Method and system for controlling remote session on computer systems using a virtual channel

A system for controlling the access of a device to a remote desktop or a remote application running on a remote desktop or application server using a remoting protocol, wherein the remoting protocol is used to capture graphics, audio, clipboard or storage from a remote session and deliver it to a device where it can be reconstructed to give the illusion that the remote desktop or application is running on the local device, comprising:

• a device with a network interface, configured to set up a connection between the device and remote desktop or application server to establish or to join an existing user session, using the remoting protocol;
• the device and the remote desktop or application server are configured to set up a virtual channel within the connection using the remoting protocol, the virtual channel provided by the remoting protocol;
• the device is configured to monitor and to determine meta-data associated with the state of the device, wherein the monitoring is continued for as long as the device is connected to the remote desktop or application server;
• the device is configured to send the meta-data associated with the state of the device, containing security relevant information, over the virtual channel to the remote desktop or application server using function calls, wherein in the event of a change in the meta-data associated with the state of the device, an updated meta-data associated with the state of the device is sent over the virtual channel to the remote desktop or application server;
• and
• the remote desktop or application server is configured to determine based on the received meta-data associated with the state of the device if an access to the remote desktop or remote application running in the user session is allowed, and is configured to block the access if the access is due to the received state not fulfilling definable security standards,
• wherein security information or privileges are addable or removable from an access token assigned to the user logged into the remote session based on the received meta-data associated with the state of the device or a composite connected device state.

A method for controlling the access of a device to a remote desktop or a remote application running on a remote desktop or application server using a remoting protocol, wherein the remoting protocol is used to capture graphics, audio, clipboard or storage from a remote session and deliver it to the device where it can be reconstructed to give the illusion that the remote desktop or application is running on the local device, comprising the following steps:

• setting up a connection between the device and the remote desktop or application server to establish or to join an existing user session, using the remoting protocol;
• setting up a virtual channel within the connection using the remoting protocol, the virtual channel provided by the remoting protocol;
• monitoring the device to determine meta-data associated with the state of the device by a service or plugin running on the device, wherein the monitoring is continued for as long as the device is connected to the remote desktop or application server;
• sending the meta-data associated with the state of the device, containing security relevant information, over the virtual channel to the remote desktop or application server using function calls, wherein in the event of a change in the meta-data associated with the state of the device, updated meta-data associated with the state of the device is sent over the virtual channel to the remote desktop or application server;
• and
• determining based on the received meta-data associated with the state of the device if an access to the remote desktop or remote application running in the user session is allowed, and blocking the access if the access is due to the received state not fulfilling definable security standards,
• wherein the meta-data associated with the state of the device comprises one or more of the following information of the device:
• network information including at least one of IP, MAC, Gateway addresses, WiFi Access Point;
• network security information including at least one of WiFi Encryption and Authentication Protocols;
• network performance information, including at least one of Bandwidth and Latency;
• metadata about the running Operating System, including at least one of the name, version, service pack level;
• installed applications;
• license state of installed applications or the operating system;
• running applications on the device;
• geographical location or elevation;
• information if the device is jailbroken or hacked in some way that compromises the security of the device;
• information about operating system updates, which have been applied to the device;
• is an Anti-Virus installed and up to date;
• security information of the logged in user, including their privileges, security group membership, domain membership,
• the meta-data associated with the state of the device being combinable by operators to represent a Composite Connected Device State, which is used to determine if access to the remote desktop or remote applications is allowed by the device.

A system for controlling the access of a device to a remote desktop or a remote application running on a remote desktop or application server using a remoting protocol, wherein the remoting protocol is used to capture graphics, audio, clipboard or storage from a remote session and deliver it to a device where it can be reconstructed to give the illusion that the remote desktop or application is running on the local device, comprising:

• a device with a network interface, configured to set up a connection between the device and remote desktop or application server to establish or to join an existing user session, using the remoting protocol;
• the device and the remote desktop or application server are configured to set up a virtual channel within the connection using the remoting protocol, the virtual channel provided by the remoting protocol;
• the device is configured to monitor and to determine meta-data associated with the state of the device, wherein the monitoring is continued for as long as the device is connected to the remote desktop or application server;
• the device is configured to send the meta-data associated with the state of the device, containing security relevant information, over the virtual channel to the remote desktop or application server using function calls, wherein in the event of a change in the meta-data associated with the state of the device, an updated meta-data associated with the state of the device is sent over the virtual channel to the remote desktop or application server;
• and
• the remote desktop or application server is configured to determine based on the received meta-data associated with the state of the device if an access to the remote desktop or remote application running in the user session is allowed, and is configured to block the access if the access is due to the received state not fulfilling definable security standards,
• wherein the meta-data associated with the state of the device comprises one or more of the following information of the device:
• network information including at least one of IP, MAC, Gateway addresses, Wi-Fi Access Point;
• network security information including at least one of Wi-Fi Encryption and Authentication Protocols;
• network performance information, including at least one of Bandwidth and Latency;
• metadata about the running Operating System, including at least one of the name, version, service pack level;
• installed applications;
• license state of installed applications or the operating system;
• running applications on the device;
• geographical location or elevation;
• information if the device is jailbroken or hacked in some way that compromises the security of the device;
• information about operating system updates, which have been applied to the device;
• is an Anti-Virus installed and up to date;
• security information of the logged in user, including their privileges, security group membership, domain membership,
• the meta-data associated with the state of the device being combinable by operators to represent a Composite Connected Device State, the Composite Connected Device State being used to determine if access to the remote desktop or remote applications is allowed by the device.