English:
[0001] Embodiments described herein generally relate to virtual desktop infrastructure clones, and more particularly to providing security in virtual desktop interface clones.
[0003] In a typical VDI solution, a base image with the required operating system and necessary applications is created. These applications may include antivirus solutions, such as McAfee antivirus solutions. Clone images of the base image are generated and distributed among host clients across a network, and each clone image is responsible for scanning its own applications.
[0004] FIG. 1 is a diagram illustrating a network of programmable devices according to one or more embodiments.
[0005] FIG. 2 is a diagram illustrating a system for providing security in a VDI according to one or more embodiments.
[0006] FIG. 3 is a flow diagram illustrating a technique for executing an application within a VDI, according to one or more embodiments.
[0007] FIG. 4 is a flow diagram illustrating a technique for providing a VDI according to one or more embodiments
[0008] In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the invention. It will be apparent, however, to one skilled in the art that the invention may be practiced without these specific details. In other instances, structure and devices are shown in block diagram form in order to avoid obscuring the invention. References to numbers without subscripts or suffixes are understood to reference all instance of subscripts and suffixes corresponding to the referenced number. Moreover, the language used in this disclosure has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter. Reference in the specification to "one embodiment" or to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiments is included in at least one embodiment of the invention, and multiple references to "one embodiment" or "an embodiment" should not be understood as necessarily referring to all the same embodiment.
[0009] As used herein, the term "computer system" can refer to a single computer or a plurality of computers working together to perform the function described as being performed on or by a computer system.
[0010] As used herein, the term "server" can refer to any computer system that is capable of communicating with and hosting an operating system and associating applications for another computer system across any type of network.
[0011] As used herein, the term "client" can refer to any computer system that is capable of executing a VDI provided by a server.
[0012] In one or more embodiments, a technique for providing VDI security is disclosed and may include deploying a clone image to a host client that includes an instance of an operating system and associated applications, along with scan results for the clone image. Further, in one or more embodiments, a server may manage scan results for a single base image and deploy copies of the scan results along with each clone image in the network. When new scan results are generated by a single instance, for example when the scanning technology has been updated, the updated scan results may be deployed throughout the network to replace the original scan results. In one or more embodiments, when an application is initiated by one of the host clients, the host client identifies the scan results that have been received from the server and, in response, allows execution of the application without scanning the application. Thus, in one or more embodiments, the disclosed techniques may reduce the time and resources required to execute clone images on host clients without sacrificing security.
[0013] Referring to the figures, FIG. 1 an example infrastructure 100 in which embodiments may be implemented is illustrated schematically. Infrastructure 100 contains computer networks 102. Computer networks 102 may include many different types of computer networks available today, such as the Internet, a corporate network, or a Local Area Network (LAN). Each of these networks can contain wired or wireless programmable devices and operate using any number of network protocols (e.g., TCP/IP). Networks 102 may be connected to gateways and routers (represented by 108), end user computers 106, and computer servers 104. Infrastructure 100 also includes cellular network 103 for use with mobile communication devices. Mobile cellular networks support mobile phones and many other types of mobile devices. Mobile devices in the infrastructure 100 are illustrated as mobile phones 110, laptops 112, and tablets 114. A mobile device such as mobile phone 110 may interact with one or more mobile provider networks as the mobile device moves, typically interacting with a plurality of mobile network towers 120, 130, and 140 for connecting to the cellular network 103. Although referred to as a cellular network in FIG. 1, a mobile device may interact with towers of more than one provider network, as well as with multiple non-cellular devices such as wireless access points and routers 108. In addition, the mobile devices 110, 112, and 114 may interact with non-mobile devices such as computers 104 and 106 for desired services. The functionality of the gateway device 108 may be implemented in any device or combination of devices illustrated in FIG. 1; however, most commonly is implemented in a firewall or intrusion protection system in a gateway or router.
[0014] In one or more embodiments, one or more of the devices connected across network 102 may support a VDI. Devices that support a virtual desktop infrastructure may include a server 104 and various end user devices, such as computers 106. A virtual desktop infrastructure may include the server 104 hosting a desktop operating system within a virtual machine (VM), and providing access to the virtual machines to the host clients 106.
[0015] In one or more embodiments, each VM includes an instance of an operating system along with applications to be used by users at each client. The applications may include user applications, as well as security applications, such as a virus scanner, malware identifier, or other security software. In one or more embodiments, the server generates clone images to include the operating system and applications and deploy the clone images to the VMs to be accessed by the clients. As part of generating the clone images, or anytime during hosting the base image, the server may provide scan results as part of the clone images. The clone images may be configured such that when a user initiates an application, the clone image identifies the scan results and, in response, launches the application without performing a scan.
[0016] FIG.2 is a diagram illustrating a system for providing security in VDI clone images. FIG.2 includes three devices, including Server 205, and Client 250, and Client 275, connected across Network 200. Network 200 may be any type of computer network, such as a LAN or a corporate network. For example, Network 200 may include a subset of the devices included in larger network 102 or 103. Network 200 may be a network enclave within a larger general network. It should be understood that the components are depicted in Fig. 2 as an example embodiment, and some or all of the various components may be located, for example, within a single server, multiple servers, network storage, or other network devices.
[0017] Server 205 includes a processor core 215. Processor core 215 may be the core for any type of processor, such as a micro-processor, an embedded processor, a digital signal processor (DSP), a network processor, or other device to execute code. Although only one processor core is illustrated in each trusted device in FIG.2, a processing element may alternatively include more than one of the processor core 215 illustrated in FIG. 2. Processor core 215 may each be a singlethreaded core or, for at least one embodiment, processor core 215 may be multithreaded in that it may include more than one hardware thread context (or "logical processor") per core.
[0018] Server 205 also includes a memory coupled to the processor. Memory 210 may be any of a wide variety of memories (including various layers of memory hierarchy) as are known or otherwise available to those of skill in the art. Program code, or instructions, such as the operating system 230, the user applications 235, security module 240, and VDI module 244, may be stored in, for example, volatile and/or non-volatile memory, such as storage devices and/or an associated machine readable or machine accessible medium including solid-state memory, hard-drives, floppy-disks, optical storage, tapes, flash memory, memory sticks, digital video disks, digital versatile discs (DVDs), etc., as well as more exotic mediums such as machine-accessible biological state preserving storage. A machine readable medium may include any mechanism for storing, transmitting, or receiving information in a form readable by a machine, and the medium may include a tangible, non-transitory medium through which the program code may pass, such as antennas, optical fibers, communications interfaces, etc. Program code may be transmitted in the form of packets, serial data, parallel data, etc., and may be used in a compressed or encrypted format. The processor core 215 follow a program sequence of instructions indicated by the code. In this manner, processor core 215 is transformed during execution of the code.
[0019] Although not illustrated in FIG. 2, a processing element may include other elements on chip with the processor core 215. For example, a processing element may include memory control logic along with the processor cores. The processing element may include I/O control logic and/or may include I/O control logic integrated with memory control logic. The processing element may also include one or more caches.
[0020] Through the VDI module 244, the server 205 may provide the operating system 230, user applications 235, and security module 240 to client 250 and client 275. The operating system 230 manages execution of the various applications. User applications 235 may be any applications that allow a user to perform some actions through the computer systems. Security module 240 may be any security program that scans the user applications. For example, security module 240 may include an antivirus or other security program that is configured to scan a system for malicious content. Security module 240 may store the results of a scan as scan results 245 in storage 220.
[0021] In one or more embodiments, the applications may be provided to clients 250 and 275 in the form of virtual machines. Virtual machines can include their own processors, memory, storage, or other components typically found in a computer system. In one or more embodiments, the server 205, or other network device may include hypervisors that are configured to create and manage the virtual machines.
[0022] In one or more embodiments, VDI module 244 manages a base image 242 that includes the operating system 230, user applications 235, security module 240, as well as scan results 245, and provides them as clone images 255 and 280. Clone images may be provided to the clients in the form of a virtual machine on the server 205 or other network device. In one or more embodiments, the clone images 255 and 280 include read-only snapshots 270 and 295, copies of the scan results 265 and 290, and copy-on-write (COW) layers 260 and 285. Thus, for every deployment of a clone image, a new snapshot layer is created and each clone image includes a read-only layer, a COW layer, and a copy of the scan results. The clone images may be provisioned by the server and accessed by the client devices 250 and 275, for example, through the use of a virtual machine on the server. In one or more embodiments, the scan results may be included in a cache snapshot layer. The read-only snapshots 270 and 295 include an instance of the operating system 230, user applications 235, and security module 240, and any other applications to be used by the end user. Read-only snapshot 270 and read-only snapshot 295 are generated from the same components hosted in server 205, and thus are identical when deployed. Because they are readonly, users at client 250 and client 275 are unable to modify the files, they remain identical even while in use. Changes generated by a user are stored as COW layers 260 and 285, which are generated as part of the clone images 255 and 280. Although the clone image 255 and 280 are depicted as part of clients 250 and 275, in one or more embodiments, each of the base image 242 and clone images 255 and 280 may be stored on storage 220, or in another network storage not shown. That is, in one or more embodiments, the clone images 255 and 280 may be hosted on server 205 or network storage, and accessed via client 250 and client 275.
[0023] Typically, when an application is initialized, the application will have to be scanned for malicious content by security module 240 before it is loaded. In one or more embodiments, before the clone images 255 and 280 are provisioned, security module 240 scans the base image at the server and stores the results as scan results 245. Thus, whereas each client would typically separately have to scan the various applications, in one or more embodiments, the files only need to be scanned once in the base image, saving a significant amount of time and resources throughout the network. A copy of the scan results is included as part of the clone images as scan results 265 and scan results 290, and may be included as part of a cache of the base image. In one or more embodiments, the scan results may alternatively be included as part of COW layers 260 and 285. Thus, when a user at client 250, for example, initiates an application in read-only snapshot 270, the client 250 identifies the scan results 265 and, in response, determines that a scan is not necessary. Accordingly, the applications may be loaded without the security module 240 scanning the application. Loading the application without scanning the applications by client cuts down on processing time because each program does not have to be scanned at the host device, as it has already been scanned on the server.
[0024] In one or more embodiments, scan results may be updated occasionally. For example, the security module 240 may re-scan the base image when the clients are offline, or periodically, or when the security module 240 has been updated to identify new malicious content. The updated scan results are then used in new clone images, or propagated through the current clone images.
[0025] In the case of non-persistent provisioning of the clone image, for example, when a user at client 250 logs off the client, the COW layer 260 and the scan results 265 are erased. Thus, updated scan results are provided when a user logs into a client again. In the case of persistent provisioning of the clone image, the COW layer and the scan results may be retained in the client device. In this scenario, the COW layer and scan results may be updated whenever a new scan of the base image is completed.
[0026] Although not illustrated, Client 250 and Client 275 may also include a memory or storage and a processor. In one or more embodiments, the memory and processor of Client 250 and Client 275 allow the devices to execute clone image 255 and clone image 280, respectively. In one or more embodiments, clients 250 and 275 may also include I/O devices, such as display devices and user input devices that allow users of the clients to utilize the clone images.
[0027] FIG. 3 is a flow diagram illustrating a technique for executing an application within a VDI, according to one or more embodiments. FIG. 3 illustrates a method at client 250 in a network running a clone image 255. The method begins at 302, and a clone image is received. The clone image may include an application and a copy of scan results. As depicted in FIG. 2, the clone image may include the application has part of the read-only snapshot 270 that includes an instance of the operating system and various applications hosted by a server 205. The copy of the scan results may be received as part of the COW layer 260 of the clone image 255, or may be a new independent layer, as shown as scan results 265.
[0028] At 304, the client 250 identifies initiation of an application on the client. For example, a user may initiate an application, or an application may otherwise be loaded. As part of the loading process, or before loading the application, at 306, a determination is made regarding whether valid scan results for the application have been identified. Identifying that scan results for the application exist may indicate that the application has already been scanned by the security module 240, and another scan is not necessary. In one or more embodiments, determining whether valid scan results exist may include determining whether the scan results have expired, or are no longer valid for any other reason. If a determination is made at 306 that the scan results are not valid, then the method continues at 308, and the application is scanned. In one or more embodiments, the instance of the security module 240 in the read-only snapshot 270 may scan the application. Thus, in one or more embodiments, scanning the image could be accomplished on any virtual machine from one of the available clones. For example, results from a new scan that occurs at client 275 may be pushed to server 205 and/or client 250. The scan may need to only occur once for all of the clone images in the system until those scan results expire. In addition, the instance of the security module 240 in the read-only snapshot 270 may replace the scan results 265 with the updated scan results. Further, in one or more embodiments, the updated can results may be pushed to the clone images for all other clients in the system, either upon a user logging into a client device, or upon a refresh operation for a non-persistent clone instance. In one or more embodiments, a client may push updated scan results to other clients in the system, or may transmit updated scan results to the server to be propagated to other clients in the system. After 308, and in the event that valid scan results are identified at 308, the method continues at 310, and the application is allowed to execute without further scan.
[0029] FIG. 4 is a flow diagram illustrating a technique for providing a VDI according to one or more embodiments. Fig. 4 illustrates a server 205 generating and deploying clone images for clients. The method starts at 402 and the server 205 generates a base image including an instance of an application. For example, the VDI module 244 of the server 205 may generate the base image.
[0030] The method continues at 404, and the security module 240 performs a scan on the base image. As described above, the security module 240 may include an antivirus program, an antimalware program, or any other security program that scans for malicious content. In one or more embodiments, the security module 240 stores the scan results 245, and a copy of the scan results 245 is included in the base image.
[0031] The method continues at 406, and a request for a clone image of the base image is received. In one or more embodiments, a request may be received, for example, as the result of a user login to a client device, such as client 250 or client 275. At 408, the clone image is deployed to the remote client. The clone image may be deployed, for example, in the form of a virtual machine that is hosted by the server.
[0032] At 410, a determination is made regarding whether the scan results 245 are valid. As long as scan results are still valid at 410, then the same scan results are deployed to clone images at 414. Scan results 245 may become invalid, for example, after a predetermined period of time, or if the security module itself has been updated with new virus or other malware definitions, or for any other reason that may be indicated by the scan results.
[0033] If at 410 it is determined that the scan results are no longer valid, then at 412, the security module 412 performs a new scan on the base image, and at 414, the server stores the updated scan results and deploys the updated scan results to the clone images. The server may deploy the updated scan results, for example, upon a user requesting a new clone image at a client, or upon a user performing a refresh operation at a client. In addition, the server may push updated scan results during a client session.
[0034] It is to be understood that the various components of the flowchart described above, could occur in a different order or even concurrently. It should also be understood that various embodiments of the inventions may include all or just some of the components described above. Thus, the flowcharts are provided for better understanding of the embodiments, but the specific ordering of the components of the flow chart are not intended to be limiting unless otherwise described so.
[0035] Program instructions may be used to cause a general-purpose or special- purpose processing system that is programmed with the instructions to perform the operations described herein. Alternatively, the operations may be performed by specific hardware components that contain hardwired logic for performing the operations, or by any combination of programmed computer components and custom hardware components. The methods described herein may be provided as a computer program product that may include a machine readable medium having stored thereon instructions that may be used to program a processing system or other electronic device to perform the methods. The term "machine readable medium" used herein shall include any medium that is capable of storing or encoding a sequence of instructions for execution by the machine and that cause the machine to perform any one of the methods described herein. The term "machine readable medium" shall accordingly include, but not be limited to, tangible, nontransitory memories such as solid-state memories, optical and magnetic disks. Furthermore, it is common in the art to speak of software, in one form or another (e.g., program, procedure, process, application, module, logic, and so on) as taking an action or causing a result. Such expressions are merely a shorthand way of stating that the execution of the software by a processing system causes the processor to perform an action or produce a result.
[0036] The following examples pertain to further embodiments.
[0037] Example 1 is a machine readable medium on which instructions are stored, comprising instructions that when executed by a processor cause a machine to: receive, from a server, a clone image comprising an instance of an operating system and an application executing on the server, and a copy of scan results; identify initiation of the application using the clone image; in response to identifying initiation of the application, determine that the copy of scan results includes scan results of the application; and in response to determining the copy of scan results includes scan results of the application, executing the application without any further scan of the application.
[0038] In Example 2, the subject matter of Example 1 can optionally include instructions that further cause a machine to determine that the scan results have expired; and in response to determining that the scan results have expired: scan the application; and update the scan results to obtain updated scan results.
[0039] In Example 3, the subject matter of Example 2 can optionally include instructions that when executed cause a machine to deploy the updated scan results to remote clients executing additional clone images and connected to the local client device across a network.
[0040] In Example 4, the subject matter of Example 1 can optionally include the clone image comprises a read-only layer and a cache snapshot layer, wherein the read-only layer comprises the instance of the operating system and the application, and wherein the cache snapshot layer includes the copy of the scan results.
[0041] In Example 5, the subject matter of Example 3 can optionally include instructions that further cause a machine to the clone image further comprises a copy-on-write layer configured to store modifications to the clone image by a local client device.
[0042] Example 6 includes a system for utilizing a virtual desktop interface, including one or more processors; and a memory, coupled to the one or more processors, on which instructions are stored which, when executed by the one or more processors cause the one or more processors to receive, from a server, a clone image comprising an instance of an operating system and an application executing on the server, and a copy of scan results; identify initiation of the application using the clone image; in response to identifying initiation of the application, determine that the copy of scan results includes scan results of the application; and in response to determining the copy of scan results includes scan results of the application, executing the application without any further scan of the application.
[0043] In Example 7, the subject matter of Example 6 can optionally include instructions that when executed cause the one or more processors to determine that the scan results have expired; and in response to determining that the scan results have expired: scan the application, and update the scan results to obtain updated scan results.
[0044] In Example 8 the Example of claim 7 can optionally include instructions that when executed cause the one or more processors to deploy the updated scan results to remote clients executing additional clone images and connected to the local client device across a network.
[0045] In Example 9, the Example of claim 6 can optionally include the clone image comprises a read-only layer and a cache snapshot layer, wherein the readonly layer comprises the instance of the operating system and the application, and wherein the cache snapshot layer includes the copy of the scan results.
[0046] In Example 10, the Example of claim 9 can optionally include the clone image further comprises a copy-on-write layer configured to store modifications to the clone image by a local client device.
[0047] Example 11 includes a method for utilizing a virtual desktop infrastructure, comprising: receiving, from a server, a clone image comprising an instance of an operating system and an application hosted by the server, and a copy of scan results; identifying initiation of the application using the clone image; in response to identifying initiation of the application, determining that the copy of scan results includes scan results of the application; and in response to determining the copy of scan results includes scan results of the application, executing the application without any further scan of the application.
[0048] In Example 12, the Example of claim 11 can optionally include determining that the copy of the scan results has expired; and in response to determining that the copy of the scan results have expired: scanning the application, and updating the scan results to obtain updated scan results.
[0049] In Example 13, the Example of claim 12 may optionally include deploying the updated scan results to clients executing additional clone images and connected to the machine across a network.
[0050] In Example 14, the Example of claim 11 may optionally include wherein the clone image comprises a read-only layer and a cache snapshot layer, wherein the read-only layer comprises the instance of the operating system and the application, and wherein the cache snapshot layer includes the copy of the scan results.
[0051] In Example 15, the Example of claim 14 can optionally include wherein the clone image further comprises a copy-on-write layer configured to store modifications to the clone image by a local client device.
[0052] Example 16 includes a machine readable medium on which instructions are stored, comprising instructions that when executed cause a machine to: generate a base image comprising a first instance of an operating system and a first instance of an application hosted by a server; perform a scan on the base image to obtain scan results; generate the clone image to include a second instance of the operating system, a second instance of the application, and a copy of the scan results; and deploy the clone image to the client, wherein the clone image is configured to allow the client to execute the clone image without scanning the clone image.
[0053] In Example 17, the Example of claim 16 can optionally include instructions that when executed cause the machine to: determine that the scan results have expired; and in response to determining that the scan results have expired: scan the application, update the scan results to obtain updated scan results, and deploy the updated scan results to the client.
[0054] In Example 18, the Example of claim 17 can optionally include wherein the instructions that when executed cause the machine to deploy the updated scan results to the client comprise instructions that when executed cause the machine to deploy, to the client, an updated clone image comprising the updated scan results.
[0055] In Example 19, the Example of claim 16 can optionally include wherein the clone image comprises a read-only layer and a cache snapshot layer, wherein the read-only layer comprises the first instance of the operating system and the application, and wherein the cache snapshot layer includes the copy of the scan results.
[0056] In Example 20, the Example of claim 19 can optionally include wherein the clone image further comprises a copy-on-write layer configured to store modifications to the clone image by a local client device.
[0057] Example 21 includes a method for providing a virtual desktop infrastructure, the method comprising: generating a base image comprising a first instance of an operating system and a first instance of an application hosted by a server; performing a scan on the base image to obtain scan results; generating the clone image to include a second instance of the operating system, a second instance of the application, and a copy of the scan results; and deploying the clone image to the client, wherein the clone image is configured to allow the client to execute the clone image without scanning the clone image.
[0058] In Example 22, the Example of claim 21 can optionally include determining that the scan results have expired; and in response to determining that the scan results have expired: scanning the application, updating the scan results to obtain updated scan results, and deploying the updated scan results to the client.
[0059] In Example 23, the Example of claim 22 can optionally include wherein deploying the updated scan results to the client comprises deploying, to the client, an updated clone image comprising the updated scan results.
[0060] In Example 24, the Example of 21 can optionally include wherein the clone image comprises a read-only layer and a cache snapshot layer, wherein the read-only layer comprises the first instance of the operating system and the application, and wherein the cache snapshot layer includes the copy of the scan results.
[0061] In Example 25, the Example of 24 can optionally include wherein the clone image further comprises a copy-on-write layer configured to store modifications to the clone image by a local client device.
[0062] Example 26 includes a machine readable medium including code, when executed, to cause a machine to perform the methods of Examples 11-15.
[0063] Example 27 includes machine readable medium including code, when executed, to cause a machine to perform the methods of Examples 21-25.
[0064] Example 28 includes a network device, comprising: means for generating a base image comprising a first instance of an operating system and a first instance of an application hosted by a server; means for performing a scan on the base image to obtain scan results; means for generating the clone image to include a second instance of the operating system, a second instance of the application, and a copy of the scan results; and means for deploying the clone image to the client, wherein the clone image is configured to allow the client to execute the clone image without scanning the clone image.
[0065] In Example 29, the Example of 28 can optionally include means for determining that the copy of the scan results has expired; and means for, in response to determining that the copy of the scan results have expired: scanning the application, and updating the scan results to obtain updated scan results.
[0066] Example 30 includes a network device, comprising: means for generating a base image comprising a first instance of an operating system and a first instance of an application hosted by a server; means for performing a scan on the base image to obtain scan results; means for generating the clone image to include a second instance of the operating system, a second instance of the application, and a copy of the scan results; and means for deploying the clone image to the client, wherein the clone image is configured to allow the client to execute the clone image without scanning the clone image.
[0067] It is to be understood that the above description is intended to be illustrative, and not restrictive. For example, the above-described embodiments may be used in combination with each other. As another example, the above-described flow diagrams include a series of actions which may not be performed in the particular order depicted in the drawings. Rather, the various actions may occur in a different order, or even simultaneously. Many other embodiment will be apparent to those of skill in the art upon reviewing the above description. The scope of the invention should therefore should be determined with reference to the appended claims, along with the full scope of equivalents to which such claims are entitled.

中文:
[0001]本文所描述的实施例总体上涉及虚拟桌面基础设施克隆体,并且更具体地涉及提供虚拟桌面界面克隆体的安全性。
[0003]在典型的VDI解决方案中,具有所需操作系统和必要应用的基本图像被创建。这些应用可以包括杀毒解决方案,比如McAfee杀毒解决方案。基本图像的克隆图像被生成且跨网络分布于主机客户端之间,并且每个克隆图像负责扫描其自己的应用。
[0004]图1是图示,展示了根据一个或多个实施例的可编程设备的网络。
[0005]图2是图示,展示了根据一个或多个实施例的用于提供VDI的安全性的系统。
[0006]图3是流程图,展示了根据一个或多个实施例的用于执行VDI内的应用的技术。
[0007]图4是流程图,展示了根据一个或多个实施例的用于提供VDI的技术。
[0008]在以下描述中,出于解释的目的,阐述了许多具体的细节以便提供对本发明的透彻理解。然而,对于本领域技术人员而言,可以在不具有这些具体细节的情况下实践本发明将是明显的。在其他实例中,以框图的形式示出了结构和设备以避免使本发明模糊。对不带下标或后缀的数字的引用被理解为引用对应于被引用数字的所有下标和后缀的实例。此外,在本公开中使用的语言主要是为了可读性和指导的目的而被选择的,并且可能尚未被选择为描绘或限制创造性主题,有必要借助权利要求书来确定这样的创造性主题。在说明书中提及“一个实施例”或者“实施例”意味着结合实施例所描述的特定特征、结构或特性被包含在本发明的至少一个实施例中,并且多次提及“一个实施例”或“实施例”不应当被理解为一定是指所有相同的实施例。
[0009]如本文所使用的,术语“计算机系统”可指用于执行被描述为在计算机系统上或由计算机系统执行的功能的单台计算机或一起工作的多台计算机。
[0010]如在本文所使用的,术语“服务器”可以指能够与操作系统通信并托管(host)操作系统并且跨任何类型的网络与另一个计算机系统的应用关联的任何计算机系统。
[0011]如在本文所使用的,术语“客户端”可以指能够执行由服务器提供的VDI的任何计算机系统。
[0012]在一个或多个实施例中,公开了一种用于提供VDI安全性的技术并且所述技术可以包括向主机客户端部署(deploy)克隆图像以及克隆图像的扫描结果,该克隆图像包括操作系统和相关联应用的实例。进一步地,在一个或多个实施例中,服务器可以管理单个基本图像的扫描结果并且将扫描结果的副本与每个克隆图像一起部署在网络中。当新的扫描结果由单个实例生成时,例如当扫描技术已经更新时,可以贯穿网络部署更新后扫描结果以便替换原始扫描结果。在一个或多个实施例中,当应用由主机客户端之一启动时,主机客户端识别已经从服务器接收到的扫描结果,并且作为响应,允许在不扫描应用的情况下执行应用。因此,在一个或多个实施例中,所公开的技术可以减少在主机客户端上执行克隆图像所需的时间和资源而不牺牲安全性。
[0013]参照附图,在图1中,示意性地展示了可以实现实施例的示例基础设施100。基础设施100包含计算机网络102。计算机网络102可以包括当今可用的许多不同类型的计算机网络,如,互联网、企业网络或者局域网(LAN)。这些网络中的每一个网络可以包含有线或无线可编程设备并且可以使用任何数量的网络协议(例如,TCP/IP)来运行。网络102可以连接至网关和路由器(由108表示)、终端用户计算机106、以及计算机服务器104。基础设施100还包括用于与移动通讯设备一起使用的蜂窝网络103。移动蜂窝网络支持移动电话以及许多其他类型的移动设备。基础设施100中的移动设备被展示为移动电话110、膝上型计算机112、以及平板计算机114。当移动设备移动时,移动设备(如移动电话110)可以与一个或多个移动供应商网络进行交互,通常与多个移动网络塔120、130、和140进行交互以连接至蜂窝网络103。虽然在图1中被称为蜂窝网络,但是移动设备可以与多于一个供应商网络的塔以及与多个非蜂窝设备(如无线接入点和路由器108)进行交互。另外,移动设备110、112和114可以与诸如计算机104和106等非移动设备交互以获得所期望的服务。可以在图1中展示的任何设备或设备组合中实现网关设备108的功能;然而,最常见的是在网关或路由器中的防火墙或入侵防御系统中实现。
[0014]在一个或多个实施例中,跨网络102连接的设备中的一个或多个设备可以支持VDI。支持虚拟桌面基础设施的设备可以包括服务器104和各种终端用户设备,比如计算机106。虚拟桌面基础设施可以包括服务器104,所述服务器将桌面操作系统托管在虚拟机(VM)内并且向主机客户端106提供对虚拟机的访问。
[0015]在一个或多个实施例中,每个VM包括操作系统的实例以及由用户在每个客户端处使用的应用。应用可以包括用户应用,以及安全应用,比如病毒扫描器、恶意软件标识器或其他安全软件。在一个或多个实施例中,服务器生成克隆图像以便包括操作系统和应用,并向VM部署克隆图像以供客户端访问。作为生成克隆图像的一部分,或者在托管基本图像期间的任何时间,服务器可以提供扫描结果作为克隆图像的一部分。克隆图像可以被配置为使得当用户启动应用时,克隆图像识别扫描结果,并且作为响应,在不执行扫描的情况下启动应用。
[0016]图2是图示,展示了用于提供VDI克隆图像的安全性的系统。图2包括三种设备,包括跨网络200连接的服务器205以及客户端250和客户端275。网络200可以是任何类型的计算机网络,比如LAN或者企业网络。例如,网络200可以包括在更大的网络102或103中所包括的设备的子集。网络200可以是更大的普通网络内的网络飞地。应当理解,图2中将组件描绘为示例实施例,并且各种组件中的一些或全部可以位于例如单个服务器、多个服务器、网络存储设备或其他网络设备内。
[0017]服务器205包括处理器核215。处理器核215可以是针对任何类型处理器的核,如微型处理器、嵌入式处理器、数字信号处理器(DSP)、网络处理器、或用于执行代码的其他设备。尽管图2中的每个可信设备中仅展示了一个处理器核,但是处理元件可以替代性地包括多于一个图2中所展示的处理器核215。处理器核215各自可以是单线程核,或者对于至少一个实施例,处理器核215可以是多线程的,因为它可以包括每核多于一个硬件线程上下文(或“逻辑处理器”)。
[0018]服务器205还包括耦合至处理器的存储器。存储器210可以是如本领域技术人员已知或以其他方式可用的各种存储器(包括存储器层次结构中的各个层)中的任何一种。程序代码或指令(如操作系统230、用户应用235、安全模块240、和VDI模块244)可以存储在例如易失性存储器和/或非易失性存储器中,如存储设备和/或相关联的机器可读介质或机器可访问介质(包括固态存储器、硬盘驱动器、软盘、光存储设备、带、闪存、存储棒、数字视频盘、数字多功能盘(DVD)等等),以及如机器可读取生物状态保存存储设备等更特殊的介质。机器可读介质可以包括任何用于以机器可读的形式存储、传输、或接收信息的机制,并且所述介质可以包括程序代码可穿过的有形非暂态介质,如天线、光纤、通信接口等。程序代码可以以数据包、串行数据、并行数据等形式传输,并且可以以压缩或加密格式使用。处理器核215遵循由代码指示的指令程序序列。以此方式,在执行代码期间对处理器核215进行变换。
[0019]尽管图2未展示,但处理元件可以包括其他具有处理器核215的片上元件。例如,处理元件可以包括存储器控制逻辑以及处理器核。处理元件可以包括I/O控制逻辑,和/或可以包括与存储器控制逻辑集成的I/O控制逻辑。处理元件还可以包括一个或多个高速缓存。
[0020]通过VDI模块244,服务器205可以将操作系统230、用户应用235和安全模块240提供给客户端250和客户端275。操作系统230管理对各种应用的执行。用户应用235可以是允许用户通过计算机系统执行某些动作的任何应用。安全模块240可以是扫描用户应用的任何安全程序。例如,安全模块240可以包括被配置用于扫描系统以查找恶意内容的杀毒程序或其他安全程序。安全模块240可以将扫描的结果作为扫描结果245存储在存储设备220中。
[0021]在一个或多个实施例中,应用可以以虚拟机的形式提供给客户端250和275。虚拟机可以包括其自己的处理器、存储器、存储设备或通常在计算机系统中找到的其他组件。在一个或多个实施例中,服务器205或其他网络设备可以包括被配置用于创建和管理虚拟机的管理程序。
[0022]在一个或多个实施例中,VDI模块244管理包括操作系统230、用户应用235、安全模块240、以及扫描结果245的基本图像242,并且将它们提供为克隆图像255和280。克隆图像可以以服务器205或其他网络设备上的虚拟机的形式提供给客户端。在一个或多个实施例中,克隆图像255和280包括:只读快照270和295、扫描结果265和290的副本、以及写时复制(copy-on-write)(COW)层260和285。因此,对于克隆图像的每种部署,新的快照层被创建,并且每个克隆图像包括只读层、COW层和扫描结果的副本。克隆图像可以由服务器配设并且由客户端设备250和275访问,例如,通过使用服务器上的虚拟机。在一个或多个实施例中,扫描结果可以包括在缓存快照层中。只读快照270和295包括操作系统230、用户应用235、和安全模块240的实例,以及由终端用户使用的任何其他应用。只读快照270和只读快照295由托管于服务器205中的相同组件生成,并且因此在部署时是相同的。因为这些只读快照是只读的,所以客户端250和客户端275处的用户不能修改文件,即使在使用中它们也保持相同。由用户生成的改变被存储为作为克隆图像255和280的一部分生成的COW层260和285。虽然克隆图像255和280被描绘为客户端250和275的一部分,但是在一个或多个实施例中,基本图像242以及克隆图像255和280中的每一个都可以被存储在存储设备220上,或存储在未示出的另一个网络存储设备中。也就是说,在一个或多个实施例中,克隆图像255和280可以被托管在服务器205或网络存储设备上,并且可以经由客户端250和客户端275访问。
[0023]通常,当初始化应用时,应用将必须在其加载之前通过安全模块240来扫描恶意内容。在一个或多个实施例中,在配设克隆图像255和280之前,安全模块240扫描服务器处的基本图像并将结果存储为扫描结果245。因此,鉴于在一个或多个实施例中,每个客户端通常必须分别扫描各种应用,文件只需要在基本映像中被扫描一次,从而在整个网络中节省大量的时间和资源。扫描结果的副本作为克隆图像的一部分被包括为扫描结果265和扫描结果290,并且可以被包括为基本图像的缓存的一部分。在一个或多个实施例中,扫描结果可以替代性地被包括为COW层260和285的一部分。因此,当客户端250处的用户例如启动只读快照270中的应用时,客户端250识别扫描结果265,并且作为响应,确定扫描是不必要的。相应地,可以在安全模块240不扫描应用的情况下加载应用。客户端在不扫描应用的情况下加载应用减少了处理时间,因为不必在主机设备上扫描每个程序,因为已经在服务器上对其进行了过扫描。
[0024]在一个或多个实施例中,可能会偶尔更新扫描结果。例如,安全模块240可以在客户端离线时、或者周期性地或者当安全模块240已经被更新时重新扫描基本图像,以便识别新的恶意内容。然后,更新后扫描结果被用于新的克隆图像中,或通过当前克隆图像进行传播。
[0025]在非持续配设克隆图像的情况下,例如,当客户端250处的用户退出客户端时,COW层260和扫描结果265被擦除。因此,当用户再次登录客户端时,更新后扫描结果被提供。在持续配设克隆图像的情况下,可以将COW层和扫描结果保留在客户端设备中。在这种情景下,每当完成对基本图像的新扫描时,COW层和扫描结果可能被更新。
[0026]尽管未展示,但是客户端250和客户端275还可以包括存储器或存储设备和处理器。在一个或多个实施例中,客户端250和客户端275的存储器和处理器允许设备分别执行克隆图像255和克隆图像280。在一个或多个实施例中,客户端250和275还可以包括I/O设备,诸如允许客户端的用户利用克隆图像的显示设备和用户输入设备。
[0027]图3是流程图,展示了根据一个或多个实施例的用于执行VDI内的应用的技术。图3展示了网络中运行克隆图像255的客户端250处的方法所述方法在302处开始,并且接收克隆图像。克隆图像可以包括应用以及扫描结果的副本。如图2中描绘的,克隆图像可以包括具有只读快照270的一部分的应用,所述一部分包括由服务器205托管的操作系统和各种应用的实例。扫描结果的副本可以作为克隆图像255的COW层260的一部分被接收,或者可以是如被示出为扫描结果265的新独立层。
[0028]在304处,客户端250识别对客户端上应用的启动。例如,用户可以启动应用,或者可以以其他方式加载应用。作为加载过程的一部分,或者在加载应用之前,在306处,作出关于是否已经识别到应用的有效扫描结果的判定。识别到存在应用的扫描结果可以指示应用已经被安全模块240扫描,并且另一次扫描是不必要的。在一个或多个实施例中,判定是否存在有效的扫描结果可以包括判定扫描结果是已到期,还是出于任何其他原因不再有效。如果在306处确定扫描结果无效,则方法在308处继续,并扫描应用。在一个或多个实施例中,只读快照270中的安全模块240的实例可以扫描应用。因此,在一个或多个实施例中,对图像进行扫描可以在来自可用克隆体之一的任何虚拟机上完成。例如,在客户端275处发生的新扫描的结果可以被推送至服务器205和/或客户端250。对于系统中的所有克隆图像,扫描可能只需要发生一次,直到这些扫描结果到期。另外,只读快照270中的安全模块240的实例可以用更新后扫描结果来替换扫描结果265。进一步地,在一个或多个实施例中,或者在用户登录客户端设备时,或者在对非持续克隆实例进行刷新操作时,对于系统中的所有其他客户端,可以向克隆映像推送更新后扫描结果。在一个或多个实施例中,客户端可以将更新后扫描结果推送至系统中的其他客户端,或者可以将更新后扫描结果传输至服务器以便传播至系统中其他客户端。在308之后,并且在308处识别出有效的扫描结果的情况下,方法在310处继续,并且允许在不进行进一步扫描的情况下执行应用。
[0029]图4是流程图,展示了根据一个或多个实施例的用于提供VDI的技术。图4展示了为客户端生成和部署克隆图像的服务器205。所述方法在402处开始,并且服务器205生成包括应用的实例的基本图像。例如,服务器205的VDI模块244可以生成基本图像。
[0030]所述方法在404处继续,并且安全模块240对基本图像执行扫描。如以上所描述的,安全模块240可以包括杀毒程序、反恶意软件程序或扫描恶意内容的任何其他安全程序。在一个或多个实施例中,安全模块240存储扫描结果245,并且扫描结果245的副本被包括在基本图像中。
[0031]所述方法在406处继续,并且接收对基本图像的克隆图像的请求。在一个或多个实施例中,可以例如作为用户登录客户端设备(例如客户端250或客户端275)的结果而接收请求。在408处,向远程客户端部署克隆图像。例如,可以以由服务器托管的虚拟机的形式来部署克隆图像。
[0032]在410处,作出关于扫描结果245是否有效的判定。只要在410处扫描结果仍然有效,就在414处向克隆图像部署相同的扫描结果。例如,在预定时间段之后,或者如果安全模块本身已经更新有新的病毒或其他恶意软件定义,或者出于可以通过扫描结果来指示的任何其他原因,扫描结果245可能变得无效。
[0033]如果在410处确定扫描结果不再有效,则在412处,安全模块412对基本图像执行新的扫描,并且在414处,服务器存储更新后扫描结果并且向克隆图像部署更新后扫描结果。例如当用户在客户端处请求新的克隆图像时或者当用户在客户端处执行刷新操作时,服务器可以部署更新后扫描结果。另外,服务器可以在客户端会话期间推送更新后扫描结果。
[0034]应理解,上述流程图的各个组成部分可以以不同的顺序或甚至同时发生。还应理解,本发明的各个实施例可以包括上述组成部分中的全部或仅一些。因此,提供流程图是为了更好地理解实施例,但是除非另有说明,流程图组成部分的特定排序不旨在是限制性的。
[0035]程序指令可以用于使利用这些指令所编程的通用或专用处理系统执行本文中所描述的操作。替代性地,这些操作可以由含有用于执行这些操作的硬件连线的逻辑的特定硬件部件执行,或者由程序计算机部件和自定义硬件部件的任意组合执行。本文描述的方法可以作为计算机程序产品来提供,所述计算机程序产品可包括具有存储在其上的指令的机器可读介质,这些指令可以用来对处理系统或其他电子设备进行编程以执行所述方法。本文使用的术语“机器可读介质”应当包括能够存储或编码指令序列的任何介质,所述指令序列供机器执行并且使机器执行本文描述的任一种方法。从而,术语“机器可读介质”应该包括但不限于有形的、非暂态存储器,如固态存储器、光盘和磁盘。而且,在采取动作或导致结果时,提到一种形式或另一种形式(例如,程序、流程、过程、应用、模块、逻辑等等)的软件在本领域是常见的。这类表达仅仅是陈述由处理系统执行软件使得处理器执行动作或产生结果的速记方式。
[0036]下面的示例涉及进一步的实施例。
[0037]示例1是一种其上存储有指令的机器可读介质,所述指令包括当由处理器执行时使机器进行以下操作的指令:从服务器处接收克隆图像以及扫描结果的副本,所述克隆图像包括在所述服务器上执行的操作系统和应用的实例;使用所述克隆图像来识别对所述应用的启动;响应于识别到对所述应用的启动而确定所述扫描结果的副本包括对所述应用的扫描结果;以及响应于确定所述扫描结果的副本包括对所述应用的所述扫描结果而在不对所述应用进行任何进一步扫描的情况下执行所述应用。
[0038]在示例2中,如示例1所述的主题可以可选地包括进一步使机器进行以下操作的指令:确定所述扫描结果已到期;以及响应于确定所述扫描结果已到期而:扫描所述应用,并且更新所述扫描结果以便获得更新后扫描结果。
[0039]在示例3中,如示例2所述的主题可以可选地包括当被执行时使机器向执行附加克隆图像并且跨网络连接至本地客户端设备的远程客户端部署所述更新后扫描结果的指令。
[0040]在示例4中,如示例1所述的主题可以可选地包括:所述克隆图像包括只读层和缓存快照层,其中,所述只读层包括所述操作系统和所述应用的所述实例,并且其中,所述缓存快照层包括所述扫描结果的所述副本。
[0041]在示例5中,如示例3所述的主题可以可选地包括进一步使机器进行以下操作的指令:所述克隆图像进一步包括被配置用于存储由本地客户端设备对所述克隆图像进行的修改的写时复制层。
[0042]示例6包括一种用于利用虚拟桌面界面的系统,所述系统包括:一个或多个处理器;以及存储器,所述存储器耦合至所述一个或多个处理器,所述存储器上存储有指令,所述指令当由所述一个或多个处理器执行时使所述一个或多个处理器:从服务器处接收克隆图像以及扫描结果的副本,所述克隆图像包括在所述服务器上执行的操作系统和应用的实例;使用所述克隆图像来识别对所述应用的启动;响应于识别到对所述应用的启动而确定所述扫描结果的副本包括对所述应用的扫描结果;以及响应于确定所述扫描结果的副本包括对所述应用的所述扫描结果而在不对所述应用进行任何进一步扫描的情况下执行所述应用。
[0043]在示例7中,如示例6所述的主题可以可选地包括当被执行时使所述一个或多个处理器进行以下操作的指令:确定所述扫描结果已到期;以及响应于确定所述扫描结果已到期而:扫描所述应用并且更新所述扫描结果以便获得更新后扫描结果。
[0044]在示例8中,如权利要求7所述的示例可以可选地包括当被执行时使所述一个或多个处理器向执行附加克隆图像并且跨网络连接至本地客户端设备的远程客户端部署所述更新后扫描结果的指令。
[0045]在示例9中,如权利要求6所述的示例可以可选地包括:所述克隆图像包括只读层和缓存快照层,其中,所述只读层包括所述操作系统和所述应用的所述实例,并且其中,所述缓存快照层包括所述扫描结果的所述副本。
[0046]在示例10中,如权利要求9所述的示例可以可选地包括:所述克隆图像进一步包括被配置用于存储由本地客户端设备对所述克隆图像进行的修改的写时复制层。
[0047]示例11包括一种用于利用虚拟桌面基础设施的方法,所述方法包括:从服务器处接收克隆图像以及扫描结果的副本,所述克隆图像包括由所述服务器托管的操作系统和应用的实例;使用所述克隆图像来识别对所述应用的启动;响应于识别到对所述应用的启动而确定所述扫描结果的副本包括对所述应用的扫描结果;以及响应于确定所述扫描结果的副本包括对所述应用的所述扫描结果而在不对所述应用进行任何进一步扫描的情况下执行所述应用。
[0048]在示例12中,如权利要求11所述的示例可以可选地包括:确定所述扫描结果的所述副本已到期;以及响应于确定所述扫描结果的所述副本已到期而扫描所述应用并且更新所述扫描结果以便获得更新后扫描结果。
[0049]在示例13中,如权利要求12所述的示例可以可选地包括:向执行附加克隆图像并且跨网络连接至所述机器的客户端部署所述更新后扫描结果。
[0050]在示例14中,如权利要求11所述的示例可以可选地包括:其中,所述克隆图像包括只读层和缓存快照层,其中,所述只读层包括所述操作系统和所述应用的所述实例,并且其中,所述缓存快照层包括所述扫描结果的所述副本。
[0051]在示例15中,如权利要求14所述的示例可以可选地包括:其中,所述克隆图像进一步包括被配置用于存储由本地客户端设备对所述克隆图像进行的修改的写时复制层。
[0052]示例16包括一种其上存储有指令的机器可读介质,所述指令包括当被执行时使机器进行以下操作的指令:生成基本图像,所述基本图像包括由服务器托管的操作系统的第一实例和应用的第一实例;对所述基本图像执行扫描以便获得扫描结果;生成所述克隆图像以便包括所述操作系统的第二实例、所述应用的第二实例、以及所述扫描结果的副本;以及向所述客户端部署所述克隆图像,其中,所述克隆图像被配置用于允许所述客户端在不扫描所述克隆图像的情况下执行所述克隆图像。
[0053]在示例17中,如权利要求16所述的示例可以可选地包括当被执行时使所述机器进行以下操作的指令:确定所述扫描结果已到期;以及响应于确定所述扫描结果已到期而:扫描所述应用,更新所述扫描结果以便获得更新后扫描结果,并且向所述客户端部署所述更新后扫描结果。
[0054]在示例18中,如权利要求17所述的示例可以可选地包括:其中,当被执行时使所述机器向所述客户端部署所述更新后扫描结果的所述指令包括当被执行时使所述机器向所述客户端部署包括所述更新后扫描结果的更新后克隆图像的指令。
[0055]在示例19中,如权利要求16所述的示例可以可选地包括:其中,所述克隆图像包括只读层和缓存快照层,其中,所述只读层包括所述操作系统和所述应用的所述第一实例,并且其中,所述缓存快照层包括所述扫描结果的所述副本。
[0056]在示例20中,如权利要求19所述的示例可以可选地包括:其中,所述克隆图像进一步包括被配置用于存储由本地客户端设备对所述克隆图像进行的修改的写时复制层。
[0057]示例21包括一种用于提供虚拟桌面基础设施的方法,所述方法包括:生成基本图像,所述基本图像包括由服务器托管的操作系统的第一实例和应用的第一实例;对所述基本图像执行扫描以便获得扫描结果;生成所述克隆图像以便包括所述操作系统的第二实例、所述应用的第二实例、以及所述扫描结果的副本;以及向所述客户端部署所述克隆图像,其中,所述克隆图像被配置用于允许所述客户端在不扫描所述克隆图像的情况下执行所述克隆图像。
[0058]在示例22中,如权利要求21所述的示例可以可选地包括:确定所述扫描结果已到期;以及响应于确定所述扫描结果已到期而:扫描所述应用,更新所述扫描结果以便获得更新后扫描结果,并且向所述客户端部署所述更新后扫描结果。
[0059]在示例23中,如权利要求22所述的示例可以可选地包括:其中,向所述客户端部署所述更新后扫描结果包括向所述客户端部署包括所述更新后扫描结果的更新后克隆图像。
[0060]在示例24中,如21所述的示例可以可选地包括:其中,所述克隆图像包括只读层和缓存快照层,其中,所述只读层包括所述操作系统和所述应用的所述第一实例,并且其中,所述缓存快照层包括所述扫描结果的所述副本。
[0061]在示例25中,如24所述的示例可以可选地包括:其中,所述克隆图像进一步包括被配置用于存储由本地客户端设备对所述克隆图像进行的修改的写时复制层。
[0062]示例26包括一种包括代码的机器可读介质,所述代码当被执行时使机器执行如示例11至15所述的方法。
[0063]示例27包括一种包括代码的机器可读介质,所述代码当被执行时使机器执行如示例21至25所述的方法。
[0064]示例28包括一种网络设备,所述网络设备包括:用于生成基本图像的装置,所述基本图像包括由服务器托管的操作系统的第一实例和应用的第一实例;用于对所述基本图像执行扫描以便获得扫描结果的装置;用于生成所述克隆图像以便包括所述操作系统的第二实例、所述应用的第二实例、以及所述扫描结果的副本的装置;以及用于向所述客户端部署所述克隆图像的装置,其中,所述克隆图像被配置用于允许所述客户端在不扫描所述克隆图像的情况下执行所述克隆图像。
[0065]在示例29中,如28的所述示例可以可选地包括:用于确定所述扫描结果的所述副本已到期的装置;以及用于响应于确定所述扫描结果的所述副本已到期而进行以下操作的装置:扫描所述应用以及更新所述扫描结果以便获得更新后扫描结果。
[0066]示例30包括一种网络设备,所述网络设备包括:用于生成基本图像的装置,所述基本图像包括由服务器托管的操作系统的第一实例和应用的第一实例;用于对所述基本图像执行扫描以便获得扫描结果的装置;用于生成所述克隆图像以便包括所述操作系统的第二实例、所述应用的第二实例、以及所述扫描结果的副本的装置;以及用于向所述客户端部署所述克隆图像的装置,其中,所述克隆图像被配置用于允许所述客户端在不扫描所述克隆图像的情况下执行所述克隆图像。
[0067]应理解,以上说明旨在是说明性的而非限制性的。例如,上述实施例可以彼此组合地使用。作为另一示例,上述流程图包括可以不以附图中所描绘的特定顺序来执行的一系列动作。相反,各种动作可以以不同的顺序或者甚至同时发生。对本领域技术人员而言,在阅读了以上说明之后,许多其他的实施例都将是明显的。因此,本发明的范围应当参照所附权利要求书以及这种权利要求书有权获得的等效物的全部范围来确定。