while allowing documents, presentations, or other applications to be shared with attendees via the secure desktop.

Claims

1. A method comprising:

with a network meeting application executing on a presenter device, receiving a request for a network meeting at the presenter device having a working desktop as a first environment for executing applications on the presenter device;

with the network meeting application, automatically creating, in response to the request, a secure desktop on the presenter device separate from the working desktop as a second environment in which software applications can be launched by the presenter on the presenter device and execute on the presenter device during the network meeting;

with the network meeting application, presenting the secure desktop to a remote device via the network meeting;

with the network meeting application, allowing remote control of the secure desktop of the presenter device by the remote device; and

with the network meeting application, blocking the remote device from accessing the working desktop of the presenter device.

2. The method of claim 1, further comprising:

intercepting an operating system call from a software application executing within the secure desktop; and

blocking the operating system call when security policies prevent the operating system call.

3. The method of claim 1, further comprising:

intercepting an operating system call from a software application executing within the secure desktop, wherein the operating system call requests access to a registry of the presenter device; and

redirecting the operating system call to a temporary registry associated with the secure desktop.

4. The method of claim 3, further comprising saving changes made to the temporary registry to the registry of the presenter device.

5. The method of claim 3, further comprising discarding changes made to the temporary registry.

6. The method of claim 2, further comprising:

intercepting an operating system call from a software application executing within the secure desktop, wherein the operating system call requests access to a file system of the presenter device; and

redirecting the operating system call to a temporary file system associated with the secure desktop.

7. The method of claim 6, further comprising saving changes made to the temporary file system to the file system of the presenter device.

8. The method of claim 6, further comprising discarding changes made to the temporary file system.

9. The method of claim 2, further comprising downloading the security policies to the presenter device from a server.

10. The method of claim 1, further comprising switching between the working desktop and the secure desktop using a secure icon.

11. The method of claim 1, further comprising setting security policies that restrict applications to be executed on the secure desktop.

12. The method of claim 11, wherein setting security policies comprises defining a location of a temporary registry and a temporary file system.

13. The method of claim 11, wherein setting security policies comprises defining desktop icons and wallpaper for the secure desktop.

33. The method of claim 1, further comprising:

executing a first software application within the working desktop of the presenter device; and

launching a second software application within the secure desktop of the presenter device while the first software application is executing within the working desktop.

14. A device comprising:

a network meeting application executing within a working desktop that provides a first environment for executing applications on a presenter device, wherein the network meeting application receives a request for a network meeting; and

a secure desktop, separate from the working desktop, automatically created by the network meeting application in response to the request as a second environment in which software applications can be launched by the presenter on the presenter device and execute on the presenter device during the network meeting,

wherein the network meeting application presents the secure desktop to a remote device via the network meeting, allows remote control of the secure desktop of the presenter device by the remote device, and blocks the remote device from accessing the working desktop of the presenter device.

15. The device of claim 14, wherein the secure desktop comprises:

a secure layer that intercepts an operating system call from a software application executing within the secure desktop, wherein the secure layer blocks the operating system call when security policies prevent the operating system calls.

16. The device of claim 14, wherein the secure desktop comprises:

a temporary registry,

wherein the secure layer intercepts an operating system call from a software application executing within the secure desktop, wherein the operating system call requests access to a registry of the presenter device, and

wherein the secure layer redirects the operating system call to the temporary registry.

17. The device of claim 16, wherein the secure layer saves changes made to the temporary registry to the registry of the presenter device.

18. The device of claim 16, wherein the secure layer discards changes made to the temporary registry.

19. The device of claim 14, wherein the secure desktop comprises:

a temporary file system,

wherein the secure layer intercepts an operating system call from a software application executing within the secure desktop, wherein the operating system call requests access to a file system of the presenter device, and

wherein the secure layer redirects the operating system call to the temporary file system.

20. The device of claim 19, wherein the secure layer saves changes made to the temporary file system to the file system of the presenter device.

21. The device of claim 19, wherein the secure layer discards changes made to the temporary file system.

22. The device of claim 14, wherein the network meeting application downloads security policies from a server for creating the secure desktop.

23. The device of claim 14, further comprising a secure icon for switching between the working desktop and the secure desktop.

24. The device of claim 14, wherein the security policies define a location of the temporary registry and a location of the temporary file system.

25. The device of claim 14, wherein the security policies define desktop icons and wallpaper for the secure desktop.

26. The device of claim 14, wherein the secure desktop has different wallpaper from the working desktop.

27. A system comprising:

a presenter device associated with a virtual private network (VPN) server, wherein a network meeting application executes within a working desktop of the presenter device, wherein the working desktop provides a first environment for launching and executing applications on the presenter device; and

one or more attendee devices associated with the VPN server, wherein at least one of the attendee devices requests a network meeting from the presenter device,

wherein, in response to the request, the presenter device automatically creates a secure desktop separate from the working desktop using the network meeting application as a second environment in which software applications can be launched by the presenter on the presenter device and execute on the presenter device during the network meeting, and

wherein the network meeting application presents the secure desktop to the one or more attendee devices via the network meeting, allows remote control of the secure desktop of the presenter device by the remote device, and blocks the remote device from accessing the working desktop of the presenter device.

28. The system of claim 27, wherein the presenter device downloads security policies from a server for creating the secure desktop.

29. The system of claim 27, wherein the secure desktop comprises a secure layer that intercepts operating system calls, wherein the secure layer checks the operating system calls against stored security policies.

30. The system of claim 27, wherein the secure desktop comprises:

a temporary registry,

wherein the secure layer intercepts an operating system call from a software application executing within the secure desktop, wherein the operating system call requests access to a registry of the presenter device, and

wherein the secure layer redirects the operating system call to the temporary registry.

31. The system of claim 27, wherein the secure desktop comprises:

a temporary file system,

wherein the secure layer intercepts an operating system call from a software application executing within the secure desktop, wherein the operating system call requests access to a file system of the presenter device, and

wherein the secure layer redirects the operating system call to the temporary file system.

32. A non-transitory computer-readable medium comprising instructions for causing a presenter device to:

with a network meeting application executing on the presenter device, receive a request for a network meeting at the presenter device having a working desktop as a first environment for executing applications on the presenter device;

with the network meeting application, automatically create, in response to the request, a secure desktop on the presenter device separate from the working desktop as a second environment in which software applications can be launched by the presenter on the presenter device and execute on the presenter device during the network meeting;

present, with the network meeting application, the secure desktop to a remote device via the network meeting;

with the network meeting application, allow remote control of the secure desktop of the presenter device by the remote device; and

with the network meeting application, block the remote device from accessing the working desktop of the presenter device.