Automatically determining which remote applications a user or group is entitled to access based on entitlement specifications and providing remote application access to the remote applications

• US 8,935,429 B2
• Filed: 07/28/2011
• Issued: 01/13/2015
• Est. Priority Date: 12/19/2006
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: Wilkinson, Anthony J., Benson, Mark, Crewe, Robin
• Primary Examiner(s): WASEL, MOHAMED A
• Application Number:
  US13/193,471
• Publication Number:
  US 20120096365A1
• Time in Patent Office: 1,265 Days
• Field of Search: 709217-219, 709/245
• US Class Current: 709/245
• CPC Class Codes: G06F 2209/549 Remote execution
• CPC Class Codes: G06F 3/04817 using icons graphical or visual programming using iconic symbols G06F8/34
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Application Workspace System “AWS,” enables users to access remote server-based applications (e.g., thin client applications, terminal server applications, applications on hosted operating systems, etc.) using the same interface that they use to access local applications, without needing to know where the application is being accessed. The AWS automatically determines which applications the user is entitled to use, and then figures out automatically, based upon a variety of parameters, which applications are to be made available to the user (resolved to version, particular package etc.), and whether they are to be installed locally, or accessed remotely.

Claims

1. A method executed on a computing device for dynamically determining and providing access to a plurality of remote applications that are remote from the computing device, comprising:

under control of the computing device,

receiving over a communications medium an identification of a user and/or a group to which the user belongs;

automatically causing the determining, based upon a set of entitlement specifications, a plurality of remote applications that may be made accessible to the identified user and/or the group to which the user belongs;

causing a set of indicators associated with the automatically determined plurality of remote applications to be displayed directly on a desktop user interface of an operating system executing on a client computing system;

receiving an indication of a selection of at least one of the presented set of indicators; and

automatically causing a user interface of the at least one of the determined remote applications associated with the selected indicator to be presented, at the client computing system, over the communications medium.

2. The method of claim 1 wherein any logon information necessary in automatically causing the user interface of the one of the determined remote applications associated with the selected indicator to be presented at the client computing system is provided using Kerberos security.

3. The method of claim 1, the automatically causing the determining, based upon the set of entitlement specifications, the plurality of remote applications that may be made accessible to the identified user and/or the group to which the user belongs, comprising:

causing the resolving of the set of entitlement specifications by causing the evaluating of policy rules specified by the set of entitlement specifications.

4. The method of claim 3 wherein the specified policy rules include rules specific to a mobile device.

5. The method of claim 1, the automatically causing the determining, based upon the set of entitlement specifications, the plurality of remote applications that may be made accessible to the identified user and/or the group to which the user belongs, comprising:

causing the resolving of the set of entitlement specifications by causing the evaluating of policy rules specified by the set of entitlement specifications based upon a plurality of parameters.

6. The method of claim 5 wherein the parameters include an indication of a point of access.

7. The method of claim 6 wherein the indication of the point of access includes an indication of whether access is being requested from a mobile device.

8. A computer-readable memory medium containing content that, when executed, causes a computing device to dynamically determine and provide access to a set of remote applications that are remote from the computing device, by performing a method comprising:

receiving over a communications medium an identification of a user and/or a group to which the user belongs;

automatically causing the determining of a set of entitlement specifications that describe a plurality of remote applications that may be made accessible to the identified user and/or the group to which the user belongs;

resolving the automatically determined set of entitlement specifications to determine a plurality of remote applications that are accessible to the identified user and/or the group to which the user belongs;

causing a set of indicators associated with the automatically the determined plurality of remote applications that are accessible to the identified user and/or the group to which the user belongs to be presented on a desktop user interface of an operating system executing on a client system;

receiving an indication of a selection of at least one of the presented set of indicators; and

automatically causing a user interface of the at least one of the determined remote applications associated with the selected indicator to be presented, over the communications medium, at the client system.

9. The computer-readable memory medium of claim 8 wherein any logon information necessary in automatically causing the user interface of the at least one of the plurality of determined remote applications to be presented at the client system is provided using Kerberos security.

10. The computer-readable memory medium of claim 8, the resolving the automatically determined set of entitlement specifications to determine the plurality of remote applications that are accessible, further comprising:

evaluating a plurality of policy rules specified by the set of entitlement specifications.

11. The computer-readable memory medium of claim 10 wherein the specified plurality of policy rules include rules to be evaluated when application access is from a mobile device.

12. The computer-readable memory medium of claim 8, the resolving the automatically determined set of entitlement specifications to determine the plurality of remote applications that are accessible, further comprising:

evaluating a plurality of policy rules specified by the set of entitlement specifications based upon a plurality of parameters.

13. The computer-readable memory medium of claim 12 wherein the parameters include an indication of a point of access.

14. The computer-readable memory medium of claim 13 wherein the indication of the point of access includes an indication of whether access is being requested from a mobile device.

15. The computer-readable memory medium wherein the content comprises computer instructions that cause a computer processor to perform the method.

16. A computing system for dynamically determining and providing access to a plurality of remote applications, the computing system comprising:

one or more processors;

memory storing a set of instructions executed by the one or more processors to cause the one or more processors to;

receive over a communications medium an identification of a user and/or a group to which the user belongs;

automatically cause the determining, based upon a set of entitlement specifications, a plurality of remote applications that may be made accessible to the identified user and/or the group to which the user belongs;

cause a set of indicators associated with the automatically determined plurality of remote applications to be displayed directly on a desktop user interface of an operating system executing on a client computing system;

receive an indication of a selection of at least one of the presented set of indicators; and

automatically cause a user interface of the at least one of the determined remote applications associated with the selected indicator to be presented, at the client computing system, over the communications medium.

17. The computing system of claim 16, wherein any logon information necessary in automatically causing the user interface of the one of the determined remote applications associated with the selected indicator to be presented at the client computing system is provided using Kerberos security.

18. The computing system of claim 16, the automatically causing the determining, based upon the set of entitlement specifications, the plurality of remote applications that may be made accessible to the identified user and/or the group to which the user belongs, comprising:

causing the resolving of the set of entitlement specifications by causing the evaluating of policy rules specified by the set of entitlement specifications.

19. The computing system of claim 18, wherein the specified policy rules include rules specific to a mobile device.

20. The computing system of claim 16, the automatically causing the determining, based upon the set of entitlement specifications, the plurality of remote applications that may be made accessible to the identified user and/or the group to which the user belongs, comprising:

causing the resolving of the set of entitlement specifications by causing the evaluating of policy rules specified by the set of entitlement specifications based upon a plurality of parameters.