Providing application and device management using entitlements

• US 9,841,882 B2
• Filed: 01/12/2015
• Issued: 12/12/2017
• Est. Priority Date: 12/19/2006
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: Wilkinson, Anthony J., Benson, Mark, Crewe, Robin
• Primary Examiner(s): Wasel, Mohamed
• Application Number:
  US14/595,194
• Publication Number:
  US 20150128125A1
• Time in Patent Office: 1,065 Days
• CPC Class Codes: G06F 2209/549 Remote execution
• CPC Class Codes: G06F 3/04817 using icons graphical or visual programming using iconic symbols G06F8/34
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Methods and systems for providing virtual workspaces are provided. Specifically, Application Workspace System “AWS” enables users to access remote server-based applications (e.g., thin client applications, terminal server applications, applications on hosted operating systems, etc.) using the same interface that they use to access local applications, without needing to know where the application is being accessed. The AWS automatically determines which applications the user is entitled to use, and then figures out, based upon a variety of parameters, which applications are to be made available to the user (resolved to version, particular package etc.), and whether they are to be installed locally, or accessed remotely.

Claims

1. A computer-implemented method for managing devices based on user entitlements, the method comprising:

establishing, by a client-side manager that is installed on a managed device, communication with a component on a server that remotely provides a virtual workspace to the managed device;

detecting, by the client-side manager, a login by a user of the managed device to the virtual workspace presented to the managed device, the client-side manager enabling management and configuration of applications that are available on the virtual workspace when the user logs in to the virtual workspace;

upon detection of the login to the virtual workspace, sending, by the client-side manager, a request for entitlement information associated with the user from the client-side manager to the component on the server;

resolving, by the client-side manager, one or more entitlements of the applications associated with the user, based on the entitlement information received from the component on the server in response to the request, to determine which of the applications the user is entitled to install and/or upgrade locally and then use locally on the managed device; and

installing and/or upgrading, by the client-side manager, the determined applications locally on the managed device and providing, by the client-side manager, a user interface of the installed and/or upgraded applications to the user for use thereof.

2. The method of claim 1, the method further comprising:

in response to detecting the login to the virtual workspace, retrieving a user ID associated with the login and requesting authentication of the retrieved user ID from a directory service, by the client-side manager.

3. The method of claim 1, wherein the method further comprises:

interacting with a native operating system'"'"'s database of installed applications on the managed device, by the client-side manager.

4. The method of claim 1, wherein the method further comprises:

retrieving system call trace information on the managed device and sending the retrieved system call trace information to the component on the server for further analysis, by the client-side manager.

5. The method of claim 4, wherein the system call trace information includes one or more of:

file, directory or network share accesses;

registry accesses;

process start and stop information;

module load and unload information;

device driver load and unload information;

network listens information;

network connects information; and

network disconnects information.

6. The method of claim 1, wherein the managed device is a mobile cellular device.

7. The method of claim 1, wherein the method further comprises:

by the component on the server and the client-side manager, enabling an administrator to associate a custom action with the login, wherein the custom action is performed before the application is launched on the managed device.

8. A non-transitory computer readable storage medium storing instructions thereon, the instructions when executed by one or more processors, causing the one or more processors to execute a set of operations comprising:

establishing, by a client-side manager that is installed on a managed device, communication with a component on a server that remotely provides a virtual workspace to the managed device;

detecting, by the client-side manager, a login by a user of the managed device to the virtual workspace presented to the managed device, the client-side manager enabling management and configuration of applications that are available on the virtual workspace when the user logs in to the virtual workspace;

upon detection of the login to the virtual workspace, sending, by the client-side manager, a request for entitlement information associated with the user from the client-side manager to the component on the server;

resolving, by the client-side manager, one or more entitlements of the applications associated with the user, based on the entitlement information received from the component on the server in response to the request, to determine which of the applications the user is entitled to install and/or upgrade locally and then use locally on the managed device; and

installing and/or upgrading, by the client-side manager, the determined applications locally on the managed device and providing, by the client-side manager, a user interface of the installed and/or upgraded applications to the user for use thereof.

9. The non-transitory computer readable storage medium of claim 8, wherein the set of operations further comprises:

in response to detecting the login to the virtual workspace, retrieving a user ID associated with the login and requesting authentication of the retrieved user ID from a directory service, by the client-side manager.

10. The non-transitory computer readable storage medium of claim 8, wherein the set of operations further comprises:

interacting with a native operating system'"'"'s database of installed applications on the managed device, by the client-side manager.

11. The non-transitory computer readable storage medium of claim 8, wherein the set of operations further comprises:

retrieving system call trace information on the managed device and sending the retrieved system call trace information to the component on the server for further analysis, by the client-side manager.

12. The non-transitory computer readable storage medium of claim 11, wherein the system call trace information includes one or more of:

file, directory or network share accesses;

registry accesses;

process start and stop information;

module load and unload information;

device driver load and unload information;

network listens information;

network connects information; and

network disconnects information.

13. The non-transitory computer readable storage medium of claim 8, wherein the managed device is a mobile cellular device.

14. The non-transitory computer readable storage medium of claim 8, wherein the set of operations further comprises:

by the component on the server and the client-side manager, enabling an administrator to associate a custom action with the login, wherein the custom action is performed before the application is launched on the managed device.

15. A computing device, comprising:

at least one processor; and

computer readable medium including instructions that, when executed by the at least one processor, cause a client-side manager that is installed on the computing device to;

establish communication with a component on a server that remotely provides a virtual workspace to the computing device;

detect a login by a user of the computing device to the virtual workspace presented to the computing device, the client-side manager enabling management and configuration of applications that are available on the virtual workspace when the user logs in to the virtual workspace;

upon detection of the login to the virtual workspace, send a request for entitlement information associated with the user from the client-side manager to the component on the server;

resolve one or more entitlements of the applications associated with the user, based on the entitlement information received from the component on the server in response to the request, to determine which of the applications the user is entitled to install and/or upgrade locally and then use locally on the computing device; and

install and/or upgrade the determined applications locally on the computing device and provide a user interface of the installed and/or upgraded applications to the user for use thereof.

16. The computing device of claim 15, wherein in response to detecting the login to the virtual workspace, the client-side manager is configured to:

retrieve a user ID associated with the login; and

request authentication of the retrieved user ID from a directory service.

17. The computing device of claim 15, wherein the client-side manager is further configured to interact with a native operating system'"'"'s database of installed applications on the computing device.

18. The computing device of claim 15, wherein the client-side manager is further configured to retrieve system call trace information on the computing device and send the retrieved system call trace information to the component on the server for further analysis.

19. The computing device of claim 15, wherein the computing device is a mobile cellular device.

20. The computing device of claim 15, wherein the component on the server and the client-side manager enable an administrator to associate a custom action with the login, wherein the custom action is performed before the application is launched on the computing device.