Redirection of USB devices from hardware isolated virtual desktop infrastructure clients
USB devices can be redirected from hardware isolated VDI clients. When a VDI client is run in a hardware isolated environment, a notification service can also be run in the hardware isolated environment to enable a USB device that is not accessible within the hardware isolated environment to be redirected to a server on which the VDI client has established a remote session. In some cases, an agent can also be employed in the hardware isolated environment to temporarily redirect the USB device to the hardware isolated environment for use in establishing the remote session before the USB device is redirected to the server. Similar techniques can be employed to redirect a USB device to a hardware isolated environment so that the USB device can be accessed by an application running in the hardware isolated environment.
1. A method for enabling a USB device that is connected to a client terminal to be accessed within a remote session that a virtual desktop infrastructure (VDI) client establishes on a server when the VDI client runs in a hardware isolated environment on the client terminal, the method comprising:
receiving, at a notification service that runs in the hardware isolated environment, connection information for the remote session that the VDI client has established on the server;
sending, by the notification service, the connection information for the remote session to a proxy that runs on the client terminal outside the hardware isolated environment;
employing, by the proxy, the connection information for the remote session to redirect the USB device to the server to thereby cause the USB device to become accessible within the remote session.
2. The method of claim 1 , wherein the connection information for the remote session includes an IP address of the server and a port number of an agent that runs on the server.
3. The method of claim 1 , wherein the notification service receives the connection information for the remote session from the VDI client via a virtual channel.
4. The method of claim 1 , wherein the hardware isolated environment is a virtual machine.
5. The method of claim 1 , further comprising:
receiving, at the notification service, a notification that the remote session has terminated;
sending, by the notification service, a corresponding notification to the proxy; and
in response to the corresponding notification, causing, by the proxy, the USB device to be returned to the client terminal.
6. The method of claim 1 , wherein the VDI client runs in a browser in the hardware isolated environment.
7. The method of claim 1 , further comprising:
sending, by an agent that runs in the hardware isolated environment, connection information for the hardware isolated environment to the proxy;
employing, by the proxy, the connection information for the hardware isolated environment to redirect the USB device to the hardware isolated environment to thereby cause the USB device to become accessible within the hardware isolated environment.
8. The method of claim 7 , wherein the proxy redirects the USB device to the hardware isolated environment prior to redirecting the USB device to the server.
9. The method of claim 8 , wherein the notification service receives the connection information for the remote session while the USB device is redirected to the hardware isolated environment.
10. One or more computer storage media storing computer executable instructions which when executed on a client terminal implement a method for enabling a USB device that is connected to a client terminal to be accessed within a remote session that a virtual desktop infrastructure (VDI) client establishes on a server when the VDI client runs in a hardware isolated environment on the client terminal, the method comprising:
in response to the VDI client establishing the remote session on the server, receiving, at a notification service that runs in the hardware isolated environment, connection information for the remote session;
sending, by the notification service, the connection information for the remote session to a proxy that runs on the client terminal outside the hardware isolated environment;
employing, by the proxy, the connection information for the remote session to redirect the USB device to the server to thereby cause the USB device to become accessible within the remote session.
11. The computer storage media of claim 10 , wherein the method further comprises:
prior to the VDI client establishing the remote session, sending, by an agent that runs in the hardware isolated environment, connection information for the hardware isolated environment to the proxy;
employing, by the proxy, the connection information for the hardware isolated environment to redirect the USB device to the hardware isolated environment to thereby cause the USB device to become accessible within the hardware isolated environment such that the VDI client can employ the USB device to establish the remote session.
12. The computer storage media of claim 11 , wherein the USB device is an authentication device.
13. The computer storage media of claim 10 , wherein the method further comprises:
ceasing, by the proxy, the redirection of the USB device to the hardware isolation environment in response to receiving the connection information for the remote session.
14. A method for enabling a USB device that is connected to a client terminal to be accessed when an application runs in a hardware isolated environment on the client terminal, the method comprising:
in conjunction with the hardware isolated environment being created on the client terminal, running an agent in the hardware isolated environment;
sending, by the agent, connection information for the hardware isolated environment to a proxy that runs on the client terminal outside the hardware isolated environment; and
employing, by the proxy, the connection information to redirect the USB device to the hardware isolated environment to thereby cause the USB device to become accessible to an application that runs in the hardware isolated environment.
15. The method of claim 14 , wherein the application is a VDI client, the method further comprising:
receiving, at a notification service that runs in the hardware isolated environment, connection information for a remote session that the VDI client has established on a server;
sending, by the notification service, the connection information for the remote session to the proxy;
employing, by the proxy, the connection information for the remote session to redirect the USB device to the server to thereby cause the USB device to become accessible within the remote session.
16. The method of claim 15 , wherein the proxy redirects the USB device to the hardware isolated environment to enable the VDI client to employ the USB device to establish the remote session and then redirects the USB device to the server.
17. The method of claim 15 , wherein the USB device is an authentication device.
18. The method of claim 15 , further comprising:
receiving, at the notification service, a notification that the remote session has terminated;
sending, by the notification service, a corresponding notification to the proxy; and
in response to the corresponding notification, causing, by the proxy, the USB device to be returned to the client terminal.
19. The method of claim 14 , wherein the USB device comprises a USB host controller.
20. The method of claim 14 , wherein the hardware isolated environment is a virtual machine and the application is a browser.