Remote Network Access Via Virtual Machine

Abstract

A virtual machine project manager creates a generic, i.e., not user-specific, virtual machine image file. Copies of this image file may be distributed to one or more users, each of whom may then use an automated procedure to generate a user-specific virtual machine image file and, thus, a user-specific virtual machine on his/her remote host computer. The generic virtual machine image file may be distributed on computer-readable media, such as a DVD disks, or the file may be stored on a server and downloaded (such as via the Internet) by the users. Each user also receives or downloads a token, which contains a small amount of user-specific information that is used by the automated procedure to provision the generic virtual machine image file for the particular user. A virtual machine accesses a security token connected to a host computer to automatically authenticate or re-authenticate a user, such as when a virtual private network connection is restarted. Substantially identical session identifiers are used by a host computer and a virtual machine, or by two or more virtual machines and, when communicating with an integrated access server. A file server stores virtual machine images that are accessed by a plurality of host computers.

1 .- 25 . (canceled) 
     
     
         26 . A method of automatically obtaining at least one user credential, comprising:
 connecting a security token to a port of a host computer;   executing a virtual machine on the host computer;   from within the virtual machine, accessing the port and reading from the security token data associated with at least one user credential related to a user; and   from within the virtual machine, using the data thus read to log the user into an operating system executed by the virtual machine.   
     
     
         27 . A method of automatically obtaining at least one user credential, comprising:
 connecting a security token to a port of a host computer;   executing a virtual machine on the host computer;   from within the virtual machine, accessing the port and reading from the security token data associated with at least one user credential related to a user; and   using the data thus read to establish a network connection between the virtual machine and a server.   
     
     
         28 . A method of automatically obtaining at least one user credential, comprising:
 connecting a security token to a port of a host computer;   executing a virtual machine on the host computer;   executing a virtual machine player on the host computer;   from within the player, accessing the port and reading from the security token data associated with at least one user credential related to a user; and   from within the virtual machine, accessing the player to obtain the data thus read.   
     
     
         29 . A method according to  claim 28 , further comprising, from within the virtual machine, using the obtained data to log the user into an operating system executed by the virtual machine. 
     
     
         30 . A method according to  claim 28 , further comprising, from within the virtual machine, using the obtained data to establish a network connection between the virtual machine and a server. 
     
     
         31 . A method of automatically obtaining at least one user credential, comprising:
 executing a host operating system on a host computer;   within the host operating system, caching at least one user credential related to a user who is logged into the host operating system;   executing a virtual machine on the host computer;   from within a virtual machine player, obtaining the at least one cached user credential from the host operating system; and   from within the virtual machine, using the obtained at least one user credential to log the user into an operating system executed by the virtual machine.   
     
     
         32 . A method of establishing parallel sessions between a host computer and an integrated access server and between a virtual machine being executed on the host computer and the integrated access server, comprising:
 using a first session identifier to establish a session between the host computer and the integrated access server; and   using a second session identifier, substantially identical to the first session identifier, to establish a session between the virtual machine and the integrated access server.   
     
     
         33 . A method according to  claim 32 , further comprising:
 on the host computer, generating the first session identifier, based at least in part on identification data associated with the host computer;   communicating, from the host computer to the virtual machine, information about the identification data associated with the host computer; and   using the communicated information to generate the second session identifier.   
     
     
         34 . A method according to  claim 33 , wherein the identification data associated with the host computer comprises a media access control (MAC) address of the host computer. 
     
     
         35 . A method of establishing parallel sessions between a first virtual machine being executed on a host computer and an integrated access server and between a second virtual machine being executed by the host computer and the integrated access server, comprising:
 using a first session identifier to establish a session between the first virtual machine and the integrated access server; and   using a second session identifier, substantially identical to the first session identifier, to establish a session between the second virtual machine and the integrated access server.   
     
     
         36 . A method according to  claim 35 , further comprising:
 communicating, from the host computer to the first virtual machine, identification data associated with the host computer;   using the communicated identification data to generate the first session identifier;   communicating, from the host computer to the second virtual machine, the identification data associated with the host computer; and   using the communicated identification data to generate the second session identifier.   
     
     
         37 . A method according to  claim 36 , wherein the identification data associated with the host computer comprises a media access control (MAC) address of the host computer. 
     
     
         38 . A method according to  claim 36 , wherein communicating the identification data from the host computer to the first virtual machine comprises executing a virtual machine player on the host computer. 
     
     
         39 . A method of coordinating an access request from a computer to a first integrated access server and an access request from the computer to a second integrated access server, wherein the first and the second integrated access servers maintain distinct universes of patient identifiers, the method comprising:
 receiving a patient identifier that identifies a patient within the universe of patient identifiers maintained by the first integrated access server;   sending the received patient identifier to the first integrated access server;   mapping the received patient identifier into a second patient identifier that identifies the same patient within the universe of patient identifiers maintained by the second integrated access server; and   sending the second patient identifier to the second integrated access server.   
     
     
         40 . A method according to  claim 39 , further comprising executing a virtual machine on the computer; and wherein sending the second patient identifier comprises setting the second patient identifier from the virtual machine to the second integrated access server. 
     
     
         41 . In a network that includes a plurality of host computers interconnected to a file server, a method of executing a virtual machine, comprising:
 storing a plurality of virtual machine images on the file server;   loading a selected one of the plurality of virtual machine images from the file server onto a first selected one of the host computers; and   executing the loaded virtual machine image on the first selected one of the host computers.   
     
     
         42 . A method according to  claim 41 , wherein:
 storing the plurality of virtual machine images on the file server comprises storing a plurality of generic virtual machine images on the file server; and further comprising:   after loading the selected one of the plurality of virtual machine images from the file server onto the first selected one of the host computers, automatically provisioning the virtual machine on the host computer.   
     
     
         43 . A method according to  claim 41 , further comprising:
 suspending execution of the virtual machine on the first selected one of the host computers; and   storing information about the suspended virtual machine on the file server.   
     
     
         44 . A method according to  claim 43 , wherein suspending execution of the virtual machine comprises suspending execution of the virtual machine in response to a user command issued on the first selected one of the host computers. 
     
     
         45 . A method according to  claim 43 , wherein suspending execution of the virtual machine comprises suspending execution of the virtual machine in response to information stored on the file server. 
     
     
         46 . A method according to  claim 43 , wherein suspending execution of the virtual machine comprises suspending execution of the virtual machine in response to a remote procedure call. 
     
     
         47 . A method according to  claim 43 , further comprising:
 loading the information about the suspended virtual machine from the file server onto a second selected one of the host computers, different than the first selected one of the host computers; and   resuming execution of the suspended virtual machine on the second selected one of the host computers.   
     
     
         48 . A method according to  claim 43 , further comprising: resuming execution of the suspended virtual machine on the file server. 
     
     
         49 .- 52 . (canceled)