WO2012065894A2

WO2012065894A2 - Method and arrangement for centrally managing portable terminals, terminal and computer for operation with an arrangement for centrally managing portable terminals

Info

Publication number: WO2012065894A2
Application number: PCT/EP2011/069761
Authority: WO
Inventors: Thorsten Höhnke; Susanne Pudlitz
Original assignee: Fujitsu Technology Solutions Intellecutal Property Gmbh
Priority date: 2010-11-18
Filing date: 2011-11-09
Publication date: 2012-05-24
Also published as: WO2012065894A3; DE102010051768A1

Abstract

In one embodiment, a method for centrally managing portable terminals comprises the following steps: inserting a portable terminal (10) into a remote computer (30) having a communications interface (31), starting a management client application (12) stored on the terminal, starting a management server application (23) stored on a computer, constructing a connection from the terminal (10) via the remote computer (30) via a communications network (40) to the computer (20), changing at least one Bit in the memory of the terminal (10) by means of the computer (20).

Description

description

Method and arrangement for the central management of portable terminals, terminal and computer for operating with an arrangement for the central management of portable terminals

The invention relates to the central management of portable terminals, in particular the central management of at least one technical feature, such as a serial number of the hardware or software used in the device or parts of the software, or other technical settings.

Information technology, IT, which is used, for example, take into sub ^¬, increasingly based on devices for data processing, which are used distributed. A user, for example a company employee, has a computer in his workstation with which he accesses central data and resources via networks, such as intranets or the Internet. Often, at the user's workplace, additional equipment such as

Storage media in the form of USB sticks or the like, used, which are connected only when needed to the workstation. In the management of these additional devices, one currently encounters the problem that a required access to such an accessory, which would have to be done by a central computer of an administrator via the network, is not readily possible. Thus, it is currently necessary to carry out corresponding administrative acts, such as updating the software of the additional device on the central computer of the administrator. This requires at least the effort which set the device to transport back and forth to ^¬, so the user to administrator and back again. For worldwide companies This is completely impractical for people with large spatial dimensions.

An object is therefore to simplify the central management of such portable terminals.

The problem is solved by the subject matters of independent ^¬ gen as well as the independent claims. Further developments and embodiments are each objects of the dependent claims.

In one embodiment, a method for the central management of portable terminals comprises the following steps: inserting a portable terminal in a remote computer with communication interface,

Starting a management client application stored on the terminal,

Starting a management server application stored on a computer,

Establishing a connection from the terminal via the remote computer via a communication network to the computer,

- Changing at least one bit in the memory of the Endge ^¬ device by the computer. When inserting the terminal in the remote computer, for example, the above-mentioned workstation of a user, a stored on the terminal management ^¬ client application is started. This connects with a management server application running on the computer, for example the central computer of an administrator. Subsequently, settings in the memory of the terminal are changed by the management server application of the computer. The terminal can be unplugged again.

Due to the produced from the terminal to computer connection management application can be seen on the computer is able, when a portable terminal is plugged into the ent ^¬ remote computer a. Thus, it is easily possible to make settings on the portable terminal from the central computer for the purpose of managing the same.

The portable terminal is, for example, a storage medium. This can be realized in the form of a portable hard disk or in the form of a so-called memory stick. The communication network is for example an Internet or an Int ^¬ RANET, the physical data transmission takes place wired and / or wireless. A respective administration ^client application stored on the ^{terminal device} is tuned to the administration server application of the computer, so that the desired functionality is achieved by interaction of the two applications. For example, passwords, serial numbers of software and hardware as well as other user-specific or connection- ^specific settings and configurations are managed.

In a further development, when the connection from the terminal to the computer is established, the terminal is registered with the computer. This login involves authentication of the terminal using its hardware identity or Address and, for example, in the context of a log-in ^¬ operation.

This ensures that changes are made to the terminal only if it is in the possession of the rightful user.

In a further development takes place when the connection from the terminal to the computer, a logout of the device at the computer.

This logout corresponds to a so-called log-out process. It corresponds to the log-ίη process described above.

In a further embodiment, the method has the following additional steps:

Starting a virtualization client application stored on the terminal,

- Start a virtualization server application stored on the computer.

In addition to the administrative client application, using the computing capacity of the remote computer, the virtualization client application of the terminal is started. The counterpart to this application, the virtualization server application, runs on the computer. Thus, as an alternative to the respective administration application, the connection between the terminal and the computer is established by virtue of the virtualization applications and, after termination of the administrative actions on the terminal, reduced again. These alternative approach allows for a simp ^¬ che centralized management of portable devices from the computer.

In a further development, the method comprises the additional steps:

- deactivating the write protection of the memory of Endge ^¬ Raets,

- Enable the write protection of the terminal.

If the storage area in which administrative actions are to be performed is protected by a write protection, then this is deactivated before changing data in the storage and then reactivated.

In one embodiment, a portable terminal for operating a central portable device management system includes an interface for exchanging data with a remote computer and a memory. The memory has an administration client application with auto-start functionality and a data area.

The management client application is automatically started using the computing power of the remote computer. The terminal is connected to the remote computer via the interface. In cooperation with the arrangement for centrally managing portable terminals, as described above, at least one change is made in the memory of the terminal. The administrative client application thus enables the central management of the terminal by the computer in cooperation with the arrangement.

The self-starting functionality is also called autostart be ^¬ draws. The interface for exchanging data with the remote computer is, for example, a Universial Serial Bus, USB interface.

In a further development, the memory has a write protection option and a virtualization client application.

In another embodiment, the virtualization client application is designed as a zero client.

The zero client is the client-side part of a desktop virtualization solution, in which, in contrast to so-called fat or thin client solutions, the complete software, ie operating system, applications and also the user's computer-simulated workplace, the so-called Desktop, on a remote server, in this case the computer, is running. The devices present at his workstation are therefore used by a user mainly for inputting and outputting data. The virtualisation lisierungsclient uses a predetermined protocol in ^¬ play as the Remote Desktop Protocol, RDP to communicate with the ent ^¬ speaking application on the computer. Desktop virtualization essentially exchanges compressed image data between client and server.

In one embodiment, a computer for operating a centralized portable device management system includes a processor, a processor coupled to the processor, and a processor. provide for the exchange of data and an executable on the processor management server application. The management ^¬ server application is configured to access to a memory of the portable terminal over the administration client application.

The management server application of the computer, using the processor and the interface, allows access from the computer to the data area in the memory of the terminal via its management client application. This simplifies the central management so equipped contract ^¬ Barer devices. Time-consuming and time-consuming transfer of end devices between user and administrator is unnecessary.

In one development, the computer has a virtualization server application that can run on the processor and at least one virtual machine that can be activated by the virtualization server application. The virtual machine is set up to interact with the virtualization client application of the terminal.

As an alternative or in addition to establishing a connection through the management applications on the client and server side, the connection between the computer and the terminal can also be established via the virtualization applications on the server and client side. Virtualization matches the desktop virtualization described above for the end device side. The virtualization server application is also called a hypervisor. For each virtualization client application, the hypervisor starts an associated virtual machine. The hypervisor also takes on tasks to manage and manage multiple virtualization client applications on different devices and corresponding respective virtual machines true. The management server application can be implemented as part of the virtualization server application.

In one disclosed embodiment, an arrangement for centralized management of portable terminals, at least one portable End ^¬ device as described above, at least one remote computer which is coupled to the at least one terminal, egg ^¬ NEN computer as described above and a communication network for the exchange of Data between the computer and the at least one portable terminal on the at least one remote computer.

In a development, the arrangement comprises an intermediary computer which is connected to the communication network. The intermediary computer is adapted to produce a ^¬ Ver bond from the terminal via the remote computer and the communication network to the computer.

The broker computer is also referred to as a gateway or broker. For example, the agent computer forms part of a demilitarized zone, demilitarized zone, DMZ, of the communication network. The demilitarized zone shields computers available in this area from one another by using one or more firewalls over other networks. This allows the access to publicly available services, such as WWW or e-mail gestat ^¬ tet while an internal network, intranet, LAN are protected from ^unauthorized access. It makes sense to have the computer in the demilitarized zone of the communication network. The connection between the terminal and the computer is then established via the intermediary computer. The invention will be explained in more detail using an exemplary embodiment with reference to the figure. FIG. 1 shows an exemplary embodiment of an arrangement for managing portable terminals according to the proposed principle.

FIG. 1 shows an exemplary embodiment of an arrangement for managing portable terminals according to the proposed principle. The device comprises a portable terminal 10, a computer 20, a remote computer 30 and a communication network 40. The portable terminal 10 comprises an interface 11 for exchanging data, a management client application 12, a data area 13 and a virtualization client application 14. The management client application 12, the data area 13 and the virtualization client application 14 are located in a memory 15 of the terminal 10. The interface 11 is designed, for example, as a USB interface.

The computer 20 includes a processor 21, an interface 32 for exchange of data 22, a Verwaltungsserverapplika ^¬ tion 23 and a virtualization server application 24th Furthermore, at least one virtual machine 25 pre ^¬ see. The management server application 23, the virtualization server application 24 and the virtual machine 25 are designed for execution on the processor 21 of the computer 20 and configured to access the memory 15 of the terminal 10 and its data area 13. Alternatively, the virtual machine 25, which can be a punched In ^¬ a virtual desktop of a user implemented, run on another, connected to the computer 20 computer.

The remote computer 30 on the one hand has an interface for exchanging data with the interface 11 of the Endge ^¬ Raets 10th On the other hand, it has an interface 31 for exchanging data with the communication network 40. The remote computer 30 is configured to execute the applications 12 and 14 stored on the terminal 10.

The communication network 40 is realized, for example, as a Local Area Network, LAN, or Wide Area Network, WAN, or a combination of both. The remote computer 30 is connected via its interface 31, the computer 20 is connected via its interface 22 to the communication network 40. The communication network 40 thus represents, for example, the network of a company. Essentially, Internet protocols, such as IP, TCP and UDP are used to from ^¬ exchange of data here.

If necessary, the communication network 40 comprises an intermediary computer 50. This forms the entrance to a demilitarized zone of the communication network 40, in which, for example, the computer 20 is located for security reasons. In order to separate internal accesses to the network from external, access to the computer 20 is preferably via the intermediary computer 50.

The portable terminal 10 is inserted with its interface 11 in the remote computer 30. The administrative client Application 12 of the terminal 10 is automatically executed on the remote computer. On the computer 20, the management server application 23 is started. This already listens for connection requests by the Verwaltungsclientapplikati- on 12 of the terminal 10. A connection between management ^¬ server application 23 of the computer 20 and the management client ^¬ application 12 of the terminal 10 is transmitted via the remote computer 30 and set up the communication network 40th The terminal 10 logs on to the computer 20. This is done for example by authentication using the hardware identity or address of the terminal 10 or by means of a login by the user. For this purpose, the user is asked to enter his ID and password ^¬ .

Subsequently, the write protection of the memory 15 of the terminal ^¬ appliance 10 is deactivated by the administration client application 12. The management server application 23 of the computer 20 can now access the memory 15 of the terminal 10, check, for example, versions or serial numbers and / or make changes to the software or the data in the data area 13. In doing so, the administration client application 12 and / or the virtualization client application can also be updated. Once the update is complete and all administrative changes on the terminal 10 are completed, the write protection of the memory 15 of the terminal 10 is reactivated.

The connection between management server application 23 of computer 20 and administrative client application 12 of terminal 10 is disconnected. At the same time, the terminal 10 is logged out of the computer 20. The administrative client application tion 12 is ended. The terminal 10 can now be unplugged from the ent ^¬ remote computer a 30 again.

Advantageously, the illustrated arrangement using the method enables simplification of the central management of portable terminals 10.

In an alternative embodiment, after starting the administration client application 12 on the remote computer 30, the virtualization client application 14 is additionally executed. This realizes a virtual desktop on the remote computer 30 using resources on the part of the computer 20, namely, the virtualization sierungsserverapplikation 24 and at least one virtual machine 25. Alternatively, to establish the connection between the Verwaltungsclient- and Verwaltungsserverapplikatio ^¬ nen 12, 23 can a connection is established between computer 20 and terminal 10 by means of the virtualization server and virtualization client applications 24, 14. The registration of the terminal 10 in the computer 20 is carried out in a similar manner as described above by means of virtualization client and virtualization server applications 14, 24. The remote computer 30 acts in this case single ^¬ Lich as input / output medium, computing power is in this Case not needed.

The computer 20 is in a demilitarized zone of the communication network 40, the connection Zvi ^¬'s terminal 10 and computer 20 is constructed in a two step process via the intermediary computer 50th Reference sign list

10 portable terminal

11 interface

12 administrative client application

13 data area

14 virtualization client application

15 memory

20 computers

21 processor

22 interface

23 administration server application

24 virtualization server application

25 virtual machine

30 remote computer

31, 32 interface

40 communication network

50 intermediary computers

Claims

claims

1. A method for central management of portable terminals, comprising the following steps:

- insertion of a portable terminal (10) in a remote computer (30) with a communication interface ^¬ point (31),

Starting a management client application (12) stored on the terminal upon detection of the insertion,

Starting a management server application (23) stored on a computer (20),

Establishing a connection from the terminal (10) via the remote computer (30) via a communication network (40) to the computer (20),

- changing at least one bit in the memory (15) of the terminal (10) by the computer (20).

2. The method according to claim 1,

wherein upon establishment of the connection from the terminal (10) to the computer (20), the terminal (10) is registered at the computer (20), which comprises an authentication using a hardware identity or address of the terminal.

3. The method according to claim 1 or 2

wherein the degradation of the connection from the terminal (10) to the computer (20), a logoff of the terminal (10) at the computer (20).

4. The method according to any one of claims 1 to 3,

further comprising: Starting a virtualization client application (14) stored on the terminal (10),

- Starting a virus tualisierungsserverapplikation (23) stored on the computer (20).

Method according to one of claims 1 to 4,

further comprising:

Deactivating the write protection of a memory (15) of the terminal (10),

- Enable the write protection of the memory (15) of the terminal (10).

A portable terminal for operating in an arrangement for central management of portable terminals comprising

- An interface (11) for exchanging data with a remote computer (30), and

- a memory (15) comprising:

a management client application (12) with

Self-start functionality,

a data area (13).

Portable terminal according to claim 6,

wherein the memory (15) comprises a write protect capability and a virtualization client application (14).

Portable terminal according to claim 7,

wherein the virtualization client application (14) is designed as a Ze ro client.

Computer for operating in an arrangement for the central management of portable terminals, comprising:

a processor (21), an interface (22) coupled to the processor (21) for exchanging data,

- one on the processor executable (21) management ^¬ server application (23) for accessing a memory (15) of the portable terminal (10) via a management client application (12) of the portable terminal (10) is designed.

The computer of claim 9 further comprising:

a virtualization server application (24) executable on the processor (21),

- At least one of the Virtualisierungsserverappli- cation (24) activatable virtual machine, which is adapted to interact with a virtualization client application (14) of the terminal (10).

Arrangement for central management of portable terminals comprising:

at least one portable terminal (10) according to one of claims 5 to 7,

at least one remote computer (30) which is coupled to the at least one terminal (10),

- A computer (20) according to any one of claims 8 to 9, and

- A communication network (40) for exchanging data between the computer (20) and the at least one portable terminal (10) via the at least one remote computer (30).

Arrangement according to claim 11 further comprising:

an intermediary computer (50) connected to the communication network (40) and adapted to establish a connection from the terminal (10) via the remote computer (30) and the communication network (40) to the computer (20).