Abstract: A virtual desktop access control is disclosed. A gateway apparatus receives a virtual desktop access request from a client, obtains a virtual desktop access policy according to a source address of the virtual desktop access request, and determines a virtual switch according to a destination address of the virtual desktop access request, wherein the destination address is an address of a virtual desktop that is connected to the virtual switch. The gateway apparatus sends the virtual desktop access policy to the virtual switch, such that the virtual switch is allowed to control a level of access which the virtual desktop has to access network resources. The gateway apparatus forwards the virtual desktop access request to the virtual desktop, receives a response to the virtual desktop access request from the virtual desktop, and forwards the response to the client.

Abstract: A virtual desktop access control is disclosed. A gateway apparatus receives a virtual desktop access request from a client, obtains a virtual desktop access policy according to a source address of the virtual desktop access request, and determines a virtual switch according to a destination address of the virtual desktop access request, wherein the destination address is an address of a virtual desktop that is connected to the virtual switch. The gateway apparatus sends the virtual desktop access policy to the virtual switch, such that the virtual switch is allowed to control a level of access which the virtual desktop has to access network resources. The gateway apparatus forwards the virtual desktop access request to the virtual desktop, receives a response to the virtual desktop access request from the virtual desktop, and forwards the response to the client.

Abstract: A method to create virtual machines is provided. An initially empty primary copy-on-write (COW) image of a base disk image is created, and an initially empty secondary COW image of the primary COW image is created. A virtual machine is booted from the secondary COW image. Writes by the virtual machine are stored in the secondary COW image. When the secondary COW image reaches a capacity threshold, data of the secondary COW image is committed into the primary COW image and then the secondary COW is cleared of data.

Abstract: A method to create virtual machines is provided. An initially empty primary copy-on-write (COW) image of a base disk image is created, and an initially empty secondary COW image of the primary COW image is created. A virtual machine is booted from the secondary COW image. Writes by the virtual machine are stored in the secondary COW image. When the secondary COW image reaches a capacity threshold, data of the secondary COW image is committed into the primary COW image and then the secondary COW is cleared of data.

Abstract: The present invention discloses a method and apparatus for network access control (NAC) in roaming services. In embodiments of the present invention, roaming quarantine access policies and roaming secure access policies are defined on access devices to control access of roaming terminals, instead of defining unified access policies on network-wide access devices. Embodiments of the present invention allow each branch network to enforce and update access policies as needed without restrictions of network identification and adaptation, making it easier to implement NAC on a distributed network, and improving NAC development. Embodiments of the present invention provide widely applicable, easy-to-implement NAC solutions for roaming.

Abstract: The present invention discloses a method and apparatus for network access control (NAC) in roaming services. In embodiments of the present invention, roaming quarantine access policies and roaming secure access policies are defined on access devices to control access of roaming terminals, instead of defining unified access policies on network-wide access devices. Embodiments of the present invention allow each branch network to enforce and update access policies as needed without restrictions of network identification and adaptation, making it easier to implement NAC on a distributed network, and improving NAC development. Embodiments of the present invention provide widely applicable, easy-to-implement NAC solutions for roaming.

Abstract: This invention discloses a network access control method supporting quarantine mode. Access devices can identify access control strategies identifications of which are returned from the AAA server during identity authentication processes. When the security policy server needs to assign an access control strategy to the access device for the terminal, the AAA server puts the identification of the required access control strategy into the identity authentication response to be sent to the access device, and then the access device recognizes and applies the access control strategy. Thus access devices from any vendors can cooperate with the security policy server in quarantine mode. This invention also discloses a network access control system supporting quarantine mode, and the system consists at least of a security policy server, an AAA server, and some user terminals.