Dell Products Inc.

Wyse Technology Inc.

Ramanujam Kaniyar Venkatesh

Gokul Thiruchengode Vajravel

Jyothi Bandakka

Sudhakar Ramasamy

Vishwanath Biradar

Anantha K Boyapalle

Vivek Viswanathan Iyer

Michael S Gatson

Abu Shaher Sanaullah

Curtis Schwebke

Puneet Kaushik

Ankit Kumar

Srinivasa Ragavan Rajagopalan

Manish Bhaskar

Sriram Kumar Raju

Sharad K Patesaria

Harish Agrawal

Ramanaa H V

Nathaniel Overholtzer

Gokul Tv

Sharik Saigal

Aswini Saravanan

Ashish Rakesh Singh

Elavarasu Krishnan

Sandeep K S

A peripheral device workspace cloud orchestrator information handling system comprises a network interface device to receive functional capabilities for an existing peripheral device previously operatively coupled by a user to a user information handling system anchor node for a peripheral device workspace defined by a manifest of included peripheral device nodes, location, and peripheral device workspace identification value, and a user composite peripheral device workspace identifier associated with an adjustable operational configuration instructing the existing peripheral device operation, a hardware processor to execute code instructions to identify new peripheral device capabilities within a received new device orchestrated device descriptor for a new peripheral device operatively coupled to the anchor node, determine a minimum percentage of the new peripheral device capabilities matches the existing functional capabilities, and instruct the anchor node to configure the new peripheral device according to the adjustable operational configuration associated with the existing peripheral device.

System and method for determining peripheral device configurations across a plurality of workspaces for seamless user peripheral device workspace ecosystem experience

Quality of service for secure workspaces having copy-on-write layers is provided. A priority filter can be loaded above an isolation filter and can be configured to evaluate I/O requests targeting copy-on-write layers to determine a priority of each I/O request. The priority filter can allow a high priority I/O request to be serviced immediately. In contrast, the priority filter can store a lower priority I/O request in a queue until high priority I/O requests have been serviced. In this way, an application in a secure workspace assigned a high priority will retain the ability to write data to its copy-on-write layer even when the copy-on-write layer is limited by a quota and other applications in the same or different secure workspace are consuming the quota.

Providing quality of service for secure workspaces having copy-on-write layers

Systems and methods for arbitration among multiple concurrent management agents in a conference room are described. In an illustrative, non-limiting embodiment, a video bar or host Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the video bar or host IHS to: receive a command targeting a device in a conference room and, determine, based at least in part upon a source of the command, whether to allow the command to reach the device.

Arbitration among multiple concurrent management agents in a conference room

Logged-in-user-specific 802.1x security can be applied on a multi-user client computing device. An 802.1x extension can be provided on a multi-user client computing device to leverage user credentials that are verified to log a user into the multi-user client computing device to select and perform 802.1x authentication for connecting the multi-user client computing device to a LAN. The 802.1x extension may also leverage the user credentials to obtain and use one or more certificates as part of the 802.1x authentication. When the user logs off of the multi-user client computing device, the 802.1x extension can automatically disconnect the multi-user client computing device from the LAN to prevent a subsequently logged in user from obtaining unauthorized access to the LAN.

Applying logged-in-user-specific 802.1x security on a multi-user client computing device

Runtime observability can be enabled for applications hosted in a secure workspace. An observability service can be included in a secure workspace deployed on a user computing device and can be selectively enabled at runtime to observe one or more applications hosted in the secure workspace. The observability service can gather information about any application it observes and provide the information to a workspace agent that is also executed in the secure workspace. The workspace agent can then relay the information to a host agent that runs on the user computing device which in turn can relay the information to a management service hosted on a management server. An administrator can then use an observability solution to analyze the information.

Enabling runtime observability for applications hosted in a secure workspace

Context-based workspace personalization is provided using an experience ID. An agent can be used on a user computing device to monitor for context of a workspace. Based on context, the agent can generate and send a manifest and an experience ID generated from the manifest to a workspace management service. The workspace management service can use the experience ID to identify whether a manageability snapshot exists for the workspace in its current context. If so, the workspace management service can send the manageability snapshot to the agent which in turn can apply the manageability snapshot to customize the workspace to the user's preferences. When the user makes changes to configurations of the workspace, the agent can relay such changes to the workspace management service using the experience ID to thereby cause such changes to be reflected in a corresponding manageability snapshot.

Context-based workspace personalization using an experience ID

Persistence can be enabled in a volatile secure workspace. A management service may be configured to provide a managed application image containing a managed application to a host agent on a user computing device. When a secure workspace is deployed on the user computing device, the host agent can attach the managed application image to the secure workspace to create an injected volume. The host agent can also provide image details of the managed application image to a file system filter in the secure workspace. The file system filter may cause the managed application to be loaded from the managed application image and may then redirect I/O performed by the managed application to the injected volume which in turn will cause such I/O to be persisted in the managed application image. In this way, the managed application, any files it creates or modifies, and any state will be persisted even though the secure workspace is volatile.

Enabling persistence in a volatile secure workspace

Users can be logged in to modern workspaces using different cloud identity providers and single sign-on. A login manager can be provided on a user computing device to obtain a user's login credentials via a custom login screen. The login manager can then inject the login credentials into an authentication interface of a cloud identity provider to authenticate the user for purposes of logging in to the user computing device. The login manager can leverage this authentication to perform single sign-on for all resources of a modern workspace such that the user can be logged in to the modern workspace via any cloud identity provider.

Logging in to modern workspaces using different cloud identity providers and single sign-on

Crash-related information for a secure workspace can be collected. An extended paging table (EPT) handler can be registered in a hypervisor used to deploy a secure workspace on a user computing device. When a secure workspace is about to crash, the EPT handler can be invoked to collect crash-related information about the secure workspace and the hypervisor on which the secure workspace is hosted. After the crash and when the secure workspace is again deployed, a workspace agent running inside the secure workspace can collect additional crash-related information. All of this crash-related information can be communicated to a host agent and relayed to a management service on a management server to allow the crash-related information to be reviewed and analyzed.

Collecting crash-related information for a secure workspace

Context-based intelligent placement of files in aggregated cloud storage is provided. A virtual volume can be created to provide an aggregated interface for accessing aggregated cloud storage. When the user attempts to create a file on the virtual volume, the virtual volume can employ a placement algorithm to intelligently select one of the aggregated cloud storage providers to which the request to create the file will be directed. The placement algorithm can consider context of the aggregated cloud storage providers, network metrics, and other factors in its selection. In this way, the aggregated cloud storage can be efficiently used while maximizing the user experience.

Context-based intelligent placement of files in aggregated cloud storage

A file can be intelligently associated with an application. When a user attempts to open a file on a user computing device, context for the file can be collected and provided to an intelligent file association engine. The intelligent file association engine can use the context to select an application to be used to open the file from among different applications. These different applications can include a local application, a VDI application, and a cloud application.

Intelligently associating a file with an application

Access to functionality of a web application can be provided via microapps. A microapp platform can include a microapp orchestrator that administrators may use to create and deploy microapps. A microapp may include a simple user interface with one or more elements that are associated with a function of a web application. When the microapp is deployed to a user computing device, the user can use the elements of the microapp's user interface to invoke the function of the web application without needing to directly interact with the web application.

Providing access to functionality of a web application via microapps

A hook driver and a UWP load modifier can be employed on a Windows device to modify the process of loading UWP applications so that both UWP and Win32 applications can be run in kiosk mode without needing to run Windows Explorer in a typical manner. To accomplish this, the UWP load modifier can implement a proxy function that is called when the UWP loader attempts to launch a UWP application. In some configurations, when the proxy function is called, it can start Windows Explorer, cause the UWP application to be launched while Windows Explorer is running and then stop Windows Explorer once the UWP application is launched. In other configurations, when the proxy function is called, it can cause the UWP application to be launched in a separate desktop in which Windows Explorer is running and then, after it is launched, move the UWP application to the default desktop.

Supporting universal windows platform and Win32 applications in kiosk mode

Reverse authentication can be performed in a VDI environment to enable an authentication device to gain access to a client without requiring that the authentication device's drivers be installed on the client. When an authentication device is connected to the client while the client is locked or not logged in, the authentication device can be redirected to a virtual appliance on which the authentication device's drivers are installed. The authentication device can then be used to authenticate the user via the virtual appliance. When authentication is successful, the virtual appliance can send the resulting authentication information back to the client to enable the user to be logged in to the client. Additionally, the virtual appliance can return the authentication device to the client. The client can then employ the authentication information to establish a remote session on a server and redirect the authentication device to the remote server.

Reverse authentication in a virtual desktop infrastructure environment

USB devices can be redirected from hardware isolated VDI clients. When a VDI client is run in a hardware isolated environment, a notification service can also be run in the hardware isolated environment to enable a USB device that is not accessible within the hardware isolated environment to be redirected to a server on which the VDI client has established a remote session. In some cases, an agent can also be employed in the hardware isolated environment to temporarily redirect the USB device to the hardware isolated environment for use in establishing the remote session before the USB device is redirected to the server. Similar techniques can be employed to redirect a USB device to a hardware isolated environment so that the USB device can be accessed by an application running in the hardware isolated environment.

Growing community of inventors

Bengaluru, India

Ramanujam Kaniyar Venkatesh