KR100946985B1 - Secure desktop operating system using virtual environment and the method thereof - Google Patents

Abstract

The present invention relates to a virtual desktop operating system and method for providing a secure desktop environment by separating and managing a virtual desktop according to a user's purpose, and monitoring a user's operation to verify system usage.

Desktop operating system using a virtual environment according to the present invention is characterized in that the desktop management unit responsible for user authentication, virtual desktop management, system monitoring, and a virtual desktop pool, which is classified according to the user's purpose and necessary to ensure safety.

According to the present invention, it is possible to provide a desktop environment to each desktop user at a low cost, and to ensure the stability of each individual desktop and data.

Virtual desktops, desktop operations

Description

Secure desktop operating system using virtual environment and its method {SECURE DESKTOP OPERATING SYSTEM USING VIRTUAL ENVIRONMENT AND THE METHOD THEREOF}

The present invention relates to a secure desktop operating system and method using a virtual environment. Specifically, the desktop operating system for providing a secure virtual desktop environment by separating and managing virtual desktops according to a user's purpose and verifying a user's system use. And to a method.

The present invention is derived from a study conducted as part of the IT new growth engine core technology development project of the Ministry of Information and Communication and the Ministry of Information and Communication Research and Development. [Task Management Number: 2006-S-035-02, Title: Open SW based virtual infrastructure implementation technology development].

Presently, in order to provide an independent desktop environment for each individual, there is a method of providing a desktop environment by first providing a physical system to each user or second, by giving an account to each individual in a large-capacity system.

However, in the case of the first method, a lot of costs occur in terms of system configuration and management, and in an environment where users change frequently, there is a problem in that the system needs to be reinstalled for each user's environment.

In the case of the second method, there is a weakness in security because each individual can directly access the resources of the system, and if a user causes a serious impact on the system, then the whole system may have a problem, causing all other problems. Users may not be able to take advantage of the system.

It is an object of the present invention to provide a secure desktop operating system and method for ensuring a secure and efficient desktop operating environment for a plurality of users through a virtual desktop.

Another object of the present invention is to provide a method for operating a virtual desktop to ensure providing an efficient desktop operating environment.

In order to achieve the above object, the present invention includes a desktop management unit that performs a user's access control, manages the virtual desktop, monitors the virtual desktop system, and the virtual desktop pool required for ensuring safety and separated according to the user's purpose It provides a desktop operating system using a virtual environment.

According to another aspect of the invention, the step of determining the universal user entitlement and privileges of the access user, the step of selecting and assigning the virtual desktop running in the universal virtual desktop pool to the user, and using the assigned virtual desktop A method of providing a general-purpose desktop operating environment using a virtual desktop, comprising the steps of: closing a user currently in use and returning the allocated virtual desktop.

According to still another aspect of the present invention, there is provided an authentication step of determining an individual user's entitlement and authority of an access user, selecting a personal virtual desktop corresponding to the access user from a personal virtual desktop pool, and selecting the selected personal virtual desktop. D) to the virtual desktop pool for verification and starting the desktop service based on the verification, monitoring the user's operation to confirm safety, and controlling the user's operation if it performs abnormal operation. If the operation is normal, the method for providing a personal desktop operating environment using a virtual desktop, including the step of migrating the verification virtual desktop from the verification virtual desktop pool to the personal virtual desktop pool, and terminating execution of the virtual desktop at the user's request Provided by .

According to the present invention, there is an advantage that can provide a desktop environment to each user safely at low cost by providing a desktop environment through a virtual environment. In addition, by dividing the user into a general user and an individual user, it is possible to secure the safety of personal data of the individual user.

According to the present invention, even in the case of individual users, the entire system can be safely operated by duplicating and monitoring the personal virtual desktop, and the personal data is copied and stored in a safe storage device when the personal virtual desktop is normally shut down. By doing so, it is possible to secure the safety of personal data.

Hereinafter, with reference to the accompanying drawings a preferred embodiment according to the present invention will be described in detail.

A user of a desktop according to the present invention is divided into a general user and a personal user. Universal user refers to a user who does not create personal data but merely performs actions such as Internet and document viewing.Individual user uses various software as well as general user's actions and creates and modifies data for each individual accordingly. Means the user performing delete, etc. That is, because of this, since the authority in the user-specific system is different, the present invention needs to perform a user authentication procedure. In other words, the general-purpose user does not need to go through the personal authentication procedure, but in the case of the individual user, it is preferable to go through the authentication process because personal data and the like are retained.

1 is a block diagram of a desktop operating system using a virtual environment according to the present invention.

The system consists of a desktop manager 100, a virtual desktop pool 200, and a personal data storage 300.

The desktop manager 100 is the first user to access the virtual desktop according to the present invention and is directly connected to an external network. When the first user accesses the system according to the present invention, the desktop manager 100 authenticates the user by checking the user's entitlement and authority, assigns the virtual desktop to the user, and performs calculation of the assigned virtual desktop. In addition, during the operation of the virtual desktop, the operation is performed to prevent damage to the entire system due to abnormal operation.

Accordingly, the desktop manager 100 performs a user authentication manager 110 that checks a user's authority and authenticates a user, a virtual desktop manager 120 that assigns and manages a virtual desktop to a user, and performs an assigned virtual desktop. It is preferably composed of a system monitoring manager 130 for monitoring the operation.

As described above, the user according to the present invention is preferably divided into a general user and an individual user, and thus provides another kind of virtual desktop. Therefore, the virtual desktop pool 200 according to the present invention is divided into a universal virtual desktop pool 210 and a personal virtual desktop pool 220, and the personal virtual desktop may be damaged because the personal virtual desktop may be damaged due to abnormal use. It is desirable to have a virtual desktop pool 230 for verification to prevent. In addition, each virtual desktop pool consists of multiple physical server systems, and each virtual desktop is created, executed, and terminated on these physical server systems.

In the case of a universal user, the user authentication manager 110 confirms that the user is a universal user, and delivers the virtual desktop in the universal virtual desktop pool 210 to the virtual desktop manager 120 so that the user can access the desktop environment. .

In the case of the individual user, the user authentication manager 110 authenticates the individual user, selects a personal virtual desktop corresponding to the user connected from the personal virtual desktop pool 220, and copies it to the verification virtual desktop pool 230. In addition, the virtual environment is delivered to the virtual desktop manager 120 to provide a desktop environment. At this time, the individual user may have personal data, which is stored in the personal data storage unit 300 and then copied to the local file system of the personal virtual desktop when the personal virtual desktop is executed and provided to the user. Detailed description thereof will be described below with reference to FIG. 3.

2 is a flowchart illustrating a method of providing a virtual desktop operating environment for a general purpose user according to the present invention. In describing FIG. 2, reference is made to FIG. 1 to help understand the description.

1 and 2, when the desktop manager 100 receives a desktop user's request for the first user, the user authentication manager 110 of the desktop manager 100 checks whether the access user is a universal user (S410). . The case of an individual user will be described below with reference to FIG. 3. If it is confirmed as a universal user, a suitable universal virtual desktop is selected from the universal virtual desktop pool 210 (S402). Thereafter, the general purpose virtual desktop is executed by the server system 212 (S403), and the general purpose virtual desktop executed by the server system 212 is transmitted to the virtual desktop manager 120. The virtual desktop manager 120 provides a desktop operating environment to the user by allowing the user to access the received universal virtual desktop (S230). When the desktop end request of the user is input, the virtual desktop manager 120 terminates the user's connection, and the virtual desktop assigned to the general purpose user is returned to the virtual desktop manager 120. The general purpose virtual desktop currently operating in the virtual desktop manager 120 may be maintained by the general purpose virtual desktop pool 210 because other general purpose users are currently running or accessing the same.

3 is a flowchart illustrating a method of providing a virtual desktop operating environment for an individual user according to the present invention. In describing FIG. 3, FIG. 1 is referred to together to help understand the description.

1 and 3, when the desktop manager 100 receives a first user's use request, the user authentication manager 110 of the desktop manager 100 authenticates whether the access user is an individual user (S310). If authenticated as an individual user, the virtual desktop manager 120 selects the personal virtual desktop of the individual user from the personal virtual desktop pool (S320). Detailed description of the authentication procedure of each individual and the selection of the personal virtual desktop will be described below with reference to FIG. 4.

When the virtual desktop manager 120 selects the personal virtual desktop, in order to provide safety of the personal virtual desktop and the personal data, the virtual desktop manager 120 replicates the selected personal virtual desktop to the verification virtual desktop pool (S330). This is to monitor the performance by copying the personal virtual desktops to the pool of virtual desktops for verification because abnormal operations of individual users can cause serious damage to the entire system.

In providing the personal virtual desktop to the user, if the personal data of the individual user already exists and stored in the personal data storage unit 300, the personal data by copying it to the local file system of the virtual desktop for verification Can be secured (S350).

As described above, when a user establishes a computing environment and performs various operations, in order to prevent damage to the personal desktop environment and personal data due to abnormal operations, the system monitoring manager 130 performs operations of individual users in the present invention. Monitor and control accordingly (S360). Detailed description of this monitoring and control will be made below with reference to FIG.

When the system monitoring manager 130 determines the user's operation as an abnormal operation (S370), or when the virtual desktop manager 120 receives the user's termination request (S380), the personal virtual desktop is a local file of the virtual desktop. After copying the personal data existing in the secure personal data storage unit 300, the execution of the user's virtual desktop is terminated (S390).

4 is a flowchart illustrating an authentication procedure of a person and a method of selecting a personal virtual desktop according to the present invention. In describing FIG. 4, FIG. 1 is referred to together to help understand the description.

1 and 4, when a user accesses the system according to the present invention, the user authentication manager 110 checks whether the user is initially registered for authentication or a new user (S321).

In the case of a registered user, after going through a user authentication procedure (S322), the virtual desktop manager searches for and selects the virtual desktop of the individual from the personal virtual desktop pool (S323).

In the case of a non-existent user, that is, a new user, the user authentication manager 110 creates an account as a new user at the time of user authentication and stores the same to perform authentication (S324). A new virtual desktop is created in the desktop pool, and it is selected and assigned to a user (S324).

5 is a flowchart illustrating a calculation operation monitoring method and a user calculation control method according to the present invention.

In the verification personal virtual desktop present in the verification virtual desktop pool, there is a monitoring agent that collects and monitors the contents of operations performed on the system, and the monitoring agent stores the collected operation information on the physical server system to which the virtual desktop belongs. 232 is sent to the monitoring server 233 present. The monitoring server 233 analyzes the received information and transmits the content to the virtual desktop manager 120 (S361).

The monitoring server 233 collects operation information of the user transmitted from the system monitoring manager for a predetermined time, analyzes it, and transmits the result to the virtual desktop manager 120 (S362).

The virtual desktop manager 120 may terminate the virtual desktop of the user running in the verification virtual desktop pool 230 or migrate to the personal virtual desktop pool 220 based on the analysis result of the received calculation information. Determine (S363).

When the user's operation is normal by the monitoring server 233, the virtual desktop manager 120 requests the server system 232 to migrate the virtual desktop from the virtual desktop pool 230 for verification to the personal virtual desktop pool 220. (S364). The server system 222 creates and executes the migrated virtual desktop in the personal virtual desktop pool 220, and thus, the original virtual desktop that is already present is already old and thus deleted (S365). At this time, since the live migration is performed, the desktop service is continuously provided to the user without interruption.

If the user's operation is abnormal, the virtual desktop manager 120 asks the verification server system 232 to terminate the personal virtual desktop, and the verification server system 232 performs this, thereby performing the original personal virtual desktop. Personal data is prevented from being damaged (S366).

6 is a schematic diagram illustrating a method for providing a virtual desktop provided to an individual user who has undergone an authentication procedure according to the present invention.

After the authentication process, the original virtual desktop 221a corresponding to the individual user 10a in the personal server system 222 is found.

The original personal virtual desktop 221a in the personal server system 222 is duplicated to generate a personal virtual desktop 231a that is replicated in the verification server system 232 (S601).

The cloned personal virtual desktop 231a is executed, and the personal data is copied from the personal data storage unit 300 and stored in the local file system of the cloned personal virtual desktop 231a (S602).

The monitoring agent 234, which starts the virtual desktop service to the user and monitors the operation of the cloned personal virtual desktop 231a, collects and transmits the data to the monitoring server 233 of the verification server system 232 ( S603).

The monitoring server 233 of the verification server system 232 transmits the analysis result of the monitoring data collected for a predetermined period to the virtual desktop manager 120 of the desktop managing unit 100 (S604).

The virtual desktop manager 120 of the desktop manager 100 informs the verification server system 232 of whether to terminate the currently running cloned personal virtual desktop 231a or perform a live migration to the personal server system 222. (S605).

When the safety is verified by the step S605, the migrated personal virtual desktop 231a of the verification server system 232 is migrated to the personal server system 222 to generate the migrated personal virtual desktop 221a`. In operation S606, the original personal virtual desktop 221a is deleted.

When receiving a desktop use termination request from the user, the personal data stored in the local file system of the migrated personal virtual desktop 221a` is copied to the personal data storage device 300 and the virtual desktop service is terminated (S607).

FIG. 7 is an overall flowchart of the present invention described with reference to FIGS. 1 to 6. In describing FIG. 7, reference is made to FIG. 1 to help understand the description.
Referring to FIG. 7, the desktop user requests the desktop manager 100 to start (S700). The user authentication manager 110 of the desktop manager 100 determines whether the desktop user who has requested to start is a personal user (S701). That is, it is determined whether it is a general user or a personal user.
If it is not a personal user, i.e., confirmed as a universal user, the virtual desktop manager 120 selects a universal virtual desktop running in the universal virtual desktop pool 210, and the server system 212 is executed. The universal virtual desktop is transmitted to the virtual desktop manager 120. The virtual desktop manager 120 connects the user to the received universal virtual desktop (S705). Accordingly, the use of the universal desktop of the universal user is started (S708). Then, when the virtual desktop manager 120 receives the desktop end request of the universal user (S710), the user's connection is terminated (S721).
If the desktop user is a personal user, the user authentication manager 110 of the desktop manager 100 determines whether the desktop user is a new user (S702). If the user is not a new user, that is, a registered user, the user authentication manager 110 performs the authentication procedure of the registered user (S704), and the server system 222 performs the personal virtualization in the personal virtual desktop pool 221. The desktop is selected (S707).
If the desktop user is a new user, generate a new user's certificate (S706), the server system 222 creates a new personal virtual desktop (S709), and verifies the personal virtual desktop created by the virtual desktop manager 120. The virtual desktop pool is cloned (S709), and the cloned virtual desktop is executed (S711). Thereafter, the data stored in the personal data storage unit 300 is copied to the local file system of the verification virtual desktop (S712), and thus, the user's use of the personal virtual desktop is started (S713).
Thereafter, the system monitoring manager 130 monitors the execution process of the personal virtual desktop for a predetermined period of time (S713), and determines whether there is an abnormal operation (S714).
If it is determined that the user's operation is normal by the system monitoring manager 130, the virtual desktop manager 120 provides the server system 232 with the personal virtual desktop pool 221 in the virtual desktop pool 230 for verifying the virtual desktop. Request a migration (S716). Thereafter, the server system 222 removes the original personal virtual desktop in the personal virtual desktop pool (S718). When the desktop management unit 100 receives a request for terminating the personal virtual desktop (S718), the server system 222 copies local data of the local file system of the personal virtual desktop to the personal data storage unit 300 and ends the desktop. (S720).

As mentioned above, the configuration of the present invention has been described in detail with reference to the preferred embodiments and the accompanying drawings, which are only examples and it will be apparent to those skilled in the art that various modifications and changes are possible within the scope of the technical idea of the present invention.

Therefore, the scope of the present invention should be defined based on the description of the claims below.

1 is a block diagram of a desktop operating system using a virtual environment according to the present invention.

2 is a flow chart illustrating a method for providing a virtual desktop operating environment for a general purpose user according to the present invention.

3 is a flowchart illustrating a method of providing a virtual desktop operating environment for an individual user according to the present invention.

Figure 4 is a flow chart illustrating an authentication process of a person and a method of selecting a personal virtual desktop according to the present invention.

5 is a flow chart for a calculation operation monitoring and user operation control method of the user according to the present invention.

6 is a schematic diagram illustrating a method for providing a virtual desktop provided to an individual user who has undergone an authentication procedure according to the present invention.

7 is an overall flow chart of the invention, described above with respect to FIGS.

Claims (13)

A first server system for creating and executing a universal virtual desktop in the universal virtual desktop pool; A second server system for creating and executing a personal virtual desktop in a personal virtual desktop pool; A third server system for executing and verifying the personal virtual desktop generated by the second server system in a verification virtual desktop pool; And A desktop manager providing the universal virtual desktop to a universal user, migrating the verified personal virtual desktop to the personal virtual desktop pool, and providing the migrated personal virtual desktop to the individual user; Desktop operating system using a virtual environment comprising a. The method of claim 1, And a personal data storage unit for storing personal data of the individual user, wherein the stored personal data is copied to the third server system by the desktop manager. The method of claim 1 or 2, wherein the desktop management unit, A user authentication manager that determines the authentication and authority of users, including individual users and universal users, A virtual desktop manager that receives the universal virtual desktop and assigns it to the universal user, and receives the personal virtual desktop and assigns the personal virtual desktop to the personal user; System monitoring manager for monitoring the operations performed on the personal virtual desktop Desktop operating system using a virtual environment comprising a. The method of claim 3, wherein the user's authority, The authority of the general-purpose user to perform only operations that do not require data for each user, Individual user's authority to exist, create, modify, and delete data of each user Desktop operating system using a virtual environment comprising a. In a method for providing a computing environment based on a virtual desktop, A verification step in which the user authentication manager of the desktop management determines the universal user entitlement and authority of the access user; A virtual desktop manager of the desktop management unit selecting a running virtual desktop from a universal virtual desktop pool and assigning the selected virtual desktop to a user; Executing the assigned virtual desktop by a server system interworking with the desktop manager; The virtual desktop manager disconnects the currently connected user and returns the allocated virtual desktop to the server system; Method for providing a universal desktop operating environment using a virtual desktop comprising a. The method of claim 5, wherein terminating the virtual desktop comprises: And terminating execution of the virtual desktop of the access user after the server system copies the personal data existing in the local file of the virtual desktop to the personal data storage unit. In a method for providing a computing environment based on a virtual desktop, (a) an authentication step in which the user authentication manager of the desktop management unit determines the individual user entitlement and authority of the access user; (b) the virtual desktop manager of the desktop management unit selecting a personal virtual desktop corresponding to the access user from the personal virtual desktop pool; (c) the virtual desktop manager duplicating the selected personal virtual desktop to a verification virtual desktop pool and starting desktop services based thereon; (d) monitoring, by the system monitoring administrator of the desktop management unit, a user's operation on the verification virtual desktop and confirming safety; (e) migrating the personal virtual desktop from the verification virtual desktop pool to the personal virtual desktop pool when the monitoring results indicate that the user's operation is normal; (f) terminating execution of the personal virtual desktop migrated to the personal virtual desktop pool upon receiving a user's termination request; Method for providing a personal computing environment using a virtual desktop comprising a. The method of claim 7, wherein the step (a), Confirming whether the user authentication manager of the desktop manager is a registered user; If the user is an unregistered new user, the user authentication manager creates a user account, and a server system interworking with the desktop manager creates a new personal virtual desktop corresponding to the user account in the personal virtual desktop pool. Method for providing a personal computing environment using a virtual desktop further comprising a. The method of claim 7, wherein step (c) is Replicating the user's personal data from the personal data storage by the virtual desktop manager of the desktop manager to the local file system of the virtual desktop for verification; Method for providing a personal computing environment using a virtual desktop further comprising a. The method of claim 7, wherein step (d), A monitoring agent in the replicated personal virtual desktop monitoring a user's operation and transmitting the monitoring result to the monitoring server of the verification server system as monitoring data; Transmitting, by the monitoring server of the verification server system, an analysis result of the monitoring data collected for a predetermined period to a virtual desktop manager; The virtual desktop manager of the desktop management unit notifies the server system for verification whether to terminate the currently running cloned personal virtual desktop or perform real-time migration to the personal server system. Method for providing a personal computing environment using a virtual desktop further comprising a. The method of claim 7, wherein in the step (e), the user's operation is a normal operation, Creating and executing the migrated personal virtual desktop by the virtual desktop manager of the desktop manager; Deleting an existing original personal virtual desktop by the virtual desktop manager of the desktop manager Method for providing a personal computing environment using a virtual desktop comprising a. The method of claim 7, wherein in the step (e), the user's operation is abnormal, Requesting the desktop administrator to terminate the user's use of the virtual desktop by the verification virtual desktop manager; The desktop manager terminating execution of the selected personal virtual desktop in the verification virtual desktop manager; Method for providing a personal computing environment using a virtual desktop further comprising a. The method of claim 7, wherein the step (f), When the desktop manager receives the user's termination request, transmitting the personal data existing in the local file system of the personal virtual desktop to the personal data storage unit; Terminating execution of the personal virtual desktop; Method for providing a personal computing environment using a virtual desktop further comprising a.

Images