Public cloud desktop management platform, cloud desktop control method and device

Abstract

The application provides a public cloud desktop management platform, a cloud desktop control method and equipment, which are used for improving the performance of the cloud desktop management platform in the public cloud and solving the technical problem of communication between the tenant cloud desktop and the cloud desktop management platform. A public virtual machine is additionally deployed for multiple user VMs of the same tenant, a tenant side Controller of the cloud desktop management platform is deployed on the public virtual machine, the public virtual machine is simultaneously added to a management network and a tenant network where the tenant cloud desktop is located, and a control service on the public virtual machine provides services for the user virtual machine in the tenant network. Through the application, the pressure of the control service of the cloud desktop management platform can be reduced, the overall platform performance and reliability can be improved, and safe communication between the tenant cloud desktop and the cloud desktop management platform is realized.

Description

Technical Field

[0001] This invention relates to the fields of communication and cloud computing technology, and in particular to a public cloud desktop management platform, cloud desktop control method and device. Background Technology

[0002] In public cloud scenarios, enabling multiple tenants to use the same cloud desktop system and providing unified cloud desktop services to multiple tenants can improve user experience. However, to achieve this goal, it is necessary to implement data isolation, network isolation, and isolation between tenant business networks and management networks to fully guarantee the security of user business and data.

[0003] Virtual machines in cloud desktop services typically integrate an Agent component. This Agent component interacts with the cloud desktop management platform and performs many important functions. For example, it periodically sends heartbeat keep-alive messages to the cloud desktop management platform and receives and applies various policies issued by the platform locally. These policies include authorization policies for virtual machines and cloud desktop clients (such as security rules, software blacklists and whitelists), access control policies for security and network, ACL policies, and virtual firewall policies. The cloud desktop management platform first sends the policies to the Agent component, which is then responsible for distributing and applying the policies to the virtual machines.

[0004] In public cloud scenarios, to ensure security, tenants are required to be isolated from the management network. However, how to achieve reliable and efficient interaction between the cloud desktop and the management platform when the tenant and management network are isolated is a technical problem that needs to be solved. Summary of the Invention

[0005] In view of this, the present invention provides a public cloud desktop management platform, a cloud desktop control method and device, for improving the performance of the cloud desktop management platform in the public cloud and solving the technical problem of communication between the tenant's cloud desktop and the cloud desktop management platform.

[0006] Based on one aspect of the embodiments of the present invention, the present invention provides a public cloud desktop management platform, the cloud desktop management platform comprising:

[0007] The platform-side control service is used to interact with the cloud desktop client, process the cloud desktop client's requests, and provide user authentication services for the cloud desktop client.

[0008] The tenant-side control service is used to interact with user virtual machines in the tenant network, process requests from the agent service in the user virtual machine, and provide control services for the user virtual machine.

[0009] Furthermore, the platform-side control service is deployed in the cloud virtualization management platform CVM, and the tenant-side control service is deployed in the public virtual machine in the tenant's workspace;

[0010] The platform-side control service and the tenant-side control service share common resources located in the cloud virtualization management platform (CVM).

[0011] The public virtual machine is simultaneously connected to both the management network of the cloud desktop management platform and the tenant network of the user virtual machine.

[0012] Furthermore, the tenant-side control service includes a primary tenant-side control service and a backup tenant-side control service, which together constitute a primary / backup or dual-active configuration.

[0013] The primary tenant-side control service and the backup tenant-side control service are deployed in two public virtual machines in the tenant's workspace, respectively; each public virtual machine is configured with two network cards, one for accessing the management network of the cloud desktop management platform and the other for accessing the tenant network where the user's virtual machine is located.

[0014] The tenant-side control service is also used to call the Agent interface in the user virtual machine to distribute the virtual IP of the tenant-side control service to the user virtual machine.

[0015] Furthermore, when the primary tenant-side control service or the backup tenant-side control service receives a message sent by the cloud desktop management platform to the user virtual machine, it determines whether it has established a session connection to the user virtual machine.

[0016] When the determination is yes, the message is sent through the session;

[0017] If the determination is negative, the message is stored in the message middleware;

[0018] The primary tenant-side control service and the backup tenant-side control service listen to messages in the message middleware. When the primary tenant-side control service or the backup tenant-side control service hears a message in the message middleware that is to be sent to the user virtual machine and determines that a session connection to the user virtual machine has been established locally, it consumes the message in the message middleware and sends the message through the session connection.

[0019] Furthermore, the system time of the public virtual machine where the tenant-side control service resides is synchronized with the time of the platform server where the platform-side control service resides.

[0020] Based on another aspect of the embodiments of the present invention, the present invention also provides a public cloud desktop control method, which is applied to a cloud desktop management platform, the cloud desktop management platform including a platform-side control service and a tenant-side control service, the method comprising:

[0021] The platform-side control service interacts with the cloud desktop client, processes the cloud desktop client's requests, and provides user authentication services for the cloud desktop client.

[0022] The system interacts with user virtual machines in the tenant network through the tenant-side control service, processes requests from the agent service in the user virtual machine, and provides control services to the user virtual machine.

[0023] Furthermore, the platform-side control service is deployed in the cloud virtualization management platform CVM, and the tenant-side control service is deployed in the public virtual machine in the tenant's workspace;

[0024] The platform-side control service and the tenant-side control service share common resources located in the cloud virtualization management platform (CVM).

[0025] The public virtual machine is simultaneously connected to both the management network of the cloud desktop management platform and the tenant network of the user virtual machine.

[0026] Furthermore, a primary tenant-side control service and a backup tenant-side control service are deployed in two public virtual machines in the tenant workspace, respectively, and the primary tenant-side control service and the backup tenant-side control service constitute a primary-backup or dual-active configuration.

[0027] Configure two network interface cards (NICs) in each public virtual machine: one for accessing the management network of the cloud desktop management platform, and the other for accessing the tenant network where the user's virtual machine resides.

[0028] The primary tenant-side control service or the backup tenant-side control service sends the virtual IP of the tenant-side control service to the user virtual machine by calling the Agent interface in the user virtual machine.

[0029] Furthermore, when the primary tenant-side control service or the backup tenant-side control service receives a message sent by the cloud desktop management platform to the user virtual machine, it determines whether it has established a session connection to the user virtual machine.

[0030] When the determination is yes, the message is sent through the session;

[0031] If the determination is negative, the message is stored in the message middleware;

[0032] The primary tenant-side control service and the backup tenant-side control service listen to messages in the message middleware. When the primary tenant-side control service or the backup tenant-side control service hears a message in the message middleware that is to be sent to the user virtual machine and determines that a session connection to the user virtual machine has been established locally, it consumes the message in the message middleware and sends the message through the session connection.

[0033] Technical Effects: This invention deploys a shared virtual machine (VM) for multiple user VMs within the same tenant. A tenant-side controller for the cloud desktop management platform is deployed on this shared VM. The shared VM is simultaneously added to both the management network and the tenant network where the tenant's cloud desktop resides. The control service on the shared VM provides services to the user VMs within the tenant network. This invention reduces the load on the cloud desktop management platform's control service, improves overall platform performance and reliability, and enables secure communication between the tenant's cloud desktop and the cloud desktop management platform. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments of the present invention or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained from these drawings of the embodiments of the present invention.

[0035] Figure 1 This is a schematic diagram of the composition structure of a public cloud-in-cloud desktop management platform provided in an embodiment of the present invention;

[0036] Figure 2 This is a schematic diagram of a public cloud desktop framework structure provided in an embodiment of the present invention;

[0037] Figure 3 A schematic diagram of the electronic device structure for implementing the cloud desktop control method provided by the present invention. Detailed Implementation

[0038] The terminology used in this embodiment of the invention is for the purpose of describing particular embodiments only and is not intended to limit the embodiments of the invention. The singular forms “a,” “the,” and “the” as used in this embodiment are also intended to include the plural forms unless the context clearly indicates otherwise. The term “and / or” as used in this invention refers to any or all possible combinations comprising one or more of the associated listed items.

[0039] It should be understood that although the terms first, second, third, etc., may be used to describe various information in embodiments of the present invention, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of embodiments of the present invention, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" may also be interpreted as "when," "when," or "in response to a determination."

[0040] To achieve secure communication between tenant cloud desktops and the cloud desktop management platform in a public cloud and improve the performance of the public cloud desktop management platform, this invention provides a public cloud desktop management platform, a cloud desktop control method, and a device. The basic idea of ​​this invention is to deploy a common virtual machine for multiple user virtual machines (VMs) within the same tenant, deploy the tenant-side controller service of the cloud desktop management platform on the common virtual machine, and simultaneously add the common virtual machine to both the management network and the tenant network where the tenant's cloud desktop resides. The control service on the common virtual machine provides services to the user VMs in the tenant network. This invention reduces the load on the controller service of the cloud desktop management platform, improves the overall platform performance and reliability, and enables secure communication between tenant cloud desktops and the cloud desktop management platform.

[0041] Figure 1 This is a schematic diagram illustrating the structural composition of a cloud desktop management platform in a public cloud according to an embodiment of the present invention. In this embodiment, the cloud desktop management platform located in the public cloud management network includes two control services. The Controller in the cloud desktop management platform and the Controller in the tenant's public VM constitute a whole, jointly providing Controller control services to the tenant. The platform-side control service and the tenant-side control service use some common resources, which can be uniformly deployed in the network on the cloud desktop management platform side. The cloud desktop management platform provided by the present invention includes:

[0042] The platform-side control service Controller1 is used to interact with the cloud desktop client, process the cloud desktop client's requests, and provide control services to the cloud desktop client. The control services provided to the cloud desktop client include at least user authentication and authorization services.

[0043] The tenant-side control service Controller2 interacts with cloud desktops (user VMs) in the tenant network, processes requests from agent services within the user VMs, and provides control services to the user VMs. These control services include, but are not limited to: policy control, process status monitoring, and remote shutdown or restart requests.

[0044] Policy control may include the tenant-side control service issuing various policies to user VMs based on agent requests, such as firewall policies, blacklists and whitelists, to ensure that user VMs apply these policies. Process status monitoring may include the tenant-side control service receiving periodic heartbeat messages from agents to monitor the status of user VMs or the status of critical processes within the VMs. The cloud desktop management platform issues remote shutdown and restart commands to the user VM's agent through the tenant-side control service to shut down and restart user VMs. The tenant-side control service can also be used to respond to agent requests and return User Profile Management (UPM) data to user VMs.

[0045] In this invention, the Agent in the user VM is a proxy program installed in the user VM. The Agent is installed when the user VM is created, and it starts automatically when the user VM starts.

[0046] Figure 2 This is a schematic diagram of a public cloud desktop framework structure provided in an embodiment of the present invention. The framework structure mainly shows three parts: the gateway layer, the cloud virtualization management platform CVM, and the cloud virtualization kernel CVK.

[0047] The Cloud Virtualization Manager (CVM) platform is used to deploy the Cloud Desktop Management Platform (WS). WS includes the Controller service (also known as the platform-side controller) and the Workspace Server. CVM primarily manages the software virtualization of hardware resources such as computing, network, and storage within the cloud platform, providing automated services to upper-layer applications. Its services include: virtual computing, virtual networking, virtual storage, high availability (HA), dynamic resource scheduling (DRS), elastic resource scaling (DRX), GPU resource pools, virtual machine backup and recovery services, KVM virtualization management, vSwitch virtual switch management, high reliability management, virtualization security management, and log auditing interfaces.

[0048] The Cloud Virtualization Kernel (CVK) is virtualization kernel software that runs between the infrastructure layer and the upper-layer guest operating system. CVK provides the upper-layer guest operating system with access to the underlying hardware resources, shielding it from the differences between heterogeneous underlying hardware and eliminating the upper-layer guest operating system's dependency on hardware devices and drivers.

[0049] The cloud desktop client connects to the cloud desktop management platform through the gateway layer. The gateway layer provides a virtual IP address (VIP) to the outside world. The client connects to the gateway through the VIP. The load balancer (LB) component provides load balancing functionality, and multiple virtual gateways (VGAs) provide gateway services.

[0050] In this embodiment of the invention, the platform-side controller acts as a unified authentication control center, providing authentication services to cloud desktop clients. It can interface with third-party authentication servers, such as Active Directory (AD), Lightweight Directory Access Protocol (LDAP), and SMS authentication. Cloud desktop users of a tenant initiate authentication requests to the platform-side controller through their cloud desktop clients. After successful authentication by the platform-side controller, it sends virtual machine access authorization information to the user's cloud desktop client. The cloud desktop client can then use this authorization information to access the user's virtual machine located in the CVK (Cloud Virtual Machine). The IP address of the platform controller is the same as the IP address of the cloud desktop management platform.

[0051] Figure 1 In the example, two public VMs are deployed for tenant n, and a Controller (referred to as tenant-side control service or tenant-side Controller) is deployed in each tenant public VM. The two public VMs provide active-active or primary-backup Controller services to provide highly available control services for multiple user VMs in the tenant workspace (tenant network). The primary public VM and the backup public VM can perform bidirectional detection through a direct heartbeat link, automatically handling keep-alive and failover. The dual public VM configuration is for providing high availability. In business scenarios where network high availability requirements are not high, only one public VM can be deployed, depending on the specific application scenario requirements.

[0052] The Agent is a proxy service program installed in the user's virtual machine (VM). It is responsible for establishing communication with the tenant-side Controller and accepting control and services provided by the tenant-side Controller. The tenant-side Controller can send its IP address to the Agent in the user's VM by calling the interface provided by the Agent.

[0053] In this invention, the Controller in the cloud desktop management platform and the Controller in the tenant's public VM constitute a whole, jointly providing Controller control services to the tenant. The two will use some public resources, such as databases (e.g., MySQL, Redis in-memory database, etc.), distributed message middleware (e.g., RocketMQ, etc.), public physical resources (e.g., storage and CPU resources virtualized via CAS, etc.). These public resources can be uniformly deployed in the network on the cloud desktop management platform side, and the tenant Controller accesses these public resources through the virtual switch vSwitch in the management network.

[0054] based on Figure 1 For example, when a tenant applies for a cloud desktop, the cloud desktop management platform creates two public VMs for the tenant. Each public VM is configured with two network interface cards (NICs): one NIC connects to the management network and the other connects to the tenant network. The tenant's network is isolated. The tenant-side controller deployed in the public VM accesses public resources located in the CVM through the NIC connected to the management network and interacts with the Agent in the user VM through the NIC connected to the tenant's business network. The public VM acts as a proxy virtual machine, connecting the management network and the tenant network.

[0055] The following, combined with Figure 1 The configuration and deployment process for the tenant's public VMs and cloud desktop management platform is described in detail.

[0056] The implementation steps on the public VM side are as follows:

[0057] S11. Administrators create public VM image virtual machines on the platform in advance, install tenant-side controller services, Nginx, keepalived and other components, and finally convert them into public VM templates for later creation of tenant public VMs.

[0058] Nginx is a high-performance web and reverse proxy service component, which in this embodiment can be used for user load balancing and message forwarding. The Keepalived component is used for reliability enhancement. Keepalived is a high-availability solution for virtual servers based on the Virtual Router Redundancy Protocol (VRRP), which can be used to avoid single points of failure. This invention does not limit the specific component type; any component that can achieve similar functionality is acceptable.

[0059] S12. When a tenant requests a virtual machine, two public virtual machines are deployed for the tenant based on the public virtual machine template. The relevant configurations of the public virtual machines are modified in advance, such as the database, Redis, CAS, and RabbitMQ address information, all changed to the addresses of the corresponding public component services in the cloud desktop management platform's public resources for subsequent communication. The controller services of the public VMs all access the public resources of the cloud desktop management platform, such as in-memory databases and message middleware public component services.

[0060] S13. Modify the system time of the public VM to keep it synchronized with the time of the platform server where the cloud desktop management platform WS is located.

[0061] S14. Grant permissions to the MySQL database in public resources so that the controller in the public VM can access the MySQL database on the management platform side;

[0062] S15. Modify the Nginx configuration file / etc / nginx / conf.d / controller-upstream.conf, add the actual public VM address, and restart the Nginx service.

[0063] S16. Select one of the two public VMs as the master node, configure keepalived, set the master node identifier, and configure the virtual IP address of the tenant-side controller.

[0064] S17. Select another public VM as the backup node and modify the corresponding keepalived configuration information.

[0065] S18. The controller of the public VM interacts with the platform-side database service, Redis, and RabbitMQ service. The controller service in the public VM handles the Agent requests of all tenant cloud desktops.

[0066] S19. After configuration, these two public virtual machines form a dual-active node. Virtual IPs are generated through keepalived. All user VMs under the tenant interact with the controller of the public VM through the virtual IPs. Both controllers provide services to the cloud desktop agents under the tenant at the same time. If one fails, the other can continue to run normally.

[0067] The implementation steps on the CVM management platform side are as follows:

[0068] S21. The cloud desktop management platform establishes a session connection with the user's VM's agent through one of the two tenant-side controllers;

[0069] To achieve load balancing, the cloud desktop management platform can distribute cloud desktops evenly across two tenant-side controllers based on preset policies. The tenant-side controllers and agents typically establish bidirectional streaming communication sessions using remote procedure calls (e.g., gRPC) protocols. For example, gRPC typically uses StreamObserver. <t>The interface sends controller messages to the agent in the user VM. Since this interface is a non-extendable and non-serializable interface, it cannot be saved to middleware or database and can only be stored in memory. This means that only the controller in the two public VMs that has saved the bidirectional stream object can interact with the agent in the user VM. The other tenant-side controller that has not established a session with the specified user VM to save the bidirectional stream object cannot send messages to the agent in the specified user VM.

[0070] S22. When the cloud desktop management platform needs to send a message from the controller in the public VM to the agent in the user VM, it determines whether a session connection has been established with the agent in the user VM. If it determines no, the message is placed in the message middleware in the public resources. If it determines yes, the message is sent directly to the user VM through the created session.

[0071] While maintaining the method of establishing sessions using bidirectional stream objects to achieve message transmission, this embodiment uses a message middleware to assist in message forwarding in order to ensure that all user VMs can receive messages sent by the cloud desktop management platform.

[0072] Suppose that the Agent in user VM1 in the tenant's workspace has established a session connection with the tenant-side Controller1 located in public VM1, and the message interaction is realized through a bidirectional stream object. At this time, the tenant-side Controller1 has created a bidirectional stream object to user VM1, but the tenant-side Controller2 located in public VM2 has not created a bidirectional stream object to user VM1.

[0073] When the cloud desktop management platform sends a control message intended for user VM1 to tenant-side Controller2, tenant-side Controller2 first determines whether it has a bidirectional stream object to user VM1, i.e., whether a session connection to user VM1 has been created. If the determination is no, tenant-side Controller2 can place the control message into the RabbitMQ message middleware located in the public resources on the cloud desktop management platform side. If the determination is yes, tenant-side Controller2 directly sends the control message to user VM1 through the already created session connection.

[0074] S23. All controllers in the public VMs listen to messages in the message middleware. Tenant-side controllers that establish session connections with agents in user VMs consume messages in the message middleware and send the messages to agents in user VMs, which then distribute the applications to user VMs.

[0075] Both Controller1 and Controller2 in the public VM listen to messages in RabbitMQ. Assuming that Controller1 on the tenant side listens to a message put into RabbitMQ by Controller2, it determines that it has created a session connection to user VM1 and has saved a bidirectional stream object to user VM1 based on information such as the destination address of the message or the user VM identifier. Then, Controller1 consumes this message and sends the control message to the agent of user VM1 through the session. The agent of user VM1 then issues or applies the control policy or control command in the control message to user VM1.

[0076] This invention integrates the controller on the cloud desktop management platform with the controller in the tenant's public VM into a single unit to provide services to the outside world. Compared to a solution where all agents only access the platform-side controller, this invention distributes the load of the platform-side controller by using the controller in the public VM, reducing the overall pressure on the platform-side controller, improving the overall platform performance and reliability, and solving the problems of isolation and secure communication between the tenant's cloud desktop and the management network.

[0077] Figure 3 This is a schematic diagram of an electronic device 300 for implementing the cloud desktop control method provided by the present invention. The device includes a processor 310 (such as a central processing unit (CPU), a communication bus 320, a communication interface 340, and a storage medium 330. The processor 310 and the storage medium 330 can communicate with each other via the communication bus 320. The storage medium 330 stores a computer program, which, when executed by the processor 310, performs one or more steps of the method provided by the present invention.

[0078] The storage medium may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Alternatively, the storage medium may be at least one storage device located remotely from the aforementioned processor. The processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0079] It should be recognized that embodiments of the present invention can be implemented or carried out by computer hardware, a combination of hardware and software, or by computer instructions stored in non-transitory memory. The methods can be implemented using standard programming techniques, including a non-transitory storage medium configured with a computer program within the computer program, wherein such a storage medium causes the computer to operate in a specific and predefined manner. Each program can be implemented in a high-level procedural or object-oriented programming language to communicate with the computer system. However, if desired, the program can be implemented in assembly or machine language. In any case, the language can be a compiled or interpreted language. Furthermore, for this purpose, the program can run on a programmed application-specific integrated circuit. Moreover, the operations of the processes described in this invention can be performed in any suitable order unless otherwise indicated by the invention or otherwise clearly contradicted by the context. The processes (or variations and / or combinations thereof) described in this invention can be executed under the control of one or more computer systems configured with executable instructions and can be implemented by hardware or a combination thereof as code (e.g., executable instructions, one or more computer programs, or one or more applications) that commonly executes on one or more processors. The computer program includes a plurality of instructions executable by one or more processors.

[0080] Furthermore, the method can be implemented in any suitable type of computing platform, including but not limited to personal computers, minicomputers, mainframes, workstations, networked or distributed computing environments, standalone or integrated computer platforms, or in communication with charged particle tools or other imaging devices. Aspects of the invention can be implemented as machine-readable code stored on a non-transitory storage medium or device, whether removable or integrated into a computing platform, such as a hard disk, optical read and / or write storage medium, RAM, ROM, etc., such that it is readable by a programmable computer, and when the storage medium or device is read by the computer, it can be used to configure and operate the computer to perform the processes described herein. Furthermore, the machine-readable code, or portions thereof, can be transmitted via wired or wireless networks. The invention includes these and other different types of non-transitory computer-readable storage media when such media comprises instructions or programs that implement the steps described above in conjunction with a microprocessor or other data processor. When programmed according to the methods and techniques described in the invention, the invention also includes the computer itself.

[0081] The above description is merely an embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the present invention should be included within the scope of protection of the present invention.< / t>

Claims

1. A public cloud desktop management platform, characterized in that, The cloud desktop management platform includes: The platform-side control service is used to interact with the cloud desktop client, process the cloud desktop client's requests, and provide user authentication services for the cloud desktop client. Tenant-side control service is used to interact with user virtual machines in the tenant network, process requests from the agent service in the user virtual machine, and provide control services for the user virtual machine; The platform-side control service is deployed in the cloud virtualization management platform CVM, and the tenant-side control service is deployed in the public virtual machine in the tenant's workspace; The platform-side control service and the tenant-side control service share common resources located in the cloud virtualization management platform (CVM). The public virtual machine is simultaneously connected to both the management network of the cloud desktop management platform and the tenant network of the user virtual machine.

2. The public cloud desktop management platform according to claim 1, characterized in that, The tenant-side control service includes a primary tenant-side control service and a backup tenant-side control service, which together form a primary / backup or dual-active configuration. The primary tenant-side control service and the backup tenant-side control service are deployed in two public virtual machines in the tenant's workspace, respectively; each public virtual machine is configured with two network cards, one for accessing the management network of the cloud desktop management platform and the other for accessing the tenant network where the user's virtual machine is located. The tenant-side control service is also used to call the Agent interface in the user virtual machine to distribute the virtual IP of the tenant-side control service to the user virtual machine.

3. The public cloud desktop management platform according to claim 2, characterized in that, When the primary tenant-side control service or the backup tenant-side control service receives a message sent by the cloud desktop management platform to the user virtual machine, it determines whether it has established a session connection to the user virtual machine. When the determination is yes, the message is sent through the session; If the determination is negative, the message is stored in the message middleware; The primary tenant-side control service and the backup tenant-side control service listen to messages in the message middleware. When the primary tenant-side control service or the backup tenant-side control service detects a message from the message middleware that is to be sent to the user virtual machine and determines that a session connection to the user virtual machine has been established locally, it consumes the message from the message middleware and sends the message through the session connection.

4. The public cloud desktop management platform according to claim 1, characterized in that, The system time of the public virtual machine where the tenant-side control service resides is synchronized with the time of the platform server where the platform-side control service resides.

5. A public cloud desktop control method, characterized in that, This method is applied to a cloud desktop management platform, which includes platform-side control services and tenant-side control services. The method includes: The platform-side control service interacts with the cloud desktop client, processes the cloud desktop client's requests, and provides user authentication services for the cloud desktop client. The tenant-side control service interacts with user virtual machines in the tenant network, processes requests from the agent service in the user virtual machine, and provides control services to the user virtual machine. The platform-side control service is deployed in the cloud virtualization management platform CVM, and the tenant-side control service is deployed in the public virtual machine in the tenant's workspace; The platform-side control service and the tenant-side control service share common resources located in the cloud virtualization management platform (CVM). The public virtual machine is simultaneously connected to both the management network of the cloud desktop management platform and the tenant network of the user virtual machine.

6. The method according to claim 5, characterized in that, Deploy a primary tenant-side control service and a backup tenant-side control service in two public virtual machines in the tenant workspace, respectively. The primary tenant-side control service and the backup tenant-side control service constitute a primary-backup or dual-active configuration. Configure two network interface cards (NICs) in each public virtual machine: one for accessing the management network of the cloud desktop management platform, and the other for accessing the tenant network where the user's virtual machine resides. The primary tenant-side control service or the backup tenant-side control service sends the virtual IP of the tenant-side control service to the user virtual machine by calling the Agent interface in the user virtual machine.

7. The method according to claim 6, characterized in that, When the primary tenant-side control service or the backup tenant-side control service receives a message sent by the cloud desktop management platform to the user virtual machine, it determines whether it has established a session connection to the user virtual machine. When the determination is yes, the message is sent through the session; If the determination is negative, the message is stored in the message middleware; The primary tenant-side control service and the backup tenant-side control service listen to messages in the message middleware. When the primary tenant-side control service or the backup tenant-side control service detects a message from the message middleware that is to be sent to the user virtual machine and determines that a session connection to the user virtual machine has been established locally, it consumes the message from the message middleware and sends the message through the session connection.

8. An electronic device, characterized in that, It includes a processor, a communication interface, a storage medium, and a communication bus, wherein the processor, the communication interface, and the storage medium communicate with each other through the communication bus; Storage medium used to store computer programs; A processor, when executing a computer program stored on a storage medium, implements the method according to any one of claims 5-7.

Images