Granted Patent B1

US 10,009,443 · App. 15/615,432 · Granted Jun 26, 2018

Inventor: Michael Guigli (Natick, MA)

H04L67/42G06F9/445G06F9/5077H04L41/5051H04L47/783H04L67/10

Abstract

Claims (59)

1. A method comprising:

instantiating a first server within a tenant domain serviced by a cloud service provider, the first server including a first network adapter and a second network adapter, the first network adapter configured to be controlled by the cloud service provider, the second network adapter configured to be controlled by the tenant;

operably coupling the first network adapter with an interconnection network infrastructure operably coupled with a cloud service provider infrastructure;

operably coupling the second network adapter to a first port group controlled by the tenant;

configuring the first server to host and execute an application accessible through a remote display protocol via the first network adapter;

applying local security and group policy configurations to the first server;

enabling access by an end user to the first server using a gateway of the cloud service provider and the first network adapter, or using a tenant-deployed virtual private network, the second network adapter, and a tenant-deployed remote desktop gateway;

authenticating, by the gateway of the cloud service provider, the end user against a tenant's active directory domain, the authentication including verifying a membership of the end user in an active directory security group; and

routing a connection of the end user to the first server within the tenant domain via the first network adapter associated with the active directory security group.

2. The method of claim 1 , the tenant further including a first directory server including a third network adapter configured to be controlled by the tenant, the third network adapter operably coupled to the first port group controlled by the tenant, the first port group being operably coupled with a router.

3. The method of claim 2 , wherein the operably coupling the first network adapter with the interconnection network infrastructure includes:

operably coupling each of the first network adapter and a second external interface of the router with a second port group of type private virtual local area network isolated, the second port group of the type isolated being controlled by the cloud service provider; and

operably coupling the second port group with a third port group of a type private virtual local area network promiscuous, wherein each of the second port group and the third port group is controlled by the cloud service provider.

4. The method of claim 3 , wherein the operably coupling the interconnection network infrastructure with the cloud service provider infrastructure includes operably coupling the third port group promiscuous with a fourth port group via a firewall, the fourth port group being controlled by the cloud service provider, the fourth port group operably coupled to a second resource server, a second directory server and a dynamic host configuration protocol server of the cloud service provider.

5. The method of claim 4 , wherein the first port group is a virtual extensible local area network backed distributed port group or a virtual local area network-backed distributed virtual port group.

6. The method of claim 4 , wherein the second port group is operably coupled to the third port group via a private virtual local area network mapping trunk.

7. The method of claim 4 , wherein the fourth port group is a virtual local area network-backed distributed port group, wherein the virtual local area network identity is exclusive of any private-virtual local area network identity.

8. The method of claim 4 , wherein the fourth port group is operably coupled to the third port group via a firewall.

9. The method of claim 1 , wherein configuring the first server to execute the application accessible through a remote display protocol further comprises:

creating a machine account matching an active directory computer account of the first server;

adding the machine account to a service provider created machine catalog administered by the tenant; and

adding the machine account to a service provider created delivery group administered by the tenant.

10. The method of claim 1 , further comprising:

retrieving a list of remote application servers associated with an administrator-specified tenant-managed remote desktop services connection broker address; and

adding a runtime computer name of the first server to the list of remote application servers associated with the administrator specified connection broker address.

11. The method of claim 1 , wherein the remote display protocol includes MICROSOFT remote desktop or CITRIX independent computing architecture.

12. The method of claim 1 , further comprising:

configuring the cloud service provider infrastructure, the cloud service provider infrastructure including a database, a delivery controller, a licensing server, and an access gateway; and

creating, on the delivery controller, a machine catalog and a delivery group, wherein the administration of the delivery controller is delegated to the tenant.

13. The method of claim 1 , further comprising:

authenticating, using a Kerberos protocol, a network protocol session between a first computer of a first domain and a second computer of a second domain.

14. A system comprising:

at least one data processor;

memory storing instructions which, when executed by the at least one data processor, causes the at least one data processor to perform operations comprising:

instantiating a first server within a tenant domain serviced by a cloud service provider, the first server including a first network adapter and a second network adapter, the first network adapter configured to be controlled by the cloud service provider, the second network adapter configured to be controlled by the tenant;

operably coupling the first network adapter with an interconnection network infrastructure operably coupled with a cloud service provider infrastructure;

operably coupling the second network adapter to a first port group controlled by the tenant;

configuring the first server to host and execute an application accessible through a remote display protocol via the first network adapter;

applying local security and group policy configurations to the first server;

enabling access by an end user to the first server using a gateway of the cloud service provider and the first network adapter, or using a tenant-deployed virtual private network, the second network adapter, and a tenant-deployed remote desktop gateway;

authenticating, by the gateway of the cloud service provider, the end user against a tenant's active directory domain, the authentication including verifying a membership of the end user in an active directory security group; and

routing a connection of the end user to the first server within the tenant domain via the first network adapter associated with the active directory security group.

15. The system of claim 14 , wherein configuring the first server to execute the application accessible through a remote display protocol further comprises:

creating a machine account matching an active directory computer account of the first server;

adding the machine account to a service provider created machine catalog administered by the tenant; and

adding the machine account to a service provider created delivery group administered by the tenant.

16. The system of claim 14 , the operations further comprising:

retrieving a list of remote application servers associated with an administrator-specified tenant-managed remote desktop services connection broker address; and

adding a runtime computer name of the first server to the list of remote application servers associated with the administrator specified connection broker address.

17. The system of claim 14 , the tenant further including a first directory server including a third network adapter configured to be controlled by the tenant, the third network adapter operably coupled to the first port group controlled by the tenant, the first port group being operably coupled with a router.

18. A non-transitory computer readable storage medium storing instructions, which when executed by at least one data processor of at least one computing system, implement operations comprising:

instantiating a first server within a tenant domain serviced by a cloud service provider, the first server including a first network adapter and a second network adapter, the first network adapter configured to be controlled by the cloud service provider, the second network adapter configured to be controlled by the tenant;

operably coupling the first network adapter with an interconnection network infrastructure operably coupled with a cloud service provider infrastructure;

operably coupling the second network adapter to a first port group controlled by the tenant;

configuring the first server to host and execute an application accessible through a remote display protocol via the first network adapter;

applying local security and group policy configurations to the first server;

enabling access by an end user to the first server using a gateway of the cloud service provider and the first network adapter, or using a tenant-deployed virtual private network, the second network adapter, and a tenant-deployed remote desktop gateway;

authenticating, by the gateway of the cloud service provider, the end user against a tenant's active directory domain, the authentication including verifying a membership of the end user in an active directory security group; and

routing a connection of the end user to the first server within the tenant domain via the first network adapter associated with the active directory security group.

Assignments (1)

Cited By (8)

US 12,236,398 US 12,238,166 US 12,250,147 US 12,382,117 US 12,425,312 US 12,568,138 US 12,579,229 US 12,676,908