Method and system for controlling remote session on computer systems

• US 10,075,532 B2
• Filed: 01/12/2016
• Issued: 09/11/2018
• Est. Priority Date: 01/12/2016
• Status: Active Grant

• Current Assignee: Jens Schmidt, Jonathan Allsop, Sascha Goeckel
• Original Assignee: Jens Schmidt, Jonathan Allsop, Sascha Goeckel
• Inventors: Schmidt, Jens, Goeckel, Sascha, Allsop, Jonathan
• Primary Examiner(s): Avery, Jeremiah
• Application Number:
  US14/993,512
• Publication Number:
  US 20170201588A1
• Time in Patent Office: 973 Days
• Field of Search: None
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/08 specially adapted for terminal emulation, e.g. Telnet
• CPC Class Codes: H04L 67/133 Protocols for remote procedure calls [RPC]
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/142 Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms
• CPC Class Codes: H04L 67/55 Push-based network services

Abstract

Method and devices are provided for controlling access of a device to a remote desktop or an application running on a remote desktop or application server using a remoting protocol. The method includes: registering the device with a device state server to store identifying information, including a push notification token; using the device state server with access to the device identifying information to wake a device state application on the device in response to detection of connectivity between the device and the remote desktop or application server; monitoring the device to determine a device state; sending the device state from the device to the device state server and then to the remote desktop or application server; and determining based on the received device state if an access to the remote desktop or remote application running in the user session is allowed, otherwise blocking the access.

Claims

1. A method for controlling the access of a device to a remote desktop or a remote application running on a remote desktop or application server using a remoting protocol, comprising the following steps:

Registration of the device with a device state server to store device identifying information, including a push notification token;

Using the device state server to wake a device state application on the device in response to the detection of a connectivity between the device and the remote desktop or application server;

Monitoring the device to determine a device state;

Sending the device state from the device to the device state server which in turn forwards the device state to the remote desktop or application server;

Determining based on the received device state if an access to the remote desktop or remote application running in the user session is allowed, and block the access if the access is due to the received state not allowed, wherein the remoting protocol is used to capture graphics, audio, clipboard or storage from a remote session and deliver the graphics, audio, clipboard or storage to the device where the graphics, audio, clipboard or storage can be reconstructed to give the illusion that the remote desktop or remote application is running on the device.

2. The method according to claim 1, wherein the device state comprises one or more of the following information of the device:

network information including at least one of IP, MAC, Gateway addresses, and WiFi Access Point;

network security information including at least one of WiFi Encryption and Authentication Protocols;

network performance information including as least one of Bandwidth and Latency;

metadata about the running Operating System include at least one of the name, version, and service pack level;

installed applications;

license state of installed applications or the operating system;

running applications on the device;

geographical location or elevation;

information if the device is jailbroken or hacked in some way that compromises the security of the device;

information about operating system updates, which have been applied to the device;

is an Anti-Virus installed and up to date;

security information of the logged in user, including their privileges, security group membership, domain membership.

3. The method according to claim 2, wherein the information of the device state can be combined by operators to represent a Composite Connected Device State, which allows a fine granular access to resources of the remote desktop or remote applications by the device.

4. The method according to claim 1, wherein the received device state or composite connected device state is made available to other applications, by using one or more of the following steps:

the device state is made available within the operating system Registry;

the device state is made available within Environment Variables;

the Connected Device State is made available through an Application Programming Interface (API);

the Connected Device State is made available through an Application.

5. The method according to claim 1, wherein security information are added or removed from the access token of the user logged into the remote session based on the received device state or composite connected device state.

6. The method according to claim 1, comprising a device state application running on the device which is automatically activated when setting up a session, by a push notification from the device state server, and sending the device state back to the device state server which forwards the device state to the remote desktop or application server.

7. The method according to claim 1, comprising a device state service which is installed on the remote desktop or application server, being preferably a system service, launching when the remote desktop or application server starts up and having preferably privileged access to an operating system, being capable of notifying a device state server with access to the connecting devices push notification token, communicating with the device preferably by a push notification, receiving the device state preferably by a persistent communications channel to the device state service, receiving updates of changes of the device state and controlling the access control.

8. The method according to claim 7 wherein the device state service launches a desktop blocking application preventing the user from viewing the Remote Desktop or Remote Application if one or more of the following conditions are fulfilled:

the device state of the device is unavailable;

insufficient to access rights for the Remote Desktop or Remote Application;

the device is a connecting device;

the device is not connected to a session;

the device state is not accepted by device state service.

9. The method according to claim 7 wherein the Device State Service persist the device state as properties within an operating system Registry or as Environment Variables for the session and/or wherein the device state service launches administrative scripts or applications when the device is connecting or connected to the remote desktop or application server, when reconnecting to an existing Session and/or or upon changes to the state of the Connected Device.

10. The method according to claim 7 wherein when the Device State Service is notified of a new Session or of a reconnect to an existing Session, then the device state service launches the desktop blocking application which prevents a user from being able to view any running applications or files until the device state of the connected Device is known and sufficient for the user to access the Remote Desktop or Remote Application.

11. A system for controlling the access of a device to a remote desktop or a remote application running on a remote desktop or application server using a remoting protocol, comprising:

a device with a network interface, configured to set up a connection between the device and remote desktop or application server to establish or to an existing user session, using the remoting protocol;

the device and the remote desktop or application server are configured to communicate by waking an application on the device in response to an established remoting protocol connection, and routing the communication through an intermediate server back to the remote desktop or application server;

the device is configured to monitor and to determine a device state;

the device is configured to send the device state over the intermediate server to the remote desktop or application server;

the remote desktop or application server is configured to determine based on the received device state, if an access to the remote desktop or remote application running in the user session is allowed, and is configured to block the access if the access is due to the received state not allowed, wherein the remoting protocol is used to capture graphics, audio, clipboard or storage from a remote session and deliver the graphics, audio, clipboard or storage to the device where the graphics, audio, clipboard or storage can be reconstructed to give the illusion that the remote desktop or remote application is running on the device.

12. The system according to claim 11, wherein the device state comprises one or more of the following information of the device:

network information including at least one IP, MAC, Gateway addresses, and Wi-Fi Access Point;

network security information including at least one of Wi-Fi Encryption and Authentication Protocols;

network performance information including at least one of Bandwidth and Latency;

metadata about the running Operating System including at least one of the name, version, service pack level;

installed applications;

license state of installed applications or the operating system;

running applications on the device;

geographical location or elevation;

information if the device is jailbroken or hacked in some way that compromises the security of the device;

information about operating system updates, which have been applied to the device;

is an Anti-Virus installed and up to date;

security information of the logged in user, including their privileges, security group membership, domain membership.

13. The system according to claim 12, wherein the information of the device state is combined by operators to represent a Composite Connected Device State, allowing a fine granular access to resources of the remote desktop or remote applications by the device.

14. The system according to claim 11, wherein the received device state or composite connected vice state is made available to other applications, by using one or more of the following steps:

the device state is made available within the operating system Registry;

the device state is made available within Environment Variables;

the Connected Device State is made available through an Application Programming Interface (API);

the Connected Device State is made available through an Application.

15. The system according to claim 11, wherein the security information are added or removed from an access token of the user logged into the remote session based on the received device state or composite connected device state.

16. The system according to claim 11, comprising a device state application running on the device to be automatically activated when setting up a session, by a push notification from a device state server, and sending the device state back to the device state server which forwards the device state to the remote desktop or application server.

17. The system according to claim 11, comprising a device state service being installed on the remote desktop or application server, being preferably a system service, configured to be launched when the remote desktop or application server starts up and having preferably privileged access to an operating system, being capable of notifying a device state server with access to the connecting devices push notification token, communicating with the device preferably by a push notification, receiving the device state preferably by a persistent communications channel to the device state service, receiving updates of changes of the device state and controlling the access control.

18. The system according to claim 17, wherein the device state service is configured to launch a desktop blocking application preventing the user from viewing the Remote Desktop or Remote Application if one or more of the following conditions are fulfilled:

the device state of the device is unavailable;

insufficient to access rights for the Remote Desktop or Remote Application;

the device is a connecting device;

the device is not connected to a session;

the device state is not accepted by device state service.

19. The system according to claim 17 wherein the Device State Service is configured to

persist the device state as properties within an operating system Registry or as Environment Variables for the session and/or;

launch administrative scripts or applications when the device is connecting or connected to the remote desktop or application server, when reconnecting to an existing Session and/or upon changes to the state of the Connected Device.

20. The system according to claim 17, wherein when the Device State Service is notified of a new Session or of a reconnect to an existing Session, then the device state service is configured to launch the desktop blocking application which prevents a user from being able to view any running applications or files until the device state of the connected Device is known and sufficient for the user to access the Remote Desktop or Remote Application.