Providing domain-joined remote applications in a cloud environment

• US 9,313,188 B2
• Filed: 06/14/2013
• Issued: 04/12/2016
• Est. Priority Date: 06/14/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Hussain, Amjad, Hoover, Jonathan Austin, Scott, Tristan William, Ben-Shachar, Ido Miles, London, Kevin Scott
• Primary Examiner(s): JHAVERI, JAYESH M
• Application Number:
  US13/917,890
• Publication Number:
  US 20140373092A1
• Time in Patent Office: 1,033 Days
• Field of Search: 726/3, 718/1
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45562 Creating, deleting, cloning virtual machine instances
• CPC Class Codes: G06F 2009/45566 Nested virtual machines
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 2009/45575 Starting, stopping, suspending or resuming virtual machine instances
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]
• CPC Class Codes: G06F 9/5072 Grid computing
• CPC Class Codes: G06F 9/5077 Logical partitioning of resources; Management or configuration of virtualized resources specific details on emulation or internal functioning of virtual machines G06F9/455
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

Embodiments are directed to provisioning private virtual machines in a public cloud and to managing private virtual machines hosted on a public cloud. In one scenario, a computer system receives authentication information for a private domain from an entity. The entity indicates that their private virtual machines are to be provisioned on a public cloud, where the entity'"'"'s private domain is accessible using the authentication information. The computer system establishes a virtual network on the public cloud which is configured to host the entity'"'"'s private virtual machines, where each virtual machine hosts remote applications. The computer system establishes an authenticated connection from the virtual network to the entity'"'"'s private domain using the received authentication information and provides the entity'"'"'s private virtual machines on the public cloud. The remote applications provided by the private virtual machines then have access to data stored within the entity'"'"'s private domain using the authenticated connection.

Claims

1. A computer system comprising:

one or more hardware storage media having stored thereon computer-executable instructions;

one or more hardware processors which, when executing the computer-executable instructions, cause a system architecture to be configured for provisioning private virtual machines in a public cloud in manner to permit domain-joined remote applications, and wherein the configured system architecture comprises one or more hardware logic components configured to perform the following;

at a public cloud computing system receiving from a private domain of an entity authentication information indicating one or more private virtual machines at the private domain which are to be provisioned on the public cloud computing system;

establishing a virtual network at the public cloud computing system, the virtual network being configured to host the one or more private virtual machines of the entity and which are not publically accessible, each virtual machine being configured to host one or more remote applications;

using the authentication information, establishing an authenticated connection between the virtual network and the private domain of the entity;

provisioning, at a virtual machine managing module at the public cloud computing system, one or more of the private virtual machines of the private domain, at least some of the provisioned private virtual machines hosting one or more remote applications and the one or more remote applications requiring access to private data stored at the private domain that is publically inaccessible; and

one or more users accessing at the public cloud computing system the one or more provisioned private virtual machines and then accessing through the authenticated connection the private domain for the private data required by the one or more remote applications hosted by the at least some of the provisioned private virtual machines.

2. The computer system of claim 1, wherein the one or more hardware logic components are further configured to perform the following:

receiving from a user an indication that a management action is to be taken with respect to the one or more provisioned private virtual machines; and

the virtual machine managing module automatically performing the indicated management action to be taken with respect to the one or more provisioned private virtual machines without input from the entity.

3. The computer system of claim 2, wherein:

the management action comprises instantiating a new private virtual machine; and

connecting the new virtual machine to the private domain of the entity using the authenticated connection.

4. The computer system of claim 1, wherein the virtual machine managing module sends a data request for the authentication information, and wherein the authentication information comprises a service account that is accessible using one or more authentication credentials.

5. The computer system of claim 1, wherein the virtual network is configured to allow external access to one or more specified resources.

6. The computer system of claim 1, wherein at least one of the one or more provisioned private virtual machines is configured to run a virtual desktop infrastructure (VDI) workload.

7. The computer system of claim 1, wherein a central service is instantiated to establish the virtual network on the public cloud computing system.

8. The computer system of claim 7, wherein the central service load balances incoming requests to access the private domain.

9. The computer system of claim 8, wherein the load balancing comprises determining one or more of the virtual machines at the private domain currently able to handle additional load, and sending the incoming requests to the one or more virtual machines at the private domain determined to be able to handle additional load.

10. The computer system of claim 3, wherein the new private virtual machine is created in response to an indication of increased load.

11. The computer system of claim 2, wherein:

the management action comprises receiving an indication that at least one of the one or more provisioned private virtual machines is to be removed from the virtual network at the public cloud computing system; and

automatically removing the at least one of the one or more provisioned private virtual machines from the virtual network at the public cloud computing system.

12. The computer system of claim 11, wherein the removed private virtual machine is removed automatically in response to an indication of decreased load.

13. The computer system of claim 2, wherein:

the management action comprises receiving an indication that at least one of the one or more provisioned private virtual machines is to be updated to a newer version; and

automatically updating the at least one of the one or more provisioned private virtual machines to the newer version.

14. The computer system of claim 2, wherein:

the management action comprises receiving a request to move one of the one or more provisioned private virtual machines to a different private virtual machine at the private domain of the entity; and

moving the one or more provisioned private virtual machines to the different private virtual machine at the private domain of the entity.

15. A computer-implemented method for provisioning private virtual machines in a public cloud in manner to permit domain-joined remote applications, the computer-implemented method being performed by one or more hardware processors which, when executing computer-executable instructions, cause the one or more hardware processors to perform the computer-implemented method, which comprises:

at a public cloud computing system receiving from a private domain of an entity authentication information indicating one or more private virtual machines at the private domain which are to be provisioned on the public cloud computing system;

establishing a virtual network at the public cloud computing system, the virtual network being configured to host the one or more private virtual machines of the entity and which are not publically accessible, each virtual machine being configured to host one or more remote applications;

using the authentication information, establishing an authenticated connection between the virtual network and the private domain of the entity;

provisioning, at a virtual machine managing module at the public cloud computing system, one or more of the private virtual machines of the private domain, at least some of the provisioned private virtual machines hosting one or more remote applications and the one or more remote applications requiring access to private data stored at the private domain that is publically inaccessible; and

one or more users accessing at the public cloud computing system the one or more provisioned private virtual machines and then accessing through the authenticated connection the private data required by the one or more remote applications hosted by the at least some of the provisioned private virtual machines.

16. The computer-implemented method of claim 15, further comprising:

receiving from one of the one or more users an indication that a management action is to be taken with respect to the one or more provisioned private virtual machines; and

the virtual machine managing module automatically performing the indicated management action to be taken with respect to the one or more provisioned private virtual machines without input from the entity.

17. The computer-implemented method of claim 16, wherein the management action comprises at least one of the following:

creating a new private virtual machine, deleting an existing private virtual machine, moving an existing private virtual machine and updating a private virtual machine.

18. The computer-implemented method of claim 17, wherein the management action is presented to the one of the one or more users via a user interface, and wherein the management action presented to the user via the user interface comprise management actions that are available for a specified set of the private virtual machines of the private domain.

19. A computer program product comprising one or more hardware storage media having stored thereon computer-executable instructions which, when executed by one or more hardware processors, cause the one or more hardware processors to perform a computer-implemented method for provisioning private virtual machines in a public cloud in manner to permit domain-joined remote applications, the computer-implemented method comprising:

at a public cloud computing system receiving from a private domain of an entity authentication information indicating one or more private virtual machines at the private domain which are to be provisioned on the public cloud computing system;

establishing a virtual network at the public cloud computing system, the virtual network being configured to host the one or more private virtual machines of the entity and which are not publically accessible, each virtual machine being configured to host one or more remote applications;

using the authentication information, establishing an authenticated connection between the virtual network and the private domain of the entity;

provisioning, at a virtual machine managing module at the public cloud computing system, one or more of the private virtual machines of the private domain, at least some of the provisioned private virtual machines hosting one or more remote applications and the one or more remote applications requiring access to private data stored at the private domain that is publically inaccessible; and

one or more users accessing at the public cloud computing system the one or more provisioned private virtual machines and then accessing through the authenticated connection the private data required by the one or more remote applications hosted by the at least some of the provisioned private virtual machines.

20. The computer program product of claim 19, wherein the computer-implemented method further comprises:

receiving from one of the one or more users an indication that a management action is to be taken with respect to the one or more provisioned private virtual machines; and

the virtual machine managing module automatically performing the indicatedmanagement action to be taken with respect to the one or more provisioned private virtual machines without input from the entity.

21. The computer program product of claim 20, wherein the management action comprises at least one of the following:

creating a new private virtual machine, deleting an existing private virtual machine, moving an existing private virtual machine and updating a private virtual machine.