Vmware, Inc.

Nicira, Inc.

Omnissa, LLC

Shengbo Teng

Nan Wang

Wen Jie Wang

Jingtao Zhang

Sam Zhao

YiSan Zhao

Zhibin He

Wenping Fan

Tracy Yan Chi

Zhao YiSan

Xi Chen

Yao Zhang

Daniel James Beveridge

Lu Liu

Kar Fai Tse

Jinxing Hu

Junfei Wu

Zhikai Chen

Jian Lan

Bin Guo

Bomin Nie

Lina Li

Jinrong Wu

Yunquan Peng

Peter Zhang

Tony Lu

Disclosed are examples of embedding watermarks in a VDI session of a user. The watermark is based upon the user's identity and can be embedded into the VDI session to aid in the identification of data that is compromised from the VDI session. The watermark can be extracted from an image without needing the original image for extraction purposes.

Watermarking in a virtual desktop infrastructure environment

Embodiments of the present disclosure relate to techniques for providing a remoted application to a client device over a network. Certain embodiments involve receiving, by a web server and from the client device, a request for the remoted application. The request may comprise a tag which identifies one or more attributes of the remoted application. Embodiments further involve launching, by the web server and based on the tag, the remoted application. Embodiments further involve providing, by the web server and to the client device, a video stream of the remoted application. The video stream of the remoted application may comprise one or more images rendered based on raw data of the remoted application. Embodiments further involve receiving, by the web server and from the client device, user input and providing, by the web server and based on the user input, application input to the remoted application.

Hosted application as web widget toolkit

A system is described for authenticating a user on a client device using the user's mobile device and utilizing the audio channel. An authentication server receives a request from the client to initiate a session for the user, creates the session, and sends a session token back to the client along with a request for authentication. The client broadcasts an audio transmission containing the token to the mobile device over an audio channel using data-over-sound transmission. The mobile device receives the transmission via a microphone, obtains the token and the server identity from the transmission, and sends user credentials that are stored on the mobile device along with the token identifying the session directly to the authentication server. The server verifies the received credentials, confirms the token, and logs the user into the session.

User authentication over an audio channel using a mobile device

Described herein are systems, methods, and software to enhance firewall implementation for virtual machines. In one implementation, a method of managing firewall rules for a virtual machine includes identifying, in the virtual machine, an attach process for one or more applications to the virtual machine. The method further includes, identifying one or more firewall rules that correspond to the one or more applications and providing the one or more firewall rules to networking manager for the virtual machine.

Application based firewall rule service

Described herein are systems, methods, and software to enhance network traffic management for virtual machines. In one implementation, a host for a virtual machine may identify applications available for execution on the virtual machine from mounted application volumes and identify firewall rules for the applications. Once identified, the host may identify network traffic for the virtual machine, and forward or block the network traffic for the virtual machine based on the firewall rules.

Application based network traffic management

A system and method are described for performing authentication on a computing device using a mobile device connected over an audio channel to the computing device, in scenarios where smart card authentication may have been traditionally used. An application executing on the computing device receives a request from a user, which request requires authentication of the user before being allowed by the application. An audio transmission containing encoded data including information authenticating the user is received at the computing device from the user's mobile device via a microphone. The audio transmission is decoded and the information authenticating the user is extracted. The information authenticating the user is verified and the request is allowed in the application.

Mobile key via mobile device audio channel

Described herein are systems, methods, and software to enhance network traffic management for virtual machines. In one implementation, a network policy controller may maintain firewall rules at one or more hosts of a computing environment, wherein the firewall rules define network packet forwarding policies for application groups available to virtual machines in the environment. The network policy controller further identifies an application group for attachment to one or more virtual machines, and in response to the identification, adds the one or more virtual machines to a security group for a firewall wall rule corresponding to the application group.

Application attachment based firewall management

One or more VPN tunnels are established in a site-to-site configuration. A VPN transition subnet is defined and associated with each VPN tunnel. Once the VPN tunnel(s) and the LAN(s) have been configured, a per-application VPN policy can be specified for any applications that require site-to-site VPN access. Whenever a new application is launched, a container is created for executing the VM. The VPN management system reads the VPN policy to determine whether the application is permitted to access any VPN tunnels. If the application is permitted to access a VPN tunnel, a vNIC is generated on the VM for the container of the application and/or a new IP address on the vNIC is assigned to the container. The new IP address and/or the new vNIC are then added to the VPN transition subnet associated with the VPN tunnel to enable the application to access the VPN tunnel.

Per-application VPN in container based environments

Example methods are provided for host to implement application-based network segmentation in a virtualized computing environment. The method may comprise detecting an egress packet from a virtualized computing instance supported by the host for transmission to a destination and identifying a source application associated with the egress packet. The source application may be one of multiple applications supported by the virtualized computing instance, the multiple applications being associated with respective target networks. The method may further comprise, based on a network policy configured for the source application, determining a particular target network associated with the source application; and sending, to the destination, the egress packet via a physical network interface controller (NIC) associated with the particular target network.

Application-based network segmentation in a virtualized computing environment

A system can allow a user to continue using a virtual machine while a background reboot occurs on a clone of the virtual machine. A backup agent operating on a server can receive a request from a virtual machine operating in an active state, to complete a reboot operation without operational interruption. A hypervisor can clone the virtual machine. During and after cloning, the backup agent can cause a filter agent to capture changes to the virtual machine. The virtual machine clone can notify the backup agent that the reboot is complete. Changes made in the interim on the virtual machine can be integrated on the virtual machine clone. Then the hypervisor can transition usage from the virtual machine to the virtual machine clone.

Preventing interruption during virtual machine reboot

A VPN tunnel policy is defined on a per-application basis. The VPN tunnel policy may specify that a particular application is permitted to transmit data on a specific VPN tunnel. Subsequently, the specified application is delivered to one or more virtual machines and an application tunnel manager creates a new virtual network interface card (NIC) on the VM, corresponding to the delivered application. The newly created virtual NIC is attached to a specified subnet. The subnet may be a VPN transition network with a connection to a VPN gateway device. The subnet may have been previously defined or generated at the time of assigning the application to the VPN tunnel. Once the virtual NIC has been created on the VM, an OS script is executed to force the delivered application to use the newly created virtual NIC and to prevent users from changing the application and virtual NIC linkage.

Enforcing per-application VPN policies for applications delivered in virtualized computing environments

In one embodiment, a mobile computing device receives content in a desktop compatible format. The content is generated by a remote desktop executing an application. The mobile computing device determines a conversion of at least a first portion of the content to a native display format of the mobile computing device and displays the conversion of the at least the first portion of the content in the native display format on an interface. Also, the mobile computing device displays at least a second portion of the content in the desktop compatible format on the interface where the at least the second portion of the content in the desktop compatible format corresponds to the conversion of the at least the first portion of the content in the native display format of the mobile computing device.

Growing community of inventors

Beijing, China

Shengbo Teng