Dell Products Inc.

Wyse Technology Inc.

Jyothi Bandakka

Gokul Thiruchengode Vajravel

Ramanujam Kaniyar Venkatesh

Sanmati Bahubali Tukol

Muralidhara Mallur

Ankit Kumar

Sudhakar Ramasamy

Sridhara Chinya Venkatanaranappa

Curtis Schwebke

Christopher Stephen Petrick

Srinivasa Ragavan Rajagopalan

Andy A Yiu

SriramKumar Raju

Ankur Agarwal

Ramanaa H V

Ravi Vijaykumar Vanjani

Srinivasa Ragavan R

Sharik Saigal

Quality of service for secure workspaces having copy-on-write layers is provided. A priority filter can be loaded above an isolation filter and can be configured to evaluate I/O requests targeting copy-on-write layers to determine a priority of each I/O request. The priority filter can allow a high priority I/O request to be serviced immediately. In contrast, the priority filter can store a lower priority I/O request in a queue until high priority I/O requests have been serviced. In this way, an application in a secure workspace assigned a high priority will retain the ability to write data to its copy-on-write layer even when the copy-on-write layer is limited by a quota and other applications in the same or different secure workspace are consuming the quota.

Providing quality of service for secure workspaces having copy-on-write layers

When a containerized application for which experience management services are being performed is to be migrated to a new secure workspace on a user computing device, a workspace orchestrator can interface with a migration agent on the user computing device to cause the migration agent to perform the migration. The workspace agent can also interface with a host agent on the user computing device to provide information about the new secure workspace to which the containerized application is being migrated. When the migration is performed, the host agent can notify an experience management agent on the user computing device and provide the information about the new workspace. The experience management agent can then use the information about the new secure workspace to apply policies or configurations to the new secure workspace to thereby cause the same experience management services to be provided to the containerized application in the new secure workspace.

Providing experience management for containerized applications across migrations

Application compliance policies can be dynamically updated. An agent can be deployed on user computing devices to monitor application install events to track how frequently users install applications on the user computing devices and whether applicable application compliance policies dictate that such applications should be removed. A policy management service of a management solution can interface with the agents to gather application metrics and use the application metrics to dynamically update the application compliance policies to prevent future removal of one or more applications that are determined to be commonly installed by the users. These dynamic updates could be made on a per-user basis, a per-group basis, or a global basis.

Dynamically updating application compliance policies

Persistence can be enabled in a volatile secure workspace. A management service may be configured to provide a managed application image containing a managed application to a host agent on a user computing device. When a secure workspace is deployed on the user computing device, the host agent can attach the managed application image to the secure workspace to create an injected volume. The host agent can also provide image details of the managed application image to a file system filter in the secure workspace. The file system filter may cause the managed application to be loaded from the managed application image and may then redirect I/O performed by the managed application to the injected volume which in turn will cause such I/O to be persisted in the managed application image. In this way, the managed application, any files it creates or modifies, and any state will be persisted even though the secure workspace is volatile.

Enabling persistence in a volatile secure workspace

Users can be logged in to modern workspaces using different cloud identity providers and single sign-on. A login manager can be provided on a user computing device to obtain a user's login credentials via a custom login screen. The login manager can then inject the login credentials into an authentication interface of a cloud identity provider to authenticate the user for purposes of logging in to the user computing device. The login manager can leverage this authentication to perform single sign-on for all resources of a modern workspace such that the user can be logged in to the modern workspace via any cloud identity provider.

Logging in to modern workspaces using different cloud identity providers and single sign-on

A file can be intelligently associated with an application. When a user attempts to open a file on a user computing device, context for the file can be collected and provided to an intelligent file association engine. The intelligent file association engine can use the context to select an application to be used to open the file from among different applications. These different applications can include a local application, a VDI application, and a cloud application.

Intelligently associating a file with an application

Storage can be allocated to workspaces in a ZFS-based environment. Workspaces can be associated with a workspace weightage. When a workspace is deployed on a client computing device, its workspace weightage can be used to determine an initial quota for a dataset to be created in a zpool for the workspace. The initial quota can be used to determine the size of the dataset. The workspace weightage may also be used to determine an expansion quota and a contraction quota that can be used to calculate the size of an expansion or contraction respectively. The use of workspace weightages and their associated quotas can ensure that the zpool is fairly shared by the various datasets that may be created therein for workspaces deployed on the client computing device.

Intelligent storage allocation based on workspace context in a ZFS environment

An application can be installed, updated or reconfigured without disabling a write filter. When a package is to be deployed to a client terminal to install, update or reconfigure an application, an overlay optimizer can be instructed to start a session. During the session, the overlay optimizer can analyze I/O requests to identify any I/O request that pertains to the deployment of the package. The overlay optimizer can then redirect the identified I/O requests to a session overlay that the overlay optimizer has created for the session rather than passing the I/O requests to the write filter. As a result, the artifacts that are affected by the deployment of the package will be stored in the session overlay rather than the write filter's overlay. Once the session is completed, the overlay optimizer can copy the artifacts from the session overlay to the write filter's overlay and commit them.

Installing, updating or reconfiguring an application without disabling a write filter

A disk-based write filter can include a filter driver that is loaded below the file system driver to thereby provide write filter functionality at the disk level, and a supporting driver that is loaded above the file system driver. When an excluded file is opened, the supporting driver can obtain the file's disk sector information and provide it to the filter driver to cause the filter driver to pass through I/O requests that target sectors defined in the file's disk sector information. When the excluded file is closed, the supporting driver can again obtain the file's disk sector information and provide it to the filter driver to allow the filter driver to identify any additional sectors that may have been allocated to the file. The filter driver can copy any such sectors from an overlay to disk and commence passing through I/O requests that target these sectors.

Supporting file exclusions and commits in disk-based write filters

An overlay optimizer can enhance the functionality of a write filter using an auxiliary overlay. An overlay optimizer can be loaded above a write filter. Based on the configuration of the write filter's overlay, the overlay optimizer can be configured to implement a volatile or persistent auxiliary overlay and then use the auxiliary overlay to selectively cache artifacts. To minimize the likelihood that the consumption of the write filter's overlay will exceed a critical threshold, the overly optimizer can be provided a list of monitored artifacts. The overlay optimizer can employ the list to selectively move monitored artifacts from the write filter's overlay to the auxiliary overlay when the overlay's consumption reaches a threshold. The overlay optimizer may also selectively allow I/O requests generated by particular applications while redirecting I/O requests generated by other applications.

Enhancing write filter features using an auxiliary overlay

The amount of data that is written to disk is minimized when an overlay optimizer is used in conjunction with a write filter to prevent the overlay from becoming full. An overlay optimizer minifilter can be used to intercept writes that were initiated by the overlay optimizer's request to commit files cached in the write filter's overlay to thereby extract only the modified portions of the files that are actually stored in the overlay. The overlay optimizer minifilter can then write these modified portions of the files, as opposed to the entire files, in the overlay cache. Directory change notifications are also enabled when a write filter is employed as well as in other multi-volume filter environments.

Minimizing data written to disk and enabling directory change notifications in multi-volume filter environments

USB devices can be redirected from hardware isolated VDI clients. When a VDI client is run in a hardware isolated environment, a notification service can also be run in the hardware isolated environment to enable a USB device that is not accessible within the hardware isolated environment to be redirected to a server on which the VDI client has established a remote session. In some cases, an agent can also be employed in the hardware isolated environment to temporarily redirect the USB device to the hardware isolated environment for use in establishing the remote session before the USB device is redirected to the server. Similar techniques can be employed to redirect a USB device to a hardware isolated environment so that the USB device can be accessed by an application running in the hardware isolated environment.

Redirection of USB devices from hardware isolated virtual desktop infrastructure clients

VDI sessions and virtualized devices can be prioritized in Software-Defined Networks. A server-side agent can communicate with a management server to provide VDI session details indicative of how the VDI session is being employed. The management server can then update a flow table in a Software-Defined Network based on the VDI session details. In this way, the network traffic pertaining to a VDI session can be prioritized based on how the VDI session is being used. A flow table can also be updated in conjunction with commencing or completing an imaging process.

Prioritizing VDI sessions and redirected devices in software defined networks

System and method enabling multiple users to simultaneously share a client computing device are disclosed. Method includes retrieving a plurality of I/O device groups, wherein a first I/O device group in the plurality of I/O device groups is associated with a first group of input or output (IO) devices locally connected to a client computing device, and wherein a second I/O device group in the plurality of I/O device groups is associated with a second group of I/O devices locally connected to the client computing device. Method includes launching first and second instances of an application. Method includes associating the first instance of the application with the first I/O device group on the client computing device. Method includes associating the second instance of the application associated with the second I/O device group on the client computing device.

Multi-user thin client

Systems and methods for updating firmware include a firmware update module executing on a client device. A firmware package to be installed on the client device may be verified by the firmware update module, including verifying that firmware files included in the firmware package are intact prior to beginning a firmware update. Recovery logic for enabling a client device to boot-up from a functional partition after a failed firmware update may be provided. The recovery logic may ensure that, when a firmware update failure occurs, the client device may boot-up from a functional partition. A recovery process may back up certain components stored in the client device. An update status related to the firmware update process may be provided.

Growing community of inventors

Bengaluru, India

Jyothi Bandakka