User device compliance-profile-based access to virtual sessions and select virtual session capabilities
Systems and methods can enable select virtual session capabilities on a user device configured to access a virtual session, which is an instance of a virtual machine. The user device can receive and forward to a gateway sever, a request to launch a virtual session. Based on the virtual session launch request, the gateway server can obtain a compliance profile determined from operational data for the user device and compare it to a minimum access policy (“MAP”). The MAP can include threshold or binary values for states of a group of user device operational aspects. Where the compliance profile satisfies the MAP, the gateway can permit user device access a virtual session hosted on a virtual machine (“VM”) server. The virtual session can be configured at the VM server based on the compliance profile so as to allow access to a portion of a full virtual session capability scheme.
1. A method of providing a virtual session to a user device in response to a request from the user device, the method comprising:
receiving, at a management server of a device management system, operational data from a plurality of user devices, including a first user device, that are managed by the device management system, each of the user devices including a management agent running therein to obtain the operational data and transmit the operational data to the management server;
for each of the user devices, the management server performs the steps of:
determining a compliance sub-profile using the operational data from the user device;
providing, from the management server, the compliance sub-profile to a security service;
requesting a security assessment from the security service based on the compliance sub-profile;
receiving a security sub-profile from the security service, the security sub-profile including the requested security assessment; and
generating a compliance profile including the compliance sub-profile and the security sub-profile; and
providing by the management server to a gateway server that is controlling access to virtual sessions, the compliance profile of the first user device in response to a request from the gateway server for the compliance profile of the first user device, wherein the gateway server permits the first user device to access a virtual session based on determining that the security sub-profile of the compliance profile of the first user device satisfies a minimum access policy.
2. The method of claim 1 , wherein the access to the virtual session is limited to a portion of virtual session capabilities for a full capability scheme.
3. The method of claim 2 , wherein the portion of virtual session capabilities is determined based on the security sub-profile.
4. The method of claim 2 , wherein access to the virtual session is limited by a virtual machine server that configures the virtual session.
5. The method of claim 2 , wherein the portion of virtual session capabilities is determined based on an overall security rating for the first user device.
6. The method of claim 1 , wherein the compliance profile for the first user device specifies that the first user device is connected to a network through an unsecure connection.
7. The method of claim 1 , wherein the virtual session:
allows the first user device to access a virtual machine server through a first logical network segment, and
restricts the first user device from accessing the virtual machine server through a second logical network segment that serves devices having a secure connection to the network.
8. A non-transitory, computer-readable medium containing instructions that, when executed by a hardware-based processor of a management server of a device management system, performs stages for providing a virtual session to a user device in response to a request from the user device, the stages comprising:
receiving operational data from a plurality of user devices, including a first user device, that are managed by the device management system, each of the user devices including a management agent running therein to obtain the operational data and transmit the operational data to the management server;
for each of the user devices, performing the steps of:
determining a compliance sub-profile using the operational data from the user device;
providing, from the management server, the compliance sub-profile to a security service;
requesting a security assessment from the security service based on the compliance sub-profile;
receiving a security sub-profile from the security service, the security sub-profile including the requested security assessment; and
generating a compliance profile including the compliance sub-profile and the security sub-profile; and
providing to a gateway server that is controlling access to virtual sessions, the compliance profile of the first user device in response to a request from the gateway server for the compliance profile of the first user device, wherein the gateway server permits the first user device to access a virtual session based on determining that the security sub-profile of the compliance profile of the first user device satisfies a minimum access policy.
9. The non-transitory, computer-readable medium of claim 8 , wherein the access to the virtual session is limited to a portion of virtual session capabilities for a full capability scheme.
10. The non-transitory, computer-readable medium of claim 9 , wherein the portion of virtual session capabilities is determined based on the security sub-profile.
11. The non-transitory, computer-readable medium of claim 9 , wherein access to the virtual session is limited by a virtual machine server that configures the virtual session.
12. The non-transitory, computer-readable medium of claim 9 , wherein the portion of virtual session capabilities is determined based on an overall security rating for the first user device.
13. The non-transitory, computer-readable medium of claim 8 , wherein the compliance profile for the first user device specifies that the first user device is connected to a network through an unsecure connection.
14. The non-transitory, computer-readable medium of claim 8 , wherein the virtual session:
allows the first user device to access a virtual machine server through a first logical network segment, and
restricts the first user device from accessing the virtual machine server through a second logical network segment that serves devices having a secure connection to the network.
15. A system for providing a virtual session to a user device in response to a request from the user device, comprising:
a memory storage including a non-transitory, computer-readable medium comprising instructions, and
a computing device of a management server of a device management system, including a hardware-based processor that executes the instructions to carry out stages comprising:
receiving operational data from a plurality of user devices, including a first user device, that are managed by the device management system, each of the user devices including a management agent running therein to obtain the operational data and transmit the operational data to the management server;
for each of the user devices, performing the steps of:
determining a compliance sub-profile using the operational data from the user device;
providing, from the management server, the compliance sub-profile to a security service;
requesting a security assessment from the security service based on the compliance sub-profile;
receiving a security sub-profile from the security service, the security sub-profile including the requested security assessment; and
generating a compliance profile including the compliance sub-profile and the security sub-profile; and
providing to a gateway server that is controlling access to virtual sessions, the compliance profile of the first user device in response to a request from the gateway server for the compliance profile of the first user device, wherein the gateway server permits the first user device to access a virtual session based on determining that the security sub-profile of the compliance profile of the first user device satisfies a minimum access policy.
16. The system of claim 15 , wherein the access to the virtual session is limited to a portion of virtual session capabilities for a full capability scheme.
17. The system of claim 16 , wherein the portion of virtual session capabilities is determined based on the security sub-profile.
18. The system of claim 16 , wherein access to the virtual session is limited by a virtual machine server that configures the virtual session.
19. The system of claim 16 , wherein the portion of virtual session capabilities is determined based on an overall security rating for the first user device.
20. The system of claim 15 , wherein the virtual session:
allows the first user device to access a virtual machine server through a first logical network segment, and
restricts the first user device from accessing the virtual machine server through a second logical network segment that serves devices having a secure connection to the network.