METHODS AND SYSTEMS FOR PROVIDING REMOTE ACCESS TO A COMPUTING ENVIRONMENT PROVIDED BY A VIRTUAL MACHINE

• US 20070180449A1
• Filed: 01/18/2007
• Published: 08/02/2007
• Est. Priority Date: 01/24/2006
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Robinson, David, Pedersen, Bradley, LOW, Anthony, MAZZAFERRI, Richard, CROFT, Richard
• Granted Patent: US 8,117,314 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 16/748 Hypervideo linking data to content, e.g. by linking an URL to a video object in the context of video distribution systems H04N21/858
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2209/541 Client-server
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 3/1415 with means for detecting differences between the image stored in the host and the images displayed on the displays
• CPC Class Codes: G06F 3/1438 using more than one graphics controller
• CPC Class Codes: G06F 3/1462 with means for detecting differences between the image stored in the host and the images displayed on the remote displays
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/485 Task life-cycle, e.g. stopping, restarting, resuming execution G06F9/4881 takes precedence
• CPC Class Codes: G06F 9/5027 the resource being a machine, e.g. CPUs, Servers, Terminals
• CPC Class Codes: G06F 9/5055 considering software capabilities, i.e. software resources associated or available to the machine
• CPC Class Codes: G06F 9/5077 Logical partitioning of resources; Management or configuration of virtualized resources specific details on emulation or internal functioning of virtual machines G06F9/455
• CPC Class Codes: G06F 9/5088 involving task migration
• CPC Class Codes: G06F 9/54 Interprogram communication
• CPC Class Codes: G09G 2354/00 Aspects of interface with display user
• CPC Class Codes: G09G 2370/16 Use of wireless transmission of display information
• CPC Class Codes: G09G 2370/22 Detection of presence or absence of input display information or of connection or disconnection of a corresponding information source
• CPC Class Codes: G09G 5/006 Details of the interface to the display terminal specific for a display terminal using a CRT G09G1/167; using a flat panel G09G3/2096; circuits for interfacing with colour displays G09G5/04
• CPC Class Codes: G09G 5/14 : Display of multiple viewports
• CPC Class Codes: H04L 63/0227 : Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 : for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/105 : Multiple levels of security
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/08 : specially adapted for terminal emulation, e.g. Telnet
• CPC Class Codes: H04L 67/14 : Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/303 : Terminal profiles
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/56 : Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/563 : Data redirection of data network streams
• CPC Class Codes: H04L 67/564 : Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 67/568 : Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 67/59 : Providing operational support to end devices by off-loading in the network or by emulation, e.g. when they are unavailable
• CPC Class Codes: H04L 69/24 : Negotiation of communication capabilities

Abstract

A method for providing remote access to a computer environment provided by a virtual machine includes the step of receiving authentication information associated with a user of a client machine. Based on the received authentication information, a computer environment provided by a virtualized operating system and already associated with the user is identified. A connection is established between the client machine and the identified computing environment

Claims

1. A method for providing remote access to a computing environment provided by a virtual machine, the method comprising:

(a) receiving authentication information associated with a user of a client machine;

(b) identifying, based on the received authentication information, a computing environment provided by a virtualized operating system and already associated with the user; and

(c) establishing a connection between the client machine and the identified computing environment.

2. The method of claim 1, wherein step (a) further comprises gathering, by a collection agent, information about the client machine.

3. The method of claim 2, wherein step (b) comprises identifying, based on the received authentication information and gathered client machine information, a computing environment provided by a virtual machine and already associated with the user.

4. The method of claim 2, wherein step (c) comprises establishing a connection between the client machine and the identified computing environment subject to a rule applied to the received authentication information and the gathered client machine information.

5. The method of claim 1, wherein step (b) comprises identifying, based on the received authentication information, a first computing environment provided by a first virtual machine and a second computing environment provided by a second virtual machine, the first and second computing environments already associated with the user.

6. The method of claim 1, wherein step (b) comprises identifying, based on the received authentication information, a first computing environment provided by a first virtual machine executing on a first server and a second computing environment provided by a second virtual machine executing on a second server, the first and second computing environments already associated with the user.

7. The method of claim 1, wherein step (c) comprises establishing a connection between the client machine and the identified computing environment subject to a rule.

8. The method of claim 1 further comprising:

receiving a request to disconnect the client machine from the identified computing environment; and

terminating the connection between the client machine and the identified computing environment.

9. The method of claim 8 further comprising updating a data record associated with the identified computing environment to indicate that the client machine is disconnected.

10. The method of claim 9 further comprising the step of continuing execution of the identified computing environment.

11. The method of claim 1 further comprising authenticating the user in response to the received authentication information.

12. The method of claim 1, wherein step (b) comprises consulting stored data associated with at least one computing environment to identify, based on the received authentication information, a computing environment provided by a virtualized operating system and already associated with the user.

13. The method of claim 1 further comprising the steps of:

(a) receiving authentication information associated with the user, the user using a second client machine;

(b) identifying, based on the received authentication information, a computing environment provided by a virtualized operating system and already associated with the user; and

(c) establishing a connection between the second client machine and the identified computing environment.

14. The method of claim 13 further comprising terminating the connection between the first client machine and the identified computing environment.

15. The method of claim 1, wherein step (b) further comprises identifying a computing environment provided by a virtualized operating system launched by a hypervisor executing in a terminal services session provided by an operating system executing on one of a plurality of execution machines.

16. The method of claim 15, wherein step (c) further comprises establishing a connection between the client machine and the identified computing environment, via the terminal services session.

17. The method of claim 1, wherein step (c) further comprises establishing a presentation-layer protocol connection between the client machine and the identified computing environment.

18. The method of claim 1, wherein step (c) further comprises establishing an X11 connection between the client system and the identified computing environment.

19. The method of claim 1, wherein step (c) further comprises establishing an ICA connection between the client system and the identified computing environment.

20. The method of claim 1, wherein step (c) further comprises establishing an RDP connection between the client system and the identified computing environment.

21. A method for providing remote access to a plurality of application sessions, the method comprising:

(a) receiving, at a client machine, a selection of a single user interface element by a user of the client machine;

(b) transmitting, in response to the user interface element selection, authentication information associated with the user;

(c) identifying, based on the transmitted authentication information, a computing environment provided by a virtualized operating system and already associated with the user; and

(d) establishing a connection between the client machine and the identified computing environment.

22. The method of claim 21 further comprising gathering, by a collection agent in response to the received information, information about the client machine.

23. The method of claim 22, wherein step (c) comprises identifying, based on the received authentication information and gathered client machine information, a computing environment provided by a virtualized operating system and already associated with the user.

24. The method of claim 22, wherein step (d) comprises establishing a connection between the client machine and the identified computing environment subject to a rule applied to the received authentication information and the gathered client machine information.

25. The method of claim 21, wherein step (c) comprises identifying, based on the received authentication information, a first computing environment provided by a first virtualized operating system and a second computing environment provided by a second virtualized operating system, the first and second computing environments already associated with the user.

26. The method of claim 21, wherein step (c) comprises identifying, based on the received authentication information, a first computing environment provided by a first virtualized operating system executing on a first server and a second computing environment provided by a second virtualized operating system executing on a second server, the first and second computing environments already associated with the user.

27. The method of claim 21, wherein step (d) comprises establishing a connection between the client machine and the identified computing environment subject to a rule.

28. The method of claim 21 further comprising:

receiving a request to disconnect the client machine from the identified computing environment; and

terminating the connection between the client machine and the identified computing environment.

29. The method of claim 28 further comprising updating a data record associated with the identified computing environment to indicate that the client machine is disconnected.

30. The method of claim 29 further comprising the step of continuing execution of the identified computing environment.

31. The method of claim 21 further comprising authenticating the user in response to the received authentication information.

32. The method of claim 21, wherein step (c) comprises consulting stored data associated with at least one computing environment to identify, based on the received authentication information, a computing environment provided by a virtualized operating system and already associated with the user.

33. The method of claim 21 further comprising the steps of:

(a) receiving authentication information associated with the user, the user using a second client machine;

(b) identifying, based on the received authentication information, a computing environment provided by a virtualized operating system and already associated with the user; and

(c) establishing a connection between the second client machine and the identified computing environment.

34. The method of claim 33 further comprising terminating the connection between the first client machine and the identified computing environment.

35. The method of claim 21, wherein step (c) further comprises identifying a computing environment provided by a virtualized operating system launched by a hypervisor executing in a terminal services session provided by an operating system executing on one of a plurality of execution machines.

36. The method of claim 35 wherein step (d) further comprises establishing a connection between the client machine and the identified computing environment, via the terminal services session.

37. The method of claim 21, wherein step (d) further comprises establishing a presentation-layer protocol connection between the client machine and the identified computing environment.

38. The method of claim 21, wherein step (d) further comprises establishing an X11 connection between the client system and the identified computing environment.

39. The method of claim 21, wherein step (d) further comprises establishing an ICA connection between the client system and the identified computing environment.

40. The method of claim 21, wherein step (d) further comprises establishing an RDP connection between the client system and the identified computing environment.

41. A server for providing remote access to a computing environment, the server comprising:

a network module receiving authentication information associated with a user operating a client machine;

a data store containing an identifier of a computing environment associated with the user and provided by a virtual machine;

a broker process connecting the client machine to the identified computing environment enumerated in the data store in response to the received information.

42. The server of claim 41, wherein the data store contains a first identifier of a first computing environment associated with the user and a second identifier of a second computing environment associated with the user.

43. The server of claim 42, wherein the first computing environment executes on a first server and the second computing environment executes on a second server.

44. The server of claim 41, wherein the broker process connects the client to the identified computing environment subject to a rule.

45. The server of claim 41, wherein the broker process disconnects the client computer from the identified computing environment in response to a received disconnect signal.

46. The server of claim 45, wherein the broker process updates a data record associated with the identified computing environment to indicate the client machine is disconnected from the identified computing environment.

47. The server of claim 41 further comprising an authentication module for authenticating the user in response to the received authentication information.

48. The server of claim 41 further comprising:

a collection agent gathering information about the client machine; and

a policy engine receiving the gathered information and assigning one of a plurality of levels of access responsive to application of a policy to the received information, the broker process connecting the client machine to the identified computing environment enumerated in the data store responsive to the assigned access level.

49. The server of claim 48 wherein the policy engine further comprises a database storing configurable policies.

50. The server of claim 48, wherein the policy engine transmits instructions to the collection agent determining the type of information the collection agent gathers.

51. The server of claim 48, wherein the policy engine further comprises a logon agent.

52. The server of claim 48, wherein the policy engine further comprises a plurality of logon agents.

53. The logon agent of claim 52, wherein the logon agent receives the gathered information from the collection agent.

54. The logon agent of claim 52, wherein the logon agent identifies for the policy engine authentication information received from the collection agent.

55. The server of claim 54, wherein at least one of the plurality of logon agents resides on each network domain from which a client machine may transmit a resource request.

56. The server of claim 55, wherein the client machine transmits the resource request to a particular logon agent.

57. The server of claim 56, where the logon agent identifies for the policy engine the network domain from which the client machine transmits the resource request.

58. The server of claim 48, wherein the collection agent executes on the client machine.

59. The server of claim 48, wherein the policy engine transmits the collection agent to the client machine.

60. The server of claim 48, wherein the collection agent comprises at least one script.

61. The server of claim 48, wherein the collection agent comprises bytecode.

62. The server of claim 48, wherein the collection agent gathers the information by running at least one script on the client machine.

63. The server of claim 41 wherein the data store further comprises an identifier of a computing environment associated with the user provided by a virtual machine launched by a hypervisor executing in a terminal services session provided by an operating system executing on one of a plurality of execution machines.

64. The server of claim 41 wherein the broker process further comprises connecting the client machine to the identified computing environment, via the terminal services session.

65. The server of claim 41, wherein the broker process further comprises establishing a presentation-layer protocol connection between the client machine and the identified computing environment.

66. The server of claim 41, wherein the broker process further comprises establishing an X11 connection between the client system and the identified computing environment.

67. The server of claim 41, wherein the broker process further comprises establishing an ICA connection between the client system and the identified computing environment.

68. The server of claim 41, wherein the broker process further comprises establishing an RDP connection between the client system and the identified computing environment.