Policy-based access to virtualized applications

• US 8,931,037 B2
• Filed: 12/27/2010
• Issued: 01/06/2015
• Est. Priority Date: 12/27/2010
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Mefford, Cread Wellington Jr., Babey, Matthew Christopher, Chardon, Alvin, Stearns, Scott Elliot, Anderson, Adam Brady, de Souza, Lidiane Pereira, Anderson, Angela Mele
• Primary Examiner(s): Vaughan, Michael R
• Application Number:
  US12/978,655
• Publication Number:
  US 20120167159A1
• Time in Patent Office: 1,471 Days
• Field of Search: None
• US Class Current: 726/1
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

When a request is received to execute a virtualized application, an application virtualization client component evaluates an execution policy to determine if the application may be executed. If the application virtualization client component determines based on the execution policy that the virtualized application may be executed, the application virtualization client component publishes the virtualized application. The application virtualization client component publishes the application by making the virtualized application available for execution if the application is installed, and installing the virtualized application if it is not installed. The application virtualization client component also evaluates the execution policy during execution of the virtualized application. If the application virtualization client component determines that the execution policy is no longer satisfied, the application virtualization client component unpublishes the virtualized application, thereby preventing execution of the virtualized application.

Claims

1. A computer-implemented method comprising performing computer-implemented operations for:

receiving a request to execute a virtualized application on a device;

in response to receiving the request, attempting to evaluate an execution policy for the virtualized application to determine if the virtualized application may be executed on the device;

determining whether the execution policy can be evaluated;

unpublishing the virtualized application from the device by removing the virtualized application from the device in response to determining that the execution policy cannot be evaluated; and

publishing the virtualized application in response to determining that the execution policy can be evaluated and that the virtualized application may be executed.

2. The computer-implemented method of claim 1, wherein the execution policy specifies that the virtualized application may only be executed during a specified period of time.

3. The computer-implemented method of claim 1, wherein the execution policy specifies that the virtualized application may only be executed for a specified duration.

4. The computer-implemented method of claim 1, wherein the execution policy specifies that the virtualized application may only be executed when computing resources utilized by the device executing the virtualized application are not limited.

5. The computer-implemented method of claim 1, wherein publishing the virtualized application comprises:

determining whether the virtualized application is installed at the device;

making the virtualized application available for execution if the virtualized application is installed at the device; and

streaming the virtualized application to the device if the virtualized application is not installed at the device.

6. The computer-implemented method of claim 5, further comprising:

evaluating the execution policy during execution of the virtualized application to determine if the virtualized application may continue to be executed; and

unpublishing the virtualized application in response to determining that the virtualized application may not continue to be executed.

7. The computer-implemented method of claim 1, further comprising:

determining if an application virtualization server component is available to evaluate the execution policy;

evaluating the execution policy at the application virtualization server component in response to determining that the application virtualization server component is available; and

evaluating the execution policy at the device executing the virtualized application if the application virtualization server component is unavailable to evaluate the execution policy.

8. The computer-implemented method of claim 7, further comprising storing audit data comprising data describing one or more conditions under which the virtualized application was unpublished.

9. The computer-implemented method of claim 1, wherein unpublishing the virtualized application comprises stopping execution of the virtualized application and storing a state of the virtualized application.

10. The computer-implemented method of claim 9, further comprising:

determining, based on the execution policy, that the virtualized application may be executed; and

republishing the virtualized application in response to determining that the virtualized application may be executed by restoring the state of the virtualized application.

11. A computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by a computer, cause the computer to:

receive a request to execute a virtualized application;

attempt to evaluate an execution policy for the virtualized application to determine if the virtualized application may be executed in response to receiving the request;

determine whether the execution policy can be evaluated;

unpublish the virtualized application by removing the virtualized application in response to determining that the execution policy cannot be evaluated; and

publish the virtualized application in response to determining that the execution policy can be evaluated and that the virtualized application may be executed.

12. The computer-readable storage medium of claim 11, having further computer-executable instructions stored thereon which, when executed by the computer, cause the computer to:

evaluate the execution policy during execution of the virtualized application to determine if the virtualized application may continue to be executed; and

to

unpublish the virtualized application in response to determining that the virtualized application may not continue to be executed.

13. The computer-readable storage medium of claim 11, wherein publishing the virtualized application comprises:

determining whether the virtualized application is installed at a device;

making the virtualized application available for execution if the virtualized application is installed at the device; and

streaming the virtualized application to the device if the virtualized application is not installed at the device.

14. The computer-readable storage medium of claim 13, wherein the execution policy specifies that the virtualized application may only be executed during a specified period of time or that the virtualized application may only be executed for a specified duration.

15. The computer-readable storage medium of claim 13, wherein the execution policy specifies that the virtualized application may only be executed when computing resources utilized by the device executing the virtualized application are not limited.

16. The computer-readable storage medium of claim 11, having further instructions stored thereupon which, when executed by the computer, cause the computer to:

determine if an application virtualization server component is available to evaluate the execution policy;

evaluate the execution policy at the application virtualization server component in response to determining that the application virtualization server component is available; and

evaluate the execution policy at the device executing the virtualized application if the application virtualization server component is unavailable to evaluate the execution policy.

17. The computer-readable storage medium of claim 16, having further instructions stored thereupon which, when executed by the computer, cause the computer to store audit data comprising data describing one or more conditions under which the virtualized application was unpublished.

18. The computer-readable storage medium of claim 11, wherein unpublishing the virtualized application comprises stopping execution of the virtualized application and storing a state of the virtualized application.

19. The computer-readable storage medium of claim 18, having further instructions stored thereupon which, when executed by the computer, cause the computer to:

determine, based on the execution policy, that the virtualized application may be executed; and

republish the virtualized application in response to determining that the virtualized application may be executed by restoring the state of the virtualized application.

20. A computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by a computer, cause the computer to:

receive a request to execute a virtualized application on a device;

in response to receiving the request, attempting to evaluate an execution policy for the virtualized application to determine if the virtualized application may be executed on the device;

determine whether the execution policy can be evaluated;

unpublish the virtualized application from the device by removing the virtualized application from the device in response to determining that the execution policy cannot be evaluated; and

to

publish the virtualized application by streaming the virtualized application to the device in response to determining that the execution policy can be evaluated and that the virtualized application may be executed, and wherein the execution policy specifies that the virtualized application may only be executed when the device is located in a specified geographical location.