# US 2016/0366173 A1 · Security of VDI Clones

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2016/0366173 A1
- Document ID: US20160366173A1
- Status: Published application
- Kind: A1
- Application number: 14/738,608
- Filed: 2015-06-12
- Published: 2016-12-15
- Earliest claimed: 2015-06-12
- Assignees: McAfee, Inc.
- Applicants: McAfee, Inc.
- Inventors: Sriranga Seetharamaiah
- Web page: https://patentgrep.com/patent/US20160366173A1

## CPC

- H04L 63/1433: {Vulnerability analysis}
- G06F 9/452: {Remote windowing, e.g. X-Window System, desktop virtualisation (protocols for virtual reality H04L67/131)}
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 21/562: {Static detection}
- G06F 21/567: {using dedicated hardware}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- G06F 8/63: {Image based installation; Cloning; Build to order}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Utilizing a virtual desktop interface, including receiving, from a server, a clone image comprising an instance of an operating system and an application executing on the server, and a copy of scan results, identify initiation of the application using the clone image, in response to identifying initiation of the application, determine that the copy of scan results includes scan results of the application, and in response to determining the copy of scan results includes scan results of the application, executing the application without any further scan of the application.

## Claims

### Claim 1

A machine readable medium on which instructions are stored, comprising instructions that when executed cause a machine to:
receive, from a server, a clone image comprising an instance of an operating system and an application hosted by the server, and a copy of scan results;
identify initiation of the application using the clone image;
in response to identifying initiation of the application, determine that the copy of scan results includes scan results of the application; and
in response to determining the copy of scan results includes scan results of the application, execute the application without any further scan of the application.

### Claim 2 (depends on 1)

The machine readable medium of claim 1, further comprising instructions that when executed cause the machine to:
determine that the copy of the scan results has expired; and
in response to determining that the copy of the scan results have expired:
scan the application, and
update the scan results to obtain updated scan results.

### Claim 3 (depends on 2)

The machine readable medium of claim 2, further comprising instructions that when executed cause the machine to:
deploy the updated scan results to clients executing additional clone images and connected to the machine across a network.

### Claim 4 (depends on 1)

The machine readable medium of claim 1, wherein the clone image comprises a read-only layer and a cache snapshot layer, wherein the read-only layer comprises the instance of the operating system and the application, and wherein the cache snapshot layer includes the copy of the scan results.

### Claim 5 (depends on 5)

The machine readable medium of claim 5, wherein the clone image further comprises a copy-on-write layer configured to store modifications to the clone image by a local client device.

### Claim 6

A system for utilizing a virtual desktop interface, comprising:
one or more processors; and
a memory, coupled to the one or more processors, on which instructions are stored comprising instructions which, when executed by the one or more processors cause the one or more processors to:
receive, from a server, a clone image comprising an instance of an operating system and an application hosted by the server, and a copy of scan results;
identify initiation of the application using the clone image;
in response to identifying initiation of the application, determine that the copy of scan results includes scan results of the application; and
in response to determining the copy of scan results includes scan results of the application, execute the application without any further scan of the application.

### Claim 7 (depends on 6)

The system of claim 6, the instructions further comprising instructions that when executed cause the one or more processors to:
determine that the copy of the scan results has expired; and
in response to determining that the copy of the scan results have expired:
scan the application, and
update the scan results to obtain updated scan results.

### Claim 8 (depends on 7)

The system of claim 7, the instructions further comprising instructions that when executed cause the one or more processors to:
deploy the updated scan results to clients executing additional clone images and connected to the machine across a network.

### Claim 9 (depends on 6)

The system of claim 6, wherein the clone image comprises a read-only layer and a cache snapshot layer, wherein the read-only layer comprises the instance of the operating system and the application, and wherein the cache snapshot layer includes the copy of the scan results.

### Claim 10 (depends on 9)

The system of claim 9, wherein the clone image further comprises a copy-on-write layer configured to store modifications to the clone image by a local client device.

### Claim 11

A method for utilizing a virtual desktop infrastructure, comprising:
receiving, from a server, a clone image comprising an instance of an operating system and an application hosted by the server, and a copy of scan results;
identifying initiation of the application using the clone image;
in response to identifying initiation of the application, determining that the copy of scan results includes scan results of the application; and
in response to determining the copy of scan results includes scan results of the application, executing the application without any further scan of the application.

### Claim 12 (depends on 11)

The method of claim 11, further comprising:
determining that the copy of the scan results has expired; and
in response to determining that the copy of the scan results have expired:
scanning the application, and
updating the scan results to obtain updated scan results.

### Claim 13 (depends on 12)

The method of claim 12, further comprising:
deploying the updated scan results to clients executing additional clone images and connected to the machine across a network.

### Claim 14 (depends on 11)

The method of claim 11, wherein the clone image comprises a read-only layer and a cache snapshot layer, wherein the read-only layer comprises the instance of the operating system and the application, and wherein the cache snapshot layer includes the copy of the scan results.

### Claim 15 (depends on 14)

The method of claim 14, wherein the clone image further comprises a copy-on-write layer configured to store modifications to the clone image by a local client device.

### Claim 16

A machine readable medium on which instructions are stored, comprising instructions that when executed cause a machine to:
generate a base image comprising a first instance of an operating system and a first instance of an application hosted by a server;
perform a scan on the base image to obtain scan results;
generate the clone image to include a second instance of the operating system, a second instance of the application, and a copy of the scan results; and
deploy the clone image to the client,
wherein the clone image is configured to allow the client to execute the clone image without scanning the clone image.

### Claim 17 (depends on 16)

The machine readable medium of claim 16, further comprising instructions that when executed cause the machine to:
determine that the scan results have expired; and
in response to determining that the scan results have expired:
scan the application,
update the scan results to obtain updated scan results, and
deploy the updated scan results to the client.

### Claim 18 (depends on 17)

The machine readable medium of claim 17, wherein the instructions that when executed cause the machine to deploy the updated scan results to the client comprise instructions that when executed cause the machine to deploy, to the client, an updated clone image comprising the updated scan results.

### Claim 19 (depends on 16)

The machine readable medium of claim 16, wherein the clone image comprises a read-only layer and a cache snapshot layer, wherein the read-only layer comprises the first instance of the operating system and the application, and wherein the cache snapshot layer includes the copy of the scan results.

### Claim 20 (depends on 19)

The machine readable medium of claim 19, wherein the clone image further comprises a copy-on-write layer configured to store modifications to the clone image by a local client device.

### Claim 21

A method for providing a virtual desktop infrastructure, the method comprising:
generating a base image comprising a first instance of an operating system and a first instance of an application hosted by a server;
performing a scan on the base image to obtain scan results;
generating the clone image to include a second instance of the operating system, a second instance of the application, and a copy of the scan results; and
deploying the clone image to the client,
wherein the clone image is configured to allow the client to execute the clone image without scanning the clone image.

### Claim 22 (depends on 21)

The method of claim 21, further comprising:
determining that the scan results have expired; and
in response to determining that the scan results have expired:
scanning the application,
updating the scan results to obtain updated scan results, and
deploying the updated scan results to the client.

### Claim 23 (depends on 22)

The method of claim 22, wherein deploying the updated scan results to the client comprises deploying, to the client, an updated clone image comprising the updated scan results.

### Claim 24 (depends on 21)

The method of claim 21, wherein the clone image comprises a read-only layer and a cache snapshot layer, wherein the read-only layer comprises the first instance of the operating system and the application, and wherein the cache snapshot layer includes the copy of the scan results.

### Claim 25 (depends on 24)

The method of claim 24, wherein the clone image further comprises a copy-on-write layer configured to store modifications to the clone image by a local client device.