Providing remote application access using entitlements

• US 8,892,776 B2
• Filed: 07/28/2011
• Issued: 11/18/2014
• Est. Priority Date: 12/19/2005
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: Benson, Mark, Crewe, Robin, Wilkinson, Anthony J.
• Primary Examiner(s): Wasel, Mohamed
• Application Number:
  US13/193,460
• Publication Number:
  US 20120096364A1
• Time in Patent Office: 1,209 Days
• Field of Search: 709217-219, 709/245
• US Class Current: 709/245
• CPC Class Codes: G06F 16/282 Hierarchical databases, e.g. IMS, LDAP data stores or Lotus Notes
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/505 considering the load
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/1023 based on a hash applied to IP addresses or costs
• CPC Class Codes: H04L 67/1031 Controlling of the operation of servers by a load balancer, e.g. adding or removing servers that serve requests
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context

Abstract

Methods and systems for providing virtual workspaces are provided. Example embodiments provide a Application Workspace System “AWS,” which enables users to access remote server-based applications (e.g., thin client applications, terminal server applications, applications on hosted operating systems, etc.) using the same interface that they use to access local applications, without needing to know where the application is being accessed. The AWS automatically determines which applications the user is entitled to use, and then figures out automatically, based upon a variety of parameters, which applications are to be made available to the user (resolved to version, particular package etc.), and whether they are to be installed locally, or accessed remotely. This abstract is provided to comply with rules requiring an abstract, and it is submitted with the intention that it will not be used to interpret or limit the scope or meaning of the claims.

Claims

1. A method executed on a computing device for dynamically determining and providing access to a plurality of applications, comprising:

under control of the computing device,

receiving over a communications medium an identification of a user and/or a group to which the user belongs;

automatically causing the determining, based upon a set of entitlement specifications, a plurality of remote applications and a plurality of local applications that may be made accessible to the identified user and/or the group to which the user belongs;

causing a set of indicators associated with the automatically determined plurality of remote applications and a set of indicators associated with the automatically determined plurality of local applications to be displayed together in a single application window of a desktop user interface of an operating system executing on a client computing system;

receiving an indication of selection of at least one of the presented set of indicators;

when an indication of a selection of an indicator associated with a remote application is received, automatically causing a user interface of the one of the determined remote applications associated with the selected indicator to be presented at the client computing system over the communications medium; and

when an indication of a selection of an indicator associated with a local application is received, automatically causing a user interface of the one of the determined local applications associated with the selected indicator to be presented at the client computing system over the communications medium.

2. The method of claim 1 wherein the application window is part of a web browser executing on the client computing system.

3. The method of claim 1 wherein the set of indicators associated with the automatically determined plurality of remote applications and the set of indicators associated with the automatically determined plurality of local applications are rendered on a web page.

4. The method of claim 1 wherein, when the indication of the selection of the indicator associated with the remote application is received, logon information used in causing the user interface of the one of the determined remote applications associated with the selected indicator to be presented at the client computing system is provided using Kerberos security.

5. The method of claim 1, the automatically causing the determining, based upon the set of entitlement specifications, the plurality of remote applications and the plurality of local applications that may be made accessible, comprising:

causing the resolving of the set of entitlement specifications by causing the evaluating of policy rules specified by the set of entitlement specifications.

6. The method of claim 5 wherein the specified policy rules include rules specific to a mobile device.

7. The method of claim 1, the automatically causing the determining, based upon the set of entitlement specifications, the plurality of remote applications and the plurality of local applications that may be made accessible, comprising:

causing the resolving of the set of entitlement specifications by causing the evaluating of policy rules specified by the set of entitlement specifications based upon a plurality of parameters.

8. The method of claim 7 wherein the parameters include an indication of a point of access.

9. The method of claim 8 wherein the indication of the point of access includes an indication of whether access is being requested from a mobile device.

10. A computer-readable memory medium containing content that, when executed, causes a computing device to dynamically determine and provide access to a plurality of applications, by performing a method comprising:

receiving over a communications medium an identification of a user and/or a group to which the user belongs;

automatically causing the determining of a set of entitlement specifications that describe a plurality of applications that may be made accessible to the identified user and/or the group to which the user belongs;

resolving the automatically determined set of entitlement specifications to determine a plurality of remote applications and a plurality of local applications that are accessible to the identified user and/or the group to which the user belongs;

causing a set of indicators associated with the automatically determined plurality of remote applications and a set of indicators associated with the automatically determined plurality of local applications to be displayed together in a single application window of a desktop user interface of an operating system executing on a client system;

receiving an indication of selection of at least one of the presented set of indicators;

when an indication of a selection of an indicator associated with a remote application is received, automatically causing a user interface of the one of the determined remote applications associated with the selected indicator to be presented at the client system over the communications medium; and

when an indication of a selection of an indicator associated with a local application is received, automatically causing a user interface of the one of the determined local applications associated with the selected indicator to be presented at the client system over the communications medium.

11. The computer-readable memory medium of claim 10 wherein the application window is part of a web browser executing on the client computing system.

12. The computer-readable memory medium of claim 10 wherein the set of indicators associated with the automatically determined plurality of remote applications and the set of indicators associated with the automatically determined plurality of local applications are rendered on a web page.

13. The computer-readable memory medium of claim 10 wherein, when the indication of the selection of the indicator associated with the remote application is received, logon information used in causing the user interface of the one of the determined remote applications associated with the selected indicator to be presented at the client system is provided using Kerberos security.

14. The computer-readable memory medium of claim 10, the resolving the automatically determined set of entitlement specifications to determine the plurality of remote applications that are accessible, further comprising:

evaluating a plurality of policy rules specified by the set of entitlement specifications.

15. The computer-readable memory medium of claim 14 wherein the specified plurality of policy rules include rules to be evaluated when application access is from a mobile device.

16. The computer-readable memory medium of claim 10, the resolving the automatically determined set of entitlement specifications to determine the plurality of remote applications that are accessible, further comprising:

evaluating a plurality of policy rules specified by the set of entitlement specifications based upon a plurality of parameters.

17. The computer-readable memory medium of claim 16 wherein the parameters include an indication of a point of access.

18. The computer-readable memory medium of claim 17 wherein the indication of the point of access includes an indication of whether access is being requested from a mobile device.

19. The computer-readable memory medium of claim 10 wherein the content comprises computer instructions that cause a computer processor to perform the method.

20. A computer-readable memory medium containing content that, when executed, causes a computing device to dynamically provide access to a set of applications, by performing a method comprising:

on a computing system, presenting in a single application window on a user interface of a desktop of an operating system executing on the computing system a set of indicators to associated remote applications and a set of indicators to associated local applications, the remote applications and local applications able to be executed by an identified user and/or group to which the user belongs as dynamically determined from a resolved set of entitlements;

receiving an indication of one of the presented plurality of indicators; and

when an indication of an indicator associated with a remote application is received, causing a user interface of the remote application associated with the received indication to be presented, over a communications medium, on the computing system; and

when an indication of an indicator associated with a local application is received, causing a user interface of the local application associated with the received indication to be presented, over a communications medium, on the computing system.

21. The computer-readable memory medium of claim 20 wherein the single application window is part of a web browser executing on the client computing system.

22. The computer-readable memory medium of claim 20 wherein the set of indicators associated with remote applications and the set of indicators associated with the local applications are rendered on a web page.

23. The computer-readable memory medium of claim 20 wherein the content comprises instructions that cause a computer processor to perform the method.

24. The computer-readable memory medium of claim 20 wherein a plurality of the indicators are graphical icons representative of their associated applications.

25. The computer-readable memory medium of claim 20 wherein the set of entitlements account for point of access.

26. The computer-readable memory medium of claim 20 wherein when the indication of the indicator associated with the remote application is received, communicating with the remote application using a uniform resource locator designation.