Method and device for controlling remote access to virtual desktop resources

Abstract

The present invention discloses a method and apparatus for remote access control of virtual desktop resources, wherein the method comprises: receiving a user's access request through a unified access gateway; dynamically assigning a first virtual desktop agent to the user based on the status information of each virtual desktop agent, and obtaining an identifier of the first virtual desktop agent; establishing a connection between the unified access gateway and the first virtual desktop agent according to the identifier; utilizing the first virtual desktop agent to respond to the access request, and returning the response result through the unified access gateway. The above technical solution adds a registration and allocation step to the existing components and interaction logic of the virtual desktop system. Without destroying the existing components and logic, the above technical solution enables the client to connect to the remote virtual desktop resource through the display protocol. Even if the virtual desktop resource service in service fails, other desktop resources can be obtained to continue providing services, thereby significantly improving the user experience.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud services, and in particular to a method and device for remote access control of virtual desktop resources. Background Art

[0002] Cloud desktop products allow users to access personalized virtual desktop services from smart terminals such as laptops, home PCs, or thin clients. For example, VMware is a leading platform for desktop and application virtualization. While ensuring corporate data compliance and secure storage in local data centers or the cloud (such as mobile cloud providers), it provides a consistent user experience across devices, locations, and networks.

[0003] When users access virtual desktop resources through an external network environment, there are two main phases: initial authentication and session connection. The authentication phase is from the Unified Access Gateway (UAG) to the connection server, based on the HTTPS protocol. The connection server returns user identity information, including verification, authorization, and session management information. The session connection phase is when the client connects to the agent service in the specific desktop virtual machine through the remote desktop display protocol and maintains the session using the remote desktop.

[0004] During the session connection phase, if a virtual desktop resource proxy service process freezes for some reason or stops listening on the port, the client will be unable to log in and use the service. In this case, operations personnel will need to restart, troubleshoot, or even reassign a new proxy service. Furthermore, even if operations personnel manually intervene to resolve the issue, it will still have a significant negative impact on the user experience. Summary of the Invention

[0005] In view of the above problems, the present invention is proposed to provide a method and apparatus for remote access control of virtual desktop resources that overcome the above problems or at least partially solve the above problems.

[0006] According to one aspect of the present invention, a method for remote access control of virtual desktop resources is provided, the method comprising:

[0007] Receive user access requests through the unified access gateway;

[0008] dynamically allocating a first virtual desktop agent to the user based on status information of each virtual desktop agent, and obtaining an identifier of the first virtual desktop agent;

[0009] establishing a connection between the unified access gateway and the first virtual desktop agent according to the identifier;

[0010] The first virtual desktop agent is used to respond to the access request, and a response result is returned through the unified access gateway.

[0011] Optionally, dynamically allocating a first virtual desktop agent to a user based on status information of each virtual desktop agent includes:

[0012] Get information about the availability and load of each virtual desktop agent;

[0013] Determine a range of virtual desktop agents to be selected for the access request according to the availability and load information;

[0014] For users with intensive access requests, multiple different virtual desktop agents are assigned; and / or, for the access requests, virtual desktop agents are assigned in order of load from small to large.

[0015] Optionally, dynamically allocating a first virtual desktop agent to a user based on status information of each virtual desktop agent includes:

[0016] Building a distributed election service, and using the distributed election service to elect a first virtual desktop agent;

[0017] The first virtual desktop agent is assigned to the user.

[0018] Optionally, build a distributed election service, including:

[0019] Configuring meta-information of a distributed election service, the meta-information including at least one of the following: term number, voting target node identifier, voting target node port number, or candidate node address list;

[0020] Establish a task log for users connecting to the virtual desktop agent;

[0021] Generate user status snapshots for rapid service restoration when replacing virtual desktop agents;

[0022] The distributed election service is constructed by taking each virtual desktop agent as a service node and based on the Raft protocol, the meta information, the task log and the user status snapshot.

[0023] Optionally, configure metadata for the distributed election service, including:

[0024] Create a meta information instance based on the meta information path and the status of each service node;

[0025] Loading the configuration information of the meta-information for the meta-information instance, and forming a storage message of the meta-information instance based on the current term and node voting status based on the message mechanism;

[0026] According to the storage message of the meta-information instance, the meta-information instance is stored for calling by the distributed election service.

[0027] Optionally, establish a task log for user connections to the Virtual Desktop Agent, including:

[0028] Initialize the log storage instance and save the log instance based on the embedded storage engine;

[0029] When electing a service node, perform any of the following log management tasks: designing a log index, saving log instances and terms, adding, deleting, modifying, and checking log instances, clearing log instances, or resetting the log term index.

[0030] Optionally, a user status snapshot is generated, including:

[0031] Record user state machine information through operations such as creating snapshot writers, remotely copying data, and configuring snapshot properties;

[0032] The latest state image file of the current user state machine is updated in time to form a user state snapshot, so that the image file can be directly loaded when the service node is restarted.

[0033] According to another aspect of the present invention, a device for controlling remote access to virtual desktop resources is provided, the device comprising:

[0034] A receiving module, adapted to receive a user's access request through a unified access gateway;

[0035] an allocation module adapted to dynamically allocate a first virtual desktop agent to a user based on status information of each virtual desktop agent and obtain an identifier of the first virtual desktop agent;

[0036] a connection module, adapted to establish a connection between the unified access gateway and the first virtual desktop agent according to the identifier;

[0037] The response module is adapted to respond to the access request by using the first virtual desktop agent and return a response result through the unified access gateway.

[0038] According to another aspect of the present invention, a virtual desktop server is provided, the virtual desktop server comprising: a unified access gateway, an agent registration center, a virtual desktop agent resource, a connection server and an AD domain control server;

[0039] The connection server and the AD domain control server are used to authenticate the user through the agent registration center, so that the user establishes a session connection between the client, the unified access gateway, the agent registration center and the virtual desktop agent resource through the display protocol;

[0040] The virtual desktop server executes operations corresponding to any one of the above methods for controlling remote access to virtual desktop resources.

[0041] According to another aspect of the present invention, a computer storage medium is provided, wherein the storage medium stores at least one executable instruction, wherein the executable instruction enables a processor to execute operations corresponding to the above-mentioned method for remote access control of virtual desktop resources.

[0042] The present invention, based on the existing virtual desktop service protocol architecture, introduces a registration and allocation mechanism to achieve a novel high-availability architecture for desktop virtual resources. This architecture supports smooth access to connection services and unified access gateway services without changing the existing structure and interaction logic. Furthermore, once a client connects to a remote resource via a display protocol, even if the virtual machine resource service in the current connection fails and becomes unavailable, the client can automatically obtain available desktop resources to maintain continuous service, significantly improving the user experience.

[0043] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are specifically listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present invention. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0045] Figure 1 A flow chart of a method for remote access control of virtual desktop resources provided by an embodiment of the present invention is shown;

[0046] Figure 2 A flowchart of constructing and storing metadata provided by an embodiment of the present invention is shown;

[0047] Figure 3 A flowchart of user connection log storage and scheduling provided by an embodiment of the present invention is shown;

[0048] Figure 4 A flowchart illustrating implementation, storage, and scheduling of user status snapshots provided by an embodiment of the present invention is shown;

[0049] Figure 5 A schematic diagram showing the structure of a device for controlling remote access to virtual desktop resources provided by an embodiment of the present invention is shown;

[0050] Figure 6 A schematic diagram of the structure of a virtual desktop server provided by an embodiment of the present invention is shown;

[0051] Figure 7 A schematic diagram of the structure of a remote access framework provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0052] Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0053] Figure 1 The flowchart of the embodiment of the method for remote access control of virtual desktop resources of the present invention is shown. The method is applied to the server of virtual desktop resources, such as VMware platform architecture. Figure 1 As shown, the method includes the following steps:

[0054] Step 110: Receive the user's access request through the unified access gateway.

[0055] Among them, when users access virtual desktop resources through clients such as PCs, laptops, and smart phones, the server can receive access requests through the unified access gateway. The unified access gateway (Unified Access Gateway, UAG) is used as the only exit for exposing services and has security control, proxy access and other capabilities. Of course, the gateway can also be implemented through other gateway structures, and no specific restrictions are made in this embodiment.

[0056] Step 120: Based on the status information of each virtual desktop agent, dynamically allocate a first virtual desktop agent to the user and obtain an identifier of the first virtual desktop agent.

[0057] Step 130: Establish a connection between the unified access gateway and the first virtual desktop agent according to the identifier.

[0058] In this step, by registering and managing each virtual desktop agent and user configuration, dynamic matching between user access and virtual desktop agents can be achieved as needed. In particular, when the virtual desktop agent being connected fails or is overloaded and affects performance, its access can be automatically switched to the first virtual desktop agent that can provide normal services without the user's awareness.

[0059] Step 140: Utilize the first virtual desktop agent to respond to the access request, and return a response result through the unified access gateway.

[0060] After performing operations such as calculation on the access request, the first virtual desktop agent may return the access request to the client terminal through the unified access gateway.

[0061] In summary, after the agent registration and allocation steps are introduced in this embodiment, the virtual desktop agent registers the user configuration information and the virtual desktop agent when providing external services. For example, after the client connects to the UAG gateway, the identifier of the first virtual desktop agent serving it is determined after registration and allocation, and then the client is routed to the first virtual desktop agent resource according to the identifier to provide services.

[0062] In a preferred embodiment, step 120 dynamically assigns a first virtual desktop agent to a user based on status information of each virtual desktop agent, including: obtaining information on the availability and load of each virtual desktop agent; determining a range of virtual desktop agents to be selected for the access request based on the information; assigning multiple different virtual desktop agents to users with frequent access requests; or, assigning virtual desktop agents in order of load from lightest to heaviest.

[0063] In particular, in this preferred embodiment, in addition to performing security control and proxy access, the unified access gateway also implements the ability to balance the load of the client, and can evenly implement the access requests of each client. For example, for clients with intensive access requests, multiple different virtual desktop agents can be assigned to calculate the responses, thereby achieving client load balancing (Load Balance).

[0064] Of course, the virtual desktop agents may also be allocated in order of the load of each virtual desktop agent from small to large, thereby achieving load balancing on the server side.

[0065] It should be pointed out that, combined with Figure 7 As shown, in some virtual desktop resource platforms, client-to-gateway access is typically achieved through display protocols. Display protocols are a key area of ​​competition for desktop virtualization vendors, as protocol efficiency determines the user experience of virtual desktops. For example, Microsoft uses the RDP protocol, Citrix uses the ICA protocol, VMware has developed its own PCoIP protocol, and Red Hat has released the SPICE protocol.

[0066] In one or some embodiments, step 120 further includes: building a distributed election service, and utilizing the distributed election service to elect the first virtual desktop agent.

[0067] Specifically, this step enables unified scheduling and management of the UAG gateway service and the virtual desktop agent services in the desktop pool. The UAG gateway also discovers all virtual desktop agent services and implements dynamic proxying through dynamic allocation. Furthermore, through the dynamic allocation function of registration and distributed election services, virtual desktop agents can also discover each other, enabling direct communication between agents.

[0068] Preferably, after determining the first virtual desktop agent, a connection is established between the user's client, the unified access gateway and the first virtual desktop agent according to the identifier of the first virtual desktop agent, and data transmission and communication are performed through Google Remote Procedure Calls (GRPC) and Protobuf data standards.

[0069] In one or some embodiments, building a distributed election service includes:

[0070] Configuring meta-information of a distributed election service, the meta-information including at least one of the following: term number, voting target node identifier, voting target node port number, or candidate node address list;

[0071] Establish a task log for users connecting to the virtual desktop agent;

[0072] Generate user status snapshots for rapid service restoration when replacing virtual desktop agents;

[0073] The distributed election service is constructed based on the meta information, the task log and the user status snapshot, with each virtual desktop agent as a service node.

[0074] Specifically, the determination of the first virtual desktop agent is preferably implemented by a distributed election service based on the Raft protocol, wherein the key steps include metadata design and storage, log design and storage, snapshot design and storage, and transmission methods such as heartbeat, metadata log, election information, and user snapshots.

[0075] It should be pointed out that the Raft protocol is a widely used distributed protocol in engineering that features strong consistency, decentralization, and high availability. Raft is a consensus algorithm. Consensus means that multiple nodes reach a consensus on a certain issue, even in the event of partial node failure, network delay, or network partition.

[0076] The Raft protocol of this embodiment defines the following concepts: Leader: The node that provides services (generates and writes logs). There can only be one leader in a Raft system at any time, and all nodes start in follower state. If a node does not receive a heartbeat from the leader for a period of time, it switches from follower to candidate state and initiates an election. If it receives a majority of votes (including its own), it switches to leader state. If it finds that another node is newer than itself, it proactively switches to follower state. The leader continuously sends heartbeat messages to followers to indicate its survival status. If the leader fails, the follower transitions to candidate state and a new leader is elected. Each new term is called a term, and the corresponding term is called a term. TermId is the term number. Time is divided into terms, and a new termId is generated after each election. There is only one leader in a term. The Raft protocol also includes mechanisms such as RequestVote, AppendEntries, and the leader sending logs and heartbeats.

[0077] In a preferred embodiment, configuring the metadata of a distributed election service includes: creating a metadata instance based on the metadata path and the status of each service node; loading the configuration information of the metadata for the metadata instance, and based on a message mechanism, forming a storage message of the metadata instance according to the current term and node voting status; storing the metadata instance according to the storage message of the metadata instance for call by the distributed election service.

[0078] Meta information is used to record the internal state of the Raft protocol implementation, such as the current term number and information about the agent node voting for the target agent, including the node IP address, port number, and backup node IP address list. Initialization of meta information creates an AgentInfo type metadata storage by default based on its storage path, configuration, and agent node monitoring. This type can be implemented based on the ProtoBuf message storage mechanism.

[0079] See Figure 2In the interactive response process shown, the above mechanism includes three nodes: metadata factory, metadata, and metadata storage. Among them, the metadata factory AgentInfoFactory is used to: be mainly responsible for the initialization of metadata and scheduling node monitoring, and create AgentInfo metadata instances by default according to the metadata path and different node monitoring; after the metadata operation is completed, it is responsible for the recovery of the metadata instance. Meta-information AgentInfo is used to: load the metadata storage configuration information according to the metadata storage configuration information, including the current term Term and Agent node vote to construct the metadata storage message AgentInfoStorage, set, allocate, and query the message, and refresh it to the memory and write it to the ProtoBufFile file after the operation is completed. Meta-information storage AgentInfoStorage is used for: local storage based on ProtoBuf Message, responsible for the maintenance of metadata such as metadata storage path, configuration, and nodes.

[0080] In one embodiment, establishing a task log of a user connecting to a virtual desktop agent includes:

[0081] Initialize the log storage instance and save the log instance based on the embedded storage engine; when electing a service node, execute any of the following log management items: design log index, save log instance and term, add, delete, modify and check log instance, clear log instance or reset log term index.

[0082] This embodiment is primarily used for the design, storage, and scheduling of connection task logs, thus providing a basis for obtaining log snapshots. Specifically, it includes saving log information for each Raft grouping node and performing operations such as log indexing, log instances and terms, adding, deleting, modifying, and checking log instances, clearing log instances, and resetting log term indexes.

[0083] The preferred storage engine is RocksDB, an embedded storage engine based on the open-source LSM-Tree data structure. RocksDB is an embeddable key-value store system from Facebook that supports persistence and can also be used as a storage database in a client / server model. The log storage factory is initialized based on the node log storage path and whether asynchronous configuration is enabled. By default, a log storage object is created. This object organizes all data sequentially, including functions such as retrieving data instances by index, inserting data, and deleting data.

[0084] The log scheduling management is mainly used to call the underlying log storage module, cache, batch submit, and related inspection and optimization for its call. The main process of log storage and scheduling can be found in Figure 3 shown.

[0085] In a preferred embodiment, since users frequently perform tasks on the virtual machine VM, each time a user task is submitted, the state data of the state machine in memory needs to be recorded, which is unsustainable for storage; if the VM is restarted, the content user state data will be lost, and the restart process will re-acquire all logs to rebuild the entire state machine instance, which is a long process and slow to start; in addition, if a new node virtual machine is added, the new node needs to obtain all logs from the Raft Leader node and re-acquire them to the state machine, which increases the burden on network bandwidth. Therefore, a snapshot module is introduced. Specifically, it includes: recording user state machine and user information by creating a snapshot writer, remotely copying data, and configuring snapshot properties, and incrementally saving and updating the latest state image file of the current user state machine, so that the image file can be directly loaded when the virtual machine is restarted.

[0086] See also Figure 4 As shown, snapshots of user or service node state image files are an effective way to achieve rapid migration of virtual desktop services. They are mainly used to record the state machine and user metadata of VM users, incrementally save the latest state image of the current state machine, and reduce log storage usage; the latest image is directly loaded at startup.

[0087] Specific snapshot creation, storage, and scheduling functions include: creating a snapshot writer, remote URI copying data, remote copy task maintenance, configuring snapshot properties such as disk read / write, network bandwidth, etc., storing the virtual machine state of the Raft service node, copying the image file to install the snapshot, notifying each Raft service node to publish the state transition type task event to the message queue, triggering the snapshot saving task through the ring buffer, and storing various types of state machine snapshots. In particular, the storage of the virtual machine state of the Raft service node, remote or local snapshot installation, copying of image files, as well as state machine snapshot synchronization and snapshot installation are achieved through scheduling management.

[0088] Figure 5 FIG. 1 shows a schematic diagram of a structure of an embodiment of a device for controlling remote access to virtual desktop resources according to the present invention. Figure 5 As shown, the apparatus 500 includes:

[0089] Receiving module 510, adapted to receive a user's access request via a unified access gateway;

[0090] an allocation module 520 adapted to dynamically allocate a first virtual desktop agent to the user based on the status information of each virtual desktop agent, and obtain an identifier of the first virtual desktop agent;

[0091] a connection module 530 adapted to establish a connection between the unified access gateway and the first virtual desktop agent according to the identifier;

[0092] The response module 540 is adapted to respond to the access request by using the first virtual desktop agent and return a response result through the unified access gateway.

[0093] In summary, after the allocation module 520 is introduced in this embodiment, all virtual desktop agents can register first if they want to provide services externally. Client access is performed through the service gateway and then routed to the corresponding virtual desktop agent service for interactive access. After the client connects to the UAG gateway, it can determine the identifier of the first virtual desktop agent serving it after centralized registration and allocation, and then route it to the available virtual desktop resources to provide services based on the identifier.

[0094] In one embodiment, the allocation module 520 is further adapted to:

[0095] Get information about the availability and load of each virtual desktop agent;

[0096] determining a range of virtual desktop agents to be selected for the access request based on the information;

[0097] For users with intensive access requests, multiple different virtual desktop agents are allocated; and / or, for the access requests, virtual desktop agents are allocated in order from lightest to most load.

[0098] In one embodiment, the allocation module 520 is further adapted to:

[0099] Building a distributed election service, and using the distributed election service to elect a first virtual desktop agent;

[0100] The first virtual desktop agent is assigned to the user.

[0101] Optionally, a distributed election service is constructed in the allocation module 520, including:

[0102] Configuring meta-information of a distributed election service, the meta-information including at least one of the following: term number, voting target node identifier, voting target node port number, or candidate node address list;

[0103] Establish a task log for users connecting to the virtual desktop agent;

[0104] Generate user status snapshots for rapid service restoration when replacing virtual desktop agents;

[0105] The distributed election service is formed based on the meta information, the task log and the user status snapshot, with each virtual desktop agent as a service node.

[0106] In one embodiment, configuring the metadata of the distributed election service includes:

[0107] Create a meta information instance based on the meta information path and the status of each service node;

[0108] Loading the configuration information of the meta-information for the meta-information instance, and forming a storage message of the meta-information instance based on the current term and node voting status based on the message mechanism;

[0109] According to the storage message of the meta-information instance, the meta-information instance is stored for calling by the distributed election service.

[0110] In one embodiment, establishing a task log of a user connecting to a virtual desktop agent includes:

[0111] Initialize the log storage instance and save the log instance based on the embedded storage engine;

[0112] When electing a service node, perform any of the following log management tasks: designing a log index, saving log instances and terms, adding, deleting, modifying, and checking log instances, clearing log instances, or resetting the log term index.

[0113] In one embodiment, forming a user status snapshot includes:

[0114] Record user state machine information through operations such as creating snapshot writers, remotely copying data, and configuring snapshot properties;

[0115] The latest state image file of the current user state machine is updated in time to form a user state snapshot, so that the image file can be directly loaded when the service node is restarted.

[0116] Figure 6 The schematic diagram of the structure of the virtual desktop server embodiment of the present invention is shown. The specific embodiment of the present invention does not limit the specific implementation of the virtual desktop server.

[0117] Combine Figure 6 The structure of the virtual desktop server shown in the figure includes: a unified access gateway, an agent registration center, virtual desktop agent resources (desktop pool), a connection server and an AD domain control server.

[0118] Specifically, if a user needs to connect to a remote desktop through a client, it is usually done through the unified access gateway UAG. The initial authentication stage of the connection is from the client to UAG, through the agent registration center, and then to the connection server; the connection server authenticates the user through the AD domain control server and returns the user's authorization resources to the agent registration center; the user uses the display protocol from the client to UAG, and then through the agent registration center to the remote virtual desktop agent resource to establish a session connection. The specific remote access framework is as follows Figure 7 As shown, its Figure 7The DMZ (demilitarized zone) is a buffer zone between non-secure systems and secure systems to solve the problem that users from the external network cannot access internal network servers after the firewall is installed.

[0119] Furthermore, the virtual desktop server disclosed in this embodiment performs operations corresponding to the virtual desktop resource remote access control method in any of the above embodiments, thereby achieving load balancing and dynamic switching of proxy services through the proxy registration center without the user noticing, thereby improving the user experience.

[0120] Another embodiment of the present invention provides a non-volatile computer storage medium storing at least one executable instruction. The computer executable instruction can execute the method for remote access control of virtual desktop resources in any of the above method embodiments.

[0121] The algorithm or demonstration provided herein are not inherently relevant to any particular computer, virtual system or other equipment. Various general-purpose systems may also be used together with the teachings based on this. According to the above description, it is apparent that the structure required for constructing this type of system. In addition, the embodiment of the present invention is not directed to any specific programming language yet. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the above description of specific languages ​​is for the purpose of disclosing the best mode of the present invention.

[0122] In the description provided herein, numerous specific details are described. However, it is understood that embodiments of the present invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of this description.

[0123] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the invention, various features of the embodiments of the invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Accordingly, the claims that follow the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of the invention.

[0124] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition may be divided into multiple submodules or subunits or subcomponents. All features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed herein may be combined in any combination, except that at least some of such features and / or processes or units are mutually exclusive. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0125] Furthermore, those skilled in the art will appreciate that although some embodiments herein include certain features included in other embodiments but not other features, combinations of features from different embodiments are intended to be within the scope of the present invention and to form different embodiments. For example, in the claims below, any of the claimed embodiments may be used in any combination.

[0126] The various component embodiments of the present invention may be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will appreciate that in practice, a microprocessor or digital signal processor (DSP) may be used to implement some or all of the functionality of some or all of the components according to the embodiments of the present invention. The present invention may also be implemented as a device or apparatus program (e.g., a computer program or computer program product) for performing part or all of the methods described herein. Such a program implementing the present invention may be stored on a computer-readable medium or in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form. It should be noted that the above-described embodiments illustrate rather than limit the present invention, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in the claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of distinct elements, as well as by means of a suitably programmed computer. In a unit claim that enumerates several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not denote any order. These words should be interpreted as names. Unless otherwise specified, the steps in the above embodiments should not be construed as limiting the order of execution.

Claims

1. A method for controlling remote access to virtual desktop resources, the method comprising: Receive user access requests through the unified access gateway; Based on the status information of each virtual desktop agent, a first virtual desktop agent is dynamically assigned to the user, and an identifier of the first virtual desktop agent is obtained; availability and load information of each virtual desktop agent are obtained; a range of virtual desktop agents to be selected for the access request is determined based on the availability and load information; for users with frequent access requests, multiple different virtual desktop agents are assigned; and / or, for the access requests, virtual desktop agents are assigned in order from least to most load; Establishing a connection between the unified access gateway and the first virtual desktop agent based on the identifier; wherein, when providing external services, the virtual desktop agent registers the user configuration information and the virtual desktop agent, and after the client connects to the unified access gateway, determines the identifier of the first virtual desktop agent serving it after registration and allocation, and then routes the client to the first virtual desktop agent resource based on the identifier to provide services; The first virtual desktop agent is used to respond to the access request, and a response result is returned through the unified access gateway.

2. The method according to claim 1, characterized in that Dynamically allocating a first virtual desktop agent to a user based on status information of each virtual desktop agent includes: Building a distributed election service, and using the distributed election service to elect a first virtual desktop agent; The first virtual desktop agent is assigned to the user.

3. The method according to claim 2, characterized in that Build distributed election services, including: Configuring meta-information of a distributed election service, the meta-information including at least one of the following: term number, voting target node identifier, voting target node port number, or candidate node address list; Establish a task log for users connecting to the virtual desktop agent; Generate user status snapshots for rapid service restoration when replacing virtual desktop agents; The distributed election service is constructed based on the meta information, the task log and the user status snapshot, with each virtual desktop agent as a service node.

4. The method according to claim 3, characterized in that Configure the metadata of the distributed election service, including: Create a meta information instance based on the meta information path and the status of each service node; Loading the configuration information of the meta-information for the meta-information instance, and forming a storage message of the meta-information instance based on the current term and node voting status based on the message mechanism; According to the storage message of the meta-information instance, the meta-information instance is stored for calling by the distributed election service.

5. The method according to claim 3, characterized in that Logs of tasks that establish user connections to the Virtual Desktop Agent, including: Initialize the log storage instance and save the log instance based on the embedded storage engine; When electing a service node, perform any of the following log management tasks: designing a log index, saving log instances and terms, adding, deleting, modifying, and checking log instances, clearing log instances, or resetting the log term index.

6. The method according to claim 3, characterized in that Form a user status snapshot, including: Record user state machine information through operations such as creating snapshot writers, remotely copying data, and configuring snapshot properties; Update the latest state image file of the current user state machine to form a user state snapshot, so that the image file can be directly loaded when the service node is restarted.

7. A device for controlling remote access to virtual desktop resources, comprising: A receiving module, adapted to receive a user's access request through a unified access gateway; an allocation module adapted to dynamically allocate a first virtual desktop agent to a user based on status information of each virtual desktop agent and obtain an identifier of the first virtual desktop agent; obtain availability and load information of each virtual desktop agent; determine a range of virtual desktop agents to be selected for the access request based on the availability and load information; allocate multiple different virtual desktop agents to users with frequent access requests; and / or allocate virtual desktop agents to the access request in order of least load to greatest load; a connection module adapted to establish a connection between the unified access gateway and the first virtual desktop agent based on the identifier; wherein, when providing external services, the virtual desktop agent registers user configuration information and the virtual desktop agent; after the client connects to the unified access gateway, the identifier of the first virtual desktop agent serving it is determined after registration and allocation, and then the client is routed to the first virtual desktop agent resource based on the identifier to provide services; The response module is adapted to respond to the access request by using the first virtual desktop agent and return a response result through the unified access gateway.

8. A virtual desktop server, comprising: Unified access gateway, agent registration center, virtual desktop agent resources, connection server and AD domain control server; The connection server and the AD domain control server are used to authenticate the user through the agent registration center, so that the user establishes a session connection between the client, the unified access gateway, the agent registration center and the virtual desktop agent resource through the display protocol; The virtual desktop server performs operations corresponding to the virtual desktop resource remote access control method according to any one of claims 1 to 6.

9. A computer storage medium, wherein at least one executable instruction is stored in the storage medium, wherein the executable instruction enables a processor to execute operations corresponding to the method for remote access control of virtual desktop resources according to any one of claims 1 to 6.

Images