Configuration techniques for managing virtual machines

Abstract

Embodiments described herein relate to configuring managed virtual machines. For example, a management service (e.g., a mobile device manager) can provide configuration settings to a parent virtual machine. Upon successful application of the configuration settings, the parent virtual machine notifies a configuration service that it is in a stable state and provides the configuration settings to the configuration service. The configuration service notifies a cloud-based service (e.g., a virtual desktop service) that it is configured to instantiate a virtual machine. The notification informs the cloud-based service to allow instantiation of a child virtual machine. In response to receiving the notification, the cloud-based service instantiates the child virtual machine(s) as needed. To configure the child virtual machine(s), the configuration service provides the configuration settings received from the parent virtual machine to the child virtual machine(s), and the child virtual machine(s) configure themselves accordingly.

Description

Background Technology

[0001] Mobile Device Management (MDM) is a method to ensure employees remain productive and do not violate company policy. Many organizations use MDM products / services and / or other management entities to control their employees' activities. These products, services, and / or entities primarily handle company data isolation, email protection, on-device security, enforcement of company policies, integration and management of mobile devices, including various laptops and handheld devices, as well as emulated computing devices (i.e., virtual machines). Such technologies mitigate various security risks by ensuring that computing devices issued by the organization and third-party computing devices allowed access to the organization's network are configured according to the organization's data and security policies. Summary of the Invention

[0002] The present invention is provided to present, in a simplified form, the selection of concepts further described in the following detailed description. The present invention is not intended to identify key or essential features of the claimed subject matter, nor is it intended to limit the scope of the claimed subject matter.

[0003] The embodiments described herein relate to configuring a managed virtual machine. For example, a management service (e.g., a mobile device manager) may provide configuration settings to a parent virtual machine. After successfully applying the configuration settings, the parent virtual machine notifies the configuration service that it is in a stable state and provides the configuration settings to the configuration service. The configuration service notifies a cloud-based service (e.g., a virtual desktop service) that it is configured to instantiate a virtual machine. This notification informs the cloud-based service that the instantiation of child virtual machines is permitted. In response to receiving the notification, the cloud-based service instantiates (multiple) child virtual machines as needed. To configure (multiple) child virtual machines, the configuration service provides (multiple) child virtual machines (multiple) with the configuration settings received from the parent virtual machine, and (multiple) child virtual machines (multiple) configure themselves accordingly.

[0004] Other features and advantages of the disclosed embodiments, as well as the structure and operation of various embodiments, are described in detail below with reference to the accompanying drawings. Note that the disclosed embodiments are not limited to the specific embodiments described herein. These embodiments given herein are for illustrative purposes only. Other embodiments will be apparent to those skilled in the art based on the teachings contained herein. Attached Figure Description

[0005] The accompanying drawings, which constitute a part of this specification, illustrate embodiments and, together with the specification, further serve to explain the principles of the embodiments and enable those skilled in the art to make and use the embodiments.

[0006] Figure 1 A block diagram of a system for managing and configuring virtual machines, according to an example embodiment, is depicted.

[0007] Figure 2 A flowchart is depicted for an example method for configuring a virtual machine according to an example embodiment.

[0008] Figure 3 A flowchart is depicted for an example method, according to an example embodiment, for enabling a cloud-based service to instantiate a sub-virtual machine.

[0009] Figure 4 A flowchart is depicted for an example method for providing additional configuration settings to a sub-virtual machine, according to an example embodiment.

[0010] Figure 5 A block diagram of a system for configuring a virtual machine with additional configuration settings, according to an example embodiment, is depicted.

[0011] Figure 6 A flowchart illustrating an example method, according to an example embodiment, for providing configuration settings specific to a particular subvirtual machine to a subvirtual machine.

[0012] Figure 7 A block diagram is depicted according to an example embodiment for configuring a subvirtual machine system with configuration settings dedicated to subvirtual machines.

[0013] Figure 8 This is a block diagram of an example computing device that can be used to implement the embodiments.

[0014] The features and advantages of the disclosed embodiments will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings, in which the same reference numerals identify corresponding elements throughout. In the drawings, the same reference numerals generally denote identical, functionally similar, and / or structurally similar elements. The first appearance of an element in a graphic is indicated by the leftmost digit of the corresponding reference numeral. Detailed Implementation

[0015] I. Introduction

[0016] The following detailed description discloses numerous exemplary embodiments. The scope of this patent application is not limited to the disclosed embodiments, but also includes combinations of the disclosed embodiments and modifications to the disclosed embodiments.

[0017] References to "an embodiment," "embodiment," and "example embodiment," etc., in the specification indicate that the described embodiment may include specific features, structures, or characteristics, but each embodiment does not necessarily include specific features, structures, or characteristics. Furthermore, these phrases do not necessarily refer to the same embodiment. Moreover, when a specific feature, structure, or characteristic is described in connection with an embodiment, it is believed that those skilled in the art can implement such a feature, structure, or characteristic in conjunction with other embodiments, whether explicitly described or not.

[0018] Numerous exemplary embodiments are described below. It should be noted that any section / heading provided herein is not limiting. Embodiments are described throughout this document, and any type of embodiment may be included under any section / heading. Furthermore, embodiments disclosed in any section / heading may be combined in any way with any other embodiments described in the same section / heading and / or different sections / headings.

[0019] II. Systems and methods for configuring and managing virtual machines

[0020] The embodiments described herein relate to virtual machines with configuration management. For example, a management service (e.g., a mobile device manager) may provide configuration settings to a parent virtual machine. After successfully applying the configuration settings, the parent virtual machine notifies the configuration service that it is in a stable state and provides the configuration settings to the configuration service. The configuration service notifies a cloud-based service (e.g., a virtual desktop service) that it is configured to instantiate a virtual machine. This notification informs the cloud-based service that it is allowed to instantiate multiple child virtual machines. In response to receiving the notification, the cloud-based service instantiates multiple child virtual machines as needed. To configure the multiple child virtual machines, the configuration service provides the configuration settings received from the parent virtual machine to the multiple child virtual machines, and the multiple child virtual machines configure themselves accordingly.

[0021] The sub-virtual machines do not obtain configuration settings directly from the management service. Instead, they utilize configuration settings provided by the configuration service, thus bypassing the management service when configuring the sub-virtual machines. Therefore, the configuration service acts as a proxy, managing and configuring the sub-virtual machines in a unified manner on behalf of the management service. By having the configuration service act as a proxy, the time required to configure the sub-virtual machines is significantly reduced, allowing users to utilize them more quickly. Specifically, the management service typically uses the OMA (Open Mobile Alliance) device management protocol to transmit configuration settings. Such a protocol requires a relatively large number of handshakes between the management service and the (multiple) sub-virtual machines to be configured. This handshake not only causes delays in sub-virtual machine configuration but also increases network traffic. Furthermore, this configuration delay effectively reduces the management service's ability to configure a large number of sub-virtual machines in a relatively short period.

[0022] Figure 1 This is a block diagram of a system 100 for managing and configuring virtual machines according to an example embodiment. (e.g.) Figure 1As shown, system 100 includes a cloud service platform 102 and computing device 104 communicatively coupled via network 106. Network 106 may include one or more networks, such as a local area network (LAN), a wide area network (WAN), an enterprise network, the Internet, etc., and may include one or more wired and / or wireless portions. As used herein, the term "enterprise" broadly refers to any of various organizational types, including businesses, non-profit organizations, and government agencies. An enterprise network includes a dedicated computer network established by an enterprise to interconnect enterprise devices (e.g., computing device 104) at one or more enterprise locations to other enterprise devices and enable enterprise devices to access and / or share computing resources. Users of computing device 104 may be referred to herein as "enterprise users" or simply "users." Each computing device 104 may include, for example, but not limited to, desktop computers, laptop computers, tablet computers, netbooks, smartphones, etc.

[0023] According to at least one embodiment, cloud service platform 102 includes a system owned by Microsoft Corporation, located in Redmond, Washington. This is part of a cloud computing platform, although this is just an example and not intended to be limiting. Figure 1 As shown, the cloud service platform 100 includes a management service 108, a configuration service 110, and a virtual desktop service 112, which has allocated a host pool 114 for virtual machines 116 and 118. Virtual machine 116 represents the initial virtual machine instantiated by the virtual desktop service 112. Virtual machines subsequently instantiated and similarly configured as parent virtual machines 116 are referred to as and shown as child virtual machines(s) 118. Each of the management service 108, configuration service 110, virtual desktop service 112, and host pool 114 can be executed via one or more nodes (or servers) of the cloud service platform 102 coupled via network communication. According to an embodiment, each of the configuration service 110 and virtual desktop service 112 is implemented as a platform-based service (e.g., Platform as a Service). Examples of virtual desktop service 112 include, but are not limited to, those published by Microsoft Corporation of Redmond, Washington. Virtual desktop.

[0024] Virtual Desktop Service 112 can instantiate a virtual machine in response to a user's request for a virtual desktop session. For example, as... Figure 1As shown, computing device 104 includes and executes virtual desktop client application 120. For example, virtual desktop client application 130 may send a request to virtual desktop service 112 via network 106 to utilize a virtual machine. In response to receiving the request, virtual desktop service 112 assigns a user to a specific virtual machine. Initially, one or more users may be assigned to parent virtual machine 116. However, if parent virtual machine 114 cannot support other users (e.g., due to its load exceeding a predetermined threshold), virtual desktop service 112 instantiates a child virtual machine (e.g., child virtual machine 118) that serves as the parent virtual machine. Virtual desktop service 112 continues to instantiate child virtual machine 118 as needed to support an increasing number of users.

[0025] Management service 108 can be configured to configure parent virtual machine 116 relative to a policy (e.g., a data and / or security policy). This policy can be specified by the enterprise. Management service 108 can also be referred to as a Mobile Device Manager (MDM). Policies can be specified based on one or more compliance rules. For example, management service 108 may include compliance engine 120. Compliance engine 120 can determine configuration settings 122 to be provided to parent virtual machine 116 and provide it with the determined configuration. The determined configuration settings can conform to compliance rules. Compliance rules can be specified by an enterprise administrator (e.g., an IT administrator or someone within the enterprise who may be responsible for deploying, maintaining, and / or configuring virtual machines 116 and 118 on behalf of enterprise users).

[0026] Configuration settings 122 can be managed by service 108 (such as...) Figure 1 (As shown) It can be maintained, or it can be stored in a data storage (not shown) that is communicatively coupled with the management service 108.

[0027] Configuration setting 122 can specify one or more configuration settings for the parent virtual machine 116, one or more network settings to be implemented by the parent virtual machine 116, one or more application behavior settings that affect the behavior of applications running on the parent virtual machine 114, and the minimum version of at least one application or operating system that needs to be installed on the parent virtual machine 116. Encryption settings can specify whether to encrypt the storage allocated to the parent virtual machine 116 (e.g., via an encryption program, such as, but not limited to, BitLocker). TM(Multiple) security settings can specify the password policy to be implemented for the parent virtual machine 116 (e.g., setting the password length to at least 10 characters, 12 characters, etc.), whether code signing should be implemented by the parent virtual machine 114, whether the Trusted Platform Module (TPM) should be implemented by the parent virtual machine 116, whether to install and / or activate an anti-malware application on the parent virtual machine 116, whether to install and / or activate a firewall application on the parent virtual machine 116, network service quality (QoS) settings to be implemented by the parent virtual machine 116, network isolation settings to be implemented by the parent virtual machine 116, etc. Note that the above configuration settings are purely exemplary, and other configuration settings can be used.

[0028] Configuration setting 122 can take any suitable form. According to an embodiment, configuration setting 122 is represented via Synchronization Markup Language (SyncML) format.

[0029] Parent virtual machine 116 is configured to execute configuration agent 124. Configuration agent 124 is configured to receive configuration settings 122 from management service 108. According to one embodiment, the provision of configuration settings 122 by management service 108 is initiated by configuration agent 124. For example, configuration agent 124 may query (or “check in”) management service 108 to determine whether management service 108 includes configuration settings 122 to be applied to parent virtual machine 116. However, the embodiments described herein are not limited thereto. For example, configuration agent 124 may query management service 108 in response to a command from a user. According to another embodiment, the provision of configuration settings 124 by management service 108 is initiated by management service 108. For example, compliance engine 120 may determine to provide new configuration settings to parent virtual machine 116 and provide (or “push”) these settings to configuration agent 124.

[0030] Configuration agent 124 converts configuration settings 122 from the received format (e.g., SyncML) to another format suitable for application to multiple sub-virtual machines (e.g., (multiple) sub-virtual machines 118). According to an embodiment, the format to which configuration settings 122 are converted is the Windows Declarative Configuration (WinDC) format.

[0031] Configuration agent 124 determines configuration settings based on the applicable configuration settings 122 and configures itself accordingly. For example, configuration agent 124 may utilize one or more filtering rules and apply them to configuration settings 122 to determine a subset of configuration settings to be applied to it. Each filtering rule may include an indication of whether a particular configuration setting of configuration setting 122 should be applied to the parent virtual machine 116. For example, some configuration settings may be more applicable to physical computing devices than virtual machines. Management service 108 may not distinguish between physical computing devices and virtual machines, and therefore may provide configuration settings that are not applicable to physical computing devices to virtual machines. Therefore, configuration agent 124 may utilize filtering rules to distinguish between physical computing device settings and virtual machine settings and apply the applicable configuration settings. Multiple filtering rules may be provided to the parent virtual machine 116 by virtual desktop service 112.

[0032] After configuration agent 124 applies configuration setting 122 to parent virtual machine 116, configuration agent 124 provides a response to management service 108 indicating the result of applying the configuration setting thereon. For example, the result could indicate whether the application of configuration setting 122 was successful or failed. Upon receiving a response specifying that each configuration setting 122 was successfully applied, compliance engine 120 designates parent virtual machine 116 as compliant with compliance rules and enables parent virtual machine 114 to access resources accessible via network 106 and / or cloud service platform 102. Compliance engine 120 can determine that parent virtual machine 116 is non-compliant and / or prevent parent virtual machine 114 from accessing resources accessible via network 106 and / or cloud service platform 102, and can block access to these resources until parent virtual machine 116 becomes compliant.

[0033] Configuration agent 124 provides an indication to configuration service 110 that parent virtual machine 116 is in a stable state and ready for user use after successfully applying configuration settings 122 to parent virtual machine 116. Configuration agent 124 also provides the reformulated configuration settings received from management service 108 (displayed as configuration settings 122') to configuration service 110. In response to receiving the indication and configuration settings 122', configuration service 110 provides a notification to virtual desktop service 112, which includes a handler 132 configured to receive notifications. This notification indicates that virtual desktop service 112 allows virtual desktop service 112 to instantiate child virtual machines 118 in host pool 114, since such virtual machines can be correctly configured with configuration settings 122'.

[0034] Therefore, when Virtual Desktop Service 112 receives a request to use a virtual machine from a Virtual Desktop Application (e.g., Virtual Desktop Application 130), Virtual Desktop Service 110 instantiates a sub-virtual machine (e.g., sub-virtual machine 118). Before instantiating the sub-virtual machine, Virtual Desktop Service 112 may provide Configuration Service 110 with a notification including the identifier of the sub-virtual machine to be instantiated. As described below, Configuration Service 110 uses the identifier to associate the application results of Configuration Settings 122' with the sub-virtual machine.

[0035] like Figure 1 As further illustrated, each sub-virtual machine 118 includes a configuration agent 126. The configuration agent 126 is configured to configure its associated sub-virtual machine. For example, the configuration agent 126 provides a configuration request to the configuration service 110. In response to receiving the configuration request, the configuration service 110 provides a response to the configuration agent 126 including configuration setting 122'. Therefore, the configuration service 110 makes configuration setting 122' available for subsequent instantiation of virtual machines (i.e., the (multiple) sub-virtual machines 118) for the host pool 114. Thus, the configuration agent 126 obtains configuration setting 122' from the configuration service 110, rather than directly from the management service 108.

[0036] Configuration agent 126 utilizes configuration settings 122' available via configuration service 110 to determine the configuration settings applicable to it and configures itself accordingly. For example, configuration agent 126 may utilize filtering rules and apply them to configuration settings 122' to determine a subset of configuration settings to be applied to its associated sub-virtual machines. Filtering rules may be provided to configuration agent 126 by virtual desktop service 112. Each filtering rule may include an indication of whether a particular configuration setting of configuration setting 122' should be applied to a specific sub-virtual machine of sub-virtual machine(s) 118. For example, a rule may include an identifier of an antivirus application (e.g., published by Microsoft Corporation, Redmond, Washington). The configuration agent 126 analyzes the instructions for each filtering rule to determine whether the corresponding configuration setting 122' should be applied to its associated sub-virtual machine.

[0037] After configuration settings 122' are applied by configuration agent 126 of sub-virtual machines 118, configuration agent 126 provides a response to configuration service 110 indicating the result of applying the configuration settings thereon. For example, the result may indicate whether the application of configuration settings 122' was successful or failed. The result may be associated with the identifier of the sub-virtual machine provided by virtual desktop service 112.

[0038] The result evaluator 128 of configuration service 110 is configured to analyze the received results to determine whether the configuration settings have been successfully applied to the sub-virtual machines from which the results were received. Upon receiving a response from one of the sub-virtual machines 118 indicating that each configuration setting 122' has been successfully applied, the result evaluator 128 of configuration service 110 designates the sub-virtual machine that received the response as being in a stable (or healthy) state and provides a notification to the handler 132 of virtual desktop service 112 that the sub-virtual machine is in a stable state. Virtual desktop service 112 enables users to use the sub-virtual machine upon receiving such a notification.

[0039] Upon receiving a response indicating that one or more specified configuration settings were not successfully applied, the result evaluator 128 may determine that the responding sub-virtual machine is not in a stable state and may provide a notification to the handler 132 of the virtual desktop service 112 indicating that the sub-virtual machine is not in a stable state. In response, the virtual desktop service 112 may terminate the sub-virtual machine and / or instantiate a new sub-virtual machine.

[0040] According to an embodiment, configuration service 110 can provide notifications to the management service 108 of each of the successfully instantiated sub-virtual machines(s)118. This enables management service 110 to track each instantiated virtual machine.

[0041] By having configuration service 110 act as a proxy, the time required to configure (multiple) sub-virtual machines 118 is significantly reduced, enabling users to utilize the sub-virtual machines more quickly. Specifically, when sending configuration settings to each (multiple) sub-virtual machine 118, the lengthy handshake between the OMA device management protocol (i.e., SyncML) used by management service 108 and (multiple) sub-virtual machines 118 is avoided. Instead, each sub-virtual machine 118 receives configuration settings 122', which have been translated into WinDC and applied accordingly.

[0042] Therefore, virtual machines can be managed and configured in a variety of ways. For example, Figure 2 A flowchart 200 depicts an example method executed by a configuration service, according to an example embodiment, for bypassing the mobile device manager during the configuration of (multiple) sub-virtual machines(s). Further reference will continue. Figure 1 The system 100 describes the method of flowchart 200, although the method is not limited to this implementation. Based on... Figure 1 The flowchart 200 and the discussion of system 100, as well as other structural and operational embodiments, will be apparent to those skilled in the art.

[0043] like Figure 2As shown, the method in flowchart 200 begins at step 202, where multiple configuration settings are received and applied by the mobile device manager to a first virtual machine instantiated by a cloud-based service. For example, refer to... Figure 1 Configuration service 110 receives configuration settings 122', which are applied by management service 108 (i.e., mobile device manager) to the parent virtual machine 116 instantiated by virtual desktop service 112.

[0044] According to one or more embodiments, the cloud-based service is a virtual desktop application platform as a service (e.g., virtual desktop service 112).

[0045] According to one or more embodiments, the multiple configuration settings include at least one of the following: security settings implemented by a first virtual machine (e.g., parent virtual machine 116), network settings implemented by a first virtual computer, encryption settings implemented by the first virtual machine, or application behavior settings implemented by the first virtual machine.

[0046] In step 204, a notification is provided to the cloud-based service indicating that the service is permitted to instantiate a second virtual machine, which is a sub-virtual machine of the first virtual machine. For example, refer to... Figure 2 Configuration service 110 provides a notification to virtual desktop service 112, instructing virtual desktop service 110 to be allowed to instantiate a sub-virtual machine (e.g., sub-virtual machine 118). See below for reference. Figure 3 Describe additional details regarding providing notifications to Virtual Desktop Service 112.

[0047] In step 206, a configuration request is received from the second virtual machine. For example, refer to... Figure 1 The configuration agent 126 of (multiple) sub-virtual machines 118 provides configuration requests to the configuration service 110.

[0048] In step 208, multiple configuration settings applied to the first virtual machine are provided to the second virtual machine for application. For example, refer to... Figure 1 Configuration service 110 provides configuration settings 122' (which are applied to parent virtual machine 116) to the requesting child virtual machine (e.g., multiple child virtual machines 118). Configuration agent 126 of the requesting child virtual machine applies configuration settings 122' to the child virtual machine.

[0049] According to one or more embodiments, a second virtual machine is configured to apply filtering rules to multiple configuration settings to determine a subset of configuration settings applicable to the second virtual machine. For example, refer to Figure 1 Multiple sub-virtual machines 118 are configured to apply filtering rules to configuration settings 122' to determine a subset of configuration settings applicable to the second virtual machine.

[0050] According to one or more embodiments, the filtering rules are provided to the second virtual machine by a cloud-based service. For example, see reference... Figure 1 The filtering rules are provided by the virtual desktop service 112 to (multiple) sub-virtual machines 118.

[0051] Figure 3 A flowchart 300 depicts an example method, according to an example embodiment, for enabling a cloud-based service to instantiate a sub-virtual machine. Further reference will continue. Figure 1 The system 100 describes the method of flowchart 300, although the method is not limited to this implementation. Based on... Figure 1 Based on the discussion of flowchart 300 and system 100, other structural and operational embodiments will be obvious to those skilled in the art.

[0052] like Figure 3 As shown, the method in flowchart 300 begins at step 302, where an indication is received that the parent virtual machine has been successfully configured according to the configuration settings. For example, refer to... Figure 1 Configuration service 110 receives an indication from configuration agent 124 that the parent virtual machine 116 has successfully configured according to configuration settings 122.

[0053] In step 304, in response to receiving the instruction, a notification is provided to the cloud-based service. For example, refer to... Figure 1 Configuration service 110 provides a notification to virtual desktop service 112 in response to receiving an instruction from configuration agent 124.

[0054] According to one or more embodiments, parent virtual machine 116 can keep child virtual machines(s)118 up-to-date with the latest configuration settings provided by management service 108. For example, Figure 4 A flowchart depicts an example method 400 for providing additional configuration settings to a sub-virtual machine, according to an example embodiment. (Refer to...) Figure 5 The method of describing flowchart 400 is not limited to the implementation described therein. Figure 5 This is a block diagram of a system 500 for configuring a virtual machine with additional configuration settings, according to an example embodiment. Figure 5 As shown, system 500 includes cloud service platform 502, which is as described in the reference above. Figure 1 An example of the cloud service platform 102 described above. The cloud service platform 502 includes a management service 508, a configuration service 510, a virtual desktop service 512, and a host pool 514. The management service 508, configuration service 510, virtual desktop service 512, and host pool 514 are as described above. Figure 1 Examples of the management service 108, configuration service 110, virtual desktop service 112, and host pool 114 are provided. Management service 508 includes a compliance engine 520 and configuration settings 522, as described above. Figure 1 Examples of the compliance engine 120 and configuration settings 122 are described above. Configuration service 510 includes a result evaluator 528, which is as described above. Figure 1 An example of the result evaluator 128. Virtual desktop service 512 includes a handler 532, which is an example of handler 132, as referenced above. Figure 1 As described above, host pool 514 includes parent virtual machine 516 and (multiple) child virtual machines 518, which are as referenced above. Figure 2 Examples of the parent virtual machine 516 and (multiple) child virtual machines 518 described above. The parent virtual machine 516 includes a configuration agent 524, and the (multiple) child virtual machines 518 include a configuration agent 526, as referenced above. Figure 1 The corresponding examples of configuration agent 124 and configuration agent 126 are described. Based on... Figure 5 The discussion of flowchart 400 and system 500, as well as other structural and operational embodiments, will be apparent to those skilled in the art.

[0055] like Figure 4 As shown, the method in flowchart 400 begins at step 402, where additional configuration settings are received from the first virtual machine. For example, refer to... Figure 5 Configuration agent 524 may periodically provide management service 508 with requests 504 (or "check-in") for the latest or additional configuration settings (e.g., configuration setting 522). When additional configuration settings are available, management service 508 provides configuration agent 526 with a response 506 including the additional configuration settings. Configuration agent 524 applies the additional configuration settings to parent virtual machine 516, and if successful, provides configuration service 510 with an indication 530 stating that the additional configuration settings have been successfully applied to parent virtual machine 516. Configuration agent 526 also converts configuration setting 522 into a format suitable for application to multiple child virtual machines (e.g., WinDC) (denoted as configuration setting 522'), and provides the converted additional configuration settings (e.g., configuration setting 522') to configuration service 510.

[0056] In step 404, additional configuration settings are provided to the second virtual machine for use by the application. For example, refer to... Figure 5 Configuration service 510 provides (or broadcasts) configuration settings 522' to configuration agent 526 of each sub-virtual machine 518.

[0057] According to one or more embodiments, specific configurations designed for a particular sub-virtual machine are not suitable for global transfer to every instantiated sub-virtual machine. Examples of such configuration settings include, but are not limited to, certificates, virtual proxy network (VPN) settings, etc. Such configuration settings may be provided to the sub-virtual machines by a management service. For example, Figure 6A flowchart 600 depicts an example method, according to an example embodiment, for providing configuration settings specific to a particular subvirtual machine to a subvirtual machine. (Refer to...) Figure 7 The method of describing flowchart 600 is not limited to the implementation described therein. Figure 7 This is a block diagram illustrating, according to an exemplary embodiment, how to configure a subvirtual machine system 700 using configuration settings specifically for the subvirtual machine. (e.g.) Figure 7 As shown, system 700 includes cloud service platform 702, which is as described in the reference above. Figure 5 An example of the cloud service platform 502 described above. The cloud service platform 702 includes a management service 708, a configuration service 710, a virtual desktop service 712, and a host pool 714. The management service 708, configuration service 710, virtual desktop service 712, and host pool 714 are as described above. Figure 5 Examples of the management service 508, configuration service 510, virtual desktop service 512, and host pool 514 are provided. Management service 708 includes a compliance engine 720 and configuration settings 722, as described above. Figure 5 Examples of the compliance engine 520 and configuration settings 522 are provided. Management service 708 also includes sub-virtual machine-specific configuration settings 734. Configuration service 710 includes a result evaluator 728, which is as described above. Figure 5 An example of the result evaluator 528. Virtual desktop service 712 includes a handler 732, which is as described above. Figure 5 Example of the described process 532. Host pool 714 includes a parent virtual machine 716 and a first child virtual machine 718A and a second child virtual machine 728B, which are respectively referenced above. Figure 1 The example described is of a parent virtual machine 716 and (multiple) child virtual machines 518. The parent virtual machine 716 includes a configuration agent 724, and child virtual machines 718A and 718B respectively include configuration agents 726A and 726B, which are respectively as described in the reference above. Figure 5 Examples of configuration agents 524 and 526 are shown. Based on flowchart 600 and... Figure 7 The discussion of System 700, other structures and operational embodiments will be apparent to those skilled in the art.

[0058] like Figure 6 As shown, the method in flowchart 600 begins at step 602, receiving a second configuration request from the second virtual machine. For example, refer to... Figure 7Configuration agent 726A for sub-virtual machine 718A and configuration agent 716B for sub-virtual machine 728B respectively query (or "check in") management service 708 to determine whether sub-virtual machine-specific configuration settings are available for sub-virtual machine 708A and sub-virtual machine 718B. Each of configuration agents 726A and 728B can query management service 708 by sending corresponding configuration requests (i.e., configuration request 704A and configuration request 704B).

[0059] In step 604, a second set of configuration settings specific to the second virtual machine are provided to the second virtual machine. For example, refer to... Figure 7 Management service 708 can determine that a sub-virtual machine-specific configuration setting (e.g., configuration setting 734) is available for sub-virtual machine 718A but not for sub-virtual machine 718B. Therefore, management service 708A can provide sub-virtual machine 718A with a response 706A including sub-virtual machine-specific configuration setting 734, and send a response 708B to sub-virtual machine 718A indicating that the sub-virtual machine-specific configuration setting is unavailable. Configuration agent 726A of sub-virtual machine 718A can receive configuration setting 734 according to the SyncML format. Configuration agent 726A can convert such setting 734 to WinDC and use the converted configuration setting to configure sub-virtual machine 718A.

[0060] After configuration agent 726A applies configuration setting 734 on sub-virtual machine 726A, configuration agent 724A provides response 736 to configuration service 710, which indicates the result of applying the configuration settings thereon. For example, the result could indicate whether the application of configuration setting 734 was successful or failed.

[0061] The result evaluator 728 of the configuration service 710 is configured to analyze the received results to determine whether the configuration settings have been successfully applied to the sub-virtual machine 718A. Upon receiving a response 736 indicating that each configuration setting has been successfully applied 734, the result evaluator 728 of the configuration service 710 designates the sub-virtual machine 718A as being in a stable state (or healthy) and provides a notification 738 to the handler 732 of the virtual desktop service 712 that the sub-virtual machine is in a stable state.

[0062] If response 736 includes a result indicating that one or more configuration settings 734 were not successfully applied, then result evaluator 728 may determine that sub-virtual machine 718A is not in a stable state and provide a notification to handler 732 of virtual desktop service 712, indicating that sub-virtual machine 708A is not in a stable state. In response, virtual desktop service 712 may terminate sub-virtual machine 718A and / or instantiate a new sub-virtual machine.

[0063] According to one or more embodiments, a sub-virtual machine-specific configuration setting (e.g., sub-virtual computer-specific configuration setting 734) includes at least one of the following: a certificate to be applied by a second virtual machine (e.g., sub-virtual machine 718A) or a virtual agent network setting to be implemented by the second virtual machine.

[0064] III. Example Computer System Implementation

[0065] The systems and methods described above. Figures 1-7The illustrated embodiments can be implemented in hardware or hardware combined with one or more of software and / or firmware. For example, management service 108, compliance engine 120, configuration service 110, result evaluator 128, virtual desktop service 112, processor 132, parent virtual machine 116, configuration agent 124, (multiple) child virtual machines 118, configuration agent 126, computing device 104, virtual desktop application 130, management service 508, compliance engine 520, configuration service 510, result evaluator 528, virtual desktop service 512, processor 532, parent virtual machine 516, configuration agent 524, (multiple) child virtual machines 518, configuration agent 5 16. Management Service 708, Compliance Engine 720, Configuration Service 710, Result Evaluator 728, Virtual Machine Service 712, Processor 732, Parent Virtual Machine 716, Configuration Agent 724, Child Virtual Machine 718A, Configuration Agent 726A, Child Virtual Machine 718B and Configuration Agent 728B, and / or each component described therein, as well as flowcharts 200, 300, 400 and / or flowchart 600, may be implemented as computer program code / instructions configured to execute in one or more processors and stored in a computer-readable storage medium. Alternative locations: Management Service 108, Compliance Engine 120, Configuration Service 110, Result Evaluator 128, Virtual Desktop Service 112, Processor 132, Parent Virtual Machine 116, Configuration Agent 124, (multiple) Child Virtual Machines 118, Configuration Agent 126, Computing Device 104, Virtual Desktop Application 130, Management Service 508, Compliance Service 520, Configuration Service 510, Result Evaluator 528, Virtual Desktop Service 512, Processor 532, Parent Virtual Machine 516, Configuration Agent 5 24. (Multiple) sub-virtual machines 518, configuration agent 516, management service 708, compliance engine 720, configuration service 710, result evaluator 728, virtual machine service 712, handler 732, parent virtual machine 716, configuration agent 724, sub-virtual machine 718A, configuration agent 726A, sub-virtual machine 718B and configuration agent 728B and / or each component described herein, as well as flowcharts 200, 300, 400 and / or flowchart 600, may be implemented as hardware logic / circuit.In this embodiment, the components include: management service 108, compliance engine 120, configuration service 110, result evaluator 128, virtual desktop service 112, processor 132, parent virtual machine 116, configuration agent 124, (multiple) child virtual machines 118, configuration service 126, computing device 104, virtual desktop application 130, management service 508, compliance engine 520, configuration server 510, result evaluator 528, virtual desktop service 512, processor 532, parent virtual machine 516, and configuration agent 524. Multiple sub-virtual machines 518, configuration agent 516, management service 708, compliance engine 720, configuration service 710, result evaluator 728, virtual machine service 712, handler 732, parent virtual machine 716, configuration agent 724, sub-virtual machine 718A, configuration agent 726A, sub-virtual machine 718B, and configuration agent 728B, and / or each component described herein, as well as flowcharts 200, 300, 400, and / or flowchart 600, may be implemented in one or more SoCs (System-on-a-Chip). An SoC may include an integrated circuit chip that includes a processor (e.g., a central processing unit (CPU), microcontroller, microprocessor, digital signal processor (DSP), etc.), memory, one or more communication interfaces, and / or other circuitry, and may optionally execute received program code and / or include embedded firmware to perform functions.

[0066] Figure 8 An exemplary implementation of a computing device 800 in which embodiments can be implemented is depicted, including a management service 108, a compliance engine 120, a configuration service 110, a result evaluator 128, a virtual desktop service 112, a processor 132, a parent virtual machine 116, a configuration agent 124, (multiple) child virtual machines 118, a configuration agent 126, a computing device 104, a virtual desktop application 130, a management service 508, a compliance engine 520, a configuration service 510, a result evaluator 528, a virtual desktop service 512, and a processor 508. 32. Parent virtual machine 516, configuration agent 524, (multiple) child virtual machines 518, configuration agent 526, management service 708, compliance engine 720, configuration service 710, result evaluator 728, virtual desktop service 712, processor 732, parent virtual machine 716, configuration agent 724, child virtual machine 718A, configuration agent 716A, child virtual machine 718B, and configuration agent 726B, and / or each component described herein, as well as flowcharts 200, 300, 400, and / or flowchart 600. The description of the computing device 800 provided herein is for illustrative purposes and is not intended to be limiting. Embodiments may be implemented in other types of computer systems, as known to those skilled in the art.

[0067] like Figure 8As shown, computing device 800 includes one or more processors (referred to as processor circuitry 802), system memory 804, and a bus 806 coupling various system components (including system memory 804) to processor circuitry 802. Processor circuitry 802 is an electrical and / or optical circuit implemented as a central processing unit (CPU), microcontroller, microprocessor, and / or other physical hardware processor circuitry in one or more physical hardware circuitry elements and / or integrated circuit devices (semiconductor chip or die). Processor circuitry 802 can execute program code stored in a computer-readable medium, such as program code for operating system 830, application program 832, other programs 834, etc., and a processor or local bus using any of various bus architectures. System memory 804 includes read-only memory (ROM) 808 and random access memory (RAM) 810. Basic input / output system 812 (BIOS) is stored in ROM 808.

[0068] The computing device 800 also includes one or more of the following drives: a hard disk drive 814 for reading from and writing to a hard disk, a disk drive 816 for reading from or writing to a removable disk 818, and an optical disc drive 820 for reading from or writing to a removable optical disc 822, such as a CD-ROM, DVD-ROM, or other optical media. The hard disk drive 814, disk drive 816, and optical disc drive 820 are connected to the bus 806 via a hard disk drive interface 824, a disk drive interface 826, and an optical disc drive interface 828, respectively. The drives and their associated computer-readable media provide the computer with non-volatile storage of computer-readable instructions, data structures, program modules, and other data. Although hard disks, removable disks, and removable optical discs have been described, other types of hardware-based computer-readable storage media can be used to store data, such as flash memory cards, digital video discs, RAM, ROM, and other hardware storage media.

[0069] Many program modules can be stored on a hard disk, magnetic disk, optical disk, ROM, or RAM. These programs include an operating system 830, one or more application programs 832, other programs 834, and program data 836. Application programs 832 or other programs 834 may include, for example, computer program logic (e.g., computer program code or instructions) for implementing the system described above, including references. Figures 1-6 The device management and configuration examples described herein.

[0070] Users can input commands and information into computing device 800 using input devices such as keyboard 838 and pointing device 840. Other input devices (not shown) may include microphones, joysticks, gamepads, satellite dish antennas, scanners, touchscreens and / or touchpads, voice recognition systems for receiving voice input, gesture recognition systems for receiving gesture input, etc. These and other input devices are typically connected to processor circuitry 802 via serial port interface 842 coupled to bus 806, but may be connected via other interfaces such as parallel ports, game ports, or Universal Serial Bus (USB).

[0071] Display screen 844 is also connected to bus 806 via an interface (such as video adapter 846). Display screen 844 may be external to or incorporated into computing device 800. Display screen 846 may display information and is a user interface for receiving user commands and / or other information (e.g., via touch, finger gestures, virtual keyboard, etc.). In addition to display screen 844, computing device 800 may include other peripheral output devices (not shown), such as speakers and printers.

[0072] Computing device 800 is connected to network 848 (e.g., the Internet) via an adapter or network interface 850, modem 852, or other means for establishing communication on the network. Modem 852 can be internal or external, such as... Figure 8 As shown, it can be connected to bus 806 via serial port interface 842, or it can be connected to bus 816 using another interface type (including parallel interface).

[0073] As used herein, the terms “computer program medium,” “computer-readable medium,” and “computer-readable storage medium” generally refer to physical hardware media (such as hard disks associated with hard disk drives 814, removable disks 818, and removable optical disks 822), other physical hardware media (such as RAM, ROM, flash memory cards, digital video disks, zip disks, MEM, nanotechnology-based storage devices), and other types of physical / tangible hardware storage media (including…). Figure 8 The system memory 804). This computer-readable storage medium is different from and does not overlap with (excluding) the communication medium. The communication medium typically embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave. The term "modulated data signal" refers to a signal whose one or more characteristics are set or altered in a manner that encodes information in the signal. By way of example and not limitation, the communication medium includes wireless media (such as acoustic, RF, infrared, and other wireless media) as well as wired media. The embodiments also relate to such communication media.

[0074] As described above, computer programs and modules (including application program 832 and other programs 834) can be stored on a hard disk, magnetic disk, optical disk, ROM, RAM, or other hardware storage medium. Such computer programs can also be received via network interface 850, serial port interface 852, or any other interface type. When executed or loaded by an application, such computer programs enable computing device 800 to implement the features of the embodiments discussed herein. Therefore, such computer programs represent the controller of computing device 800.

[0075] The embodiments also relate to computer program products that include computer code or instructions stored on any computer-readable medium. Such computer program products include hard disk drives, optical disk drives, storage device packages, memory sticks, memory cards, and other types of physical storage hardware.

[0076] IV. Other Exemplary Examples

[0077] This document describes a method performed by a configuration service for bypassing the mobile device manager during the configuration of a sub-virtual machine. The method includes: receiving multiple configuration settings applied by the mobile device manager to a first virtual machine instantiated by a cloud-based service; providing a notification to the cloud-based service indicating that the service is permitted to instantiate a second virtual machine, which is a sub-computer of the first virtual machine; receiving a configuration request from the second virtual machine; and providing the multiple configuration settings applied to the first virtual machine to the second virtual machine for application.

[0078] In an embodiment of the method, providing notification to the cloud-based service includes: receiving an indication that the parent virtual machine has been successfully configured according to the configuration settings; and providing notification to the cloud-based service in response to receiving the indication.

[0079] In an embodiment of the method, the method further includes: receiving additional configuration settings from a first virtual machine; and providing the additional configuration settings to a second virtual machine for use in an application.

[0080] In an embodiment of the method, the method further includes: the cloud-based service is a virtual desktop application platform as a service.

[0081] In embodiments of the method, the multiple configuration settings include at least one of the following: security settings implemented by the first virtual machine; network settings implemented by the first virtual machine; encryption settings implemented by the first virtual machine; or application behavior settings implemented by the first virtual machine.

[0082] In an embodiment of the method, the second virtual machine is configured to apply filtering rules to multiple configuration settings to determine a subset of configuration settings applicable to the second virtual machine.

[0083] In an embodiment of this method, the filtering rules are provided to the second virtual machine by a cloud-based service.

[0084] This document also describes a system for bypassing a mobile device manager during the configuration of a sub-virtual machine. The system includes: one or more servers, each of the one or more servers including at least one processor circuitry and memory, the memory storing instructions for execution by the at least one processor circuitry to configure the one or more servers to perform operations, a configuration service configured to: receive a plurality of configuration settings applied by the mobile device manager to a first virtual machine instantiated by a cloud-based service; provide a notification to the cloud-based service indicating that the cloud-based service is permitted to instantiate a second virtual machine, the second virtual machine being a sub-computer of the first virtual machine; receive a configuration request from the second virtual machine; and provide the plurality of configuration settings applied to the first virtual machine to the second virtual machine for application.

[0085] In an embodiment of the system, the configuration service is further configured to: receive an indication that the parent virtual machine has been successfully configured according to the configuration settings; and in response to receiving the indication, provide a notification to the cloud-based service.

[0086] In an embodiment of the system, the configuration service is further configured to: receive additional configuration settings from a first virtual machine; and provide the additional configuration settings to a second virtual machine for use by the application.

[0087] In a system implementation, the cloud-based service is a virtual desktop application platform that serves as a service.

[0088] In an embodiment of the system, the multiple configuration settings include at least one of the following: security settings implemented by the first virtual machine; network settings implemented by the first virtual machine; encryption settings implemented by the first virtual machine; or application behavior settings implemented by the first virtual machine.

[0089] In an embodiment of the system, the second virtual machine is configured to apply filtering rules to multiple configuration settings to determine a subset of configuration settings applicable to the second virtual computer.

[0090] In one embodiment of the system, the filtering rules are provided to the second virtual machine by a cloud-based service.

[0091] In one embodiment of the system, one or more servers further include a mobile device manager configured to: receive a second configuration request from a second virtual machine; and provide the second virtual machine with a second plurality of configuration settings specific to the second virtual machine.

[0092] In an embodiment of the system, the second plurality of configuration settings include at least one of the following: a certificate to be applied by the second virtual machine; or virtual proxy network settings implemented by the second virtual machine.

[0093] A computer-readable storage medium having program instructions recorded thereon, which, when executed by at least one processor of a computing device, are executed by a configuration service for bypassing a mobile device manager during the configuration of a sub-virtual machine. The method includes: receiving a plurality of configuration settings applied by the mobile device manager to a first virtual machine instantiated by a cloud-based service; providing a notification to the cloud-based service indicating that the cloud-based service is permitted to instantiate a second virtual machine, the second virtual machine being a sub-virtual machine of the first virtual machine; receiving a configuration request from the second virtual machine; and providing the plurality of configuration settings applied to the first virtual machine to the second virtual machine for application.

[0094] In embodiments using computer-readable storage media, providing notification to a cloud-based service includes: receiving an indication that a parent virtual machine has been successfully configured according to configuration settings; and providing notification to the cloud-based service in response to receiving the indication.

[0095] In an embodiment using a computer-readable storage medium, the method further includes: receiving additional configuration settings from a first virtual machine; and providing the additional configuration settings to a second virtual machine for use in an application.

[0096] In embodiments using computer-readable storage media, the cloud-based service is a virtual desktop application platform as a service.

[0097] V. Conclusion

[0098] Although various embodiments have been described above, it should be understood that they are presented by way of example only and not as limitations. It will be apparent to those skilled in the art that various changes in form and detail may be made without departing from the spirit and scope of the embodiments. Therefore, the breadth and scope of the embodiments should not be limited by any of the exemplary embodiments described above, but should be defined only by the following claims and their equivalents.

Claims

1. A method performed by a configuration service for bypassing a mobile device manager during the configuration of a sub-virtual machine, comprising: Receive multiple configuration settings, which are applied by the mobile device manager to a first virtual machine instantiated by a cloud-based service; A notification is provided to the cloud-based service, indicating that the cloud-based service is permitted to instantiate a second virtual machine, the second virtual machine being a child of the first virtual machine; Receive a configuration request from the second virtual machine; as well as The plurality of configuration settings applied to the first virtual machine are provided to the second virtual machine for application.

2. The method of claim 1, wherein providing the notification to the cloud-based service comprises: Receive an indication that the first virtual machine has been successfully configured according to the configuration settings; as well as In response to receiving the instruction, the notification is provided to the cloud-based service.

3. The method according to claim 1, further comprising: Receive additional configuration settings from the first virtual machine; as well as The additional configuration settings are provided to the second virtual machine for use in the application.

4. The method according to claim 1, wherein the cloud-based service is a virtual desktop application platform as a service.

5. The method of claim 1, wherein the plurality of configuration settings include at least one of the following: Security settings implemented by the first virtual machine; Network settings implemented by the first virtual machine; The encryption settings implemented by the first virtual machine; or Application behavior settings implemented by the first virtual machine.

6. The method of claim 1, wherein the second virtual machine is configured to apply filtering rules to the plurality of configuration settings to determine a subset of configuration settings applicable to the second virtual machine.

7. The method of claim 6, wherein the filtering rules are provided to the second virtual machine by the cloud-based service.

8. A system for bypassing a mobile device manager during the configuration of a sub-virtual machine, comprising: One or more servers, each of the one or more servers including at least one processor circuit and a memory, the memory storing instructions for execution by the at least one processor circuit to configure the one or more servers to perform operations, the one or more servers including a configuration service configured to: Receive multiple configuration settings, which are applied by the mobile device manager to a first virtual machine instantiated by a cloud-based service; A notification is provided to the cloud-based service, indicating that the cloud-based service is permitted to instantiate a second virtual machine, the second virtual machine being a child of the first virtual machine; Receive a configuration request from the second virtual machine; as well as The plurality of configuration settings applied to the first virtual machine are provided to the second virtual machine for application.

9. The system of claim 8, wherein the configuration service is further configured to: Receive an indication that the first virtual machine has been successfully configured according to the configuration settings; and In response to receiving the instruction, the notification is provided to the cloud-based service.

10. The system of claim 8, wherein the configuration service is further configured to: Receive additional configuration settings from the first virtual machine; and The additional configuration settings are provided to the second virtual machine for use in the application.

11. The system of claim 8, wherein the cloud-based service is a virtual desktop application platform as a service.

12. The system of claim 8, wherein the plurality of configuration settings include at least one of the following: Security settings implemented by the first virtual machine; Network settings implemented by the first virtual machine; The encryption settings implemented by the first virtual machine; or Application behavior settings implemented by the first virtual machine.

13. The system of claim 8, wherein the second virtual machine is configured to apply filtering rules to the plurality of configuration settings to determine a subset of configuration settings applicable to the second virtual machine.

14. The system of claim 13, wherein the filtering rules are provided to the second virtual machine by the cloud-based service.

15. The system of claim 8, wherein the one or more servers further include the mobile device manager, the mobile device manager being configured to: Receive a second configuration request from the second virtual machine; and Provide the second virtual machine with a second set of configuration settings specific to the second virtual machine.

16. The system of claim 15, wherein the second plurality of configuration settings includes at least one of the following: The certificate must be obtained from the second virtual machine application; or The virtual agent network settings to be implemented by the second virtual machine.

17. A computer-readable storage medium having program instructions recorded thereon, the program instructions, when executed by at least one processor of a computing device, performing a method executed by a configuration service for bypassing a mobile device manager during the configuration of a sub-virtual machine, the method comprising: Receive multiple configuration settings, which are applied by the mobile device manager to a first virtual machine instantiated by a cloud-based service; A notification is provided to the cloud-based service, indicating that the cloud-based service is permitted to instantiate a second virtual machine, the second virtual machine being a child of the first virtual machine; Receive a configuration request from the second virtual machine; as well as The plurality of configuration settings applied to the first virtual machine are provided to the second virtual machine for application.

18. The computer-readable storage medium of claim 17, wherein providing the notification to the cloud-based service comprises: Receive an indication that the first virtual machine has been successfully configured according to the configuration settings; as well as In response to receiving the instruction, the notification is provided to the cloud-based service.

19. The computer-readable storage medium of claim 17, further comprising: Receive additional configuration settings from the first virtual machine; as well as The additional configuration settings are provided to the second virtual machine for use in the application.

20. The computer-readable storage medium of claim 17, wherein the cloud-based service is a virtual desktop application platform as a service.

Images