# US 10,372,924 B2 · Master device for controlling application security environments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,372,924 B2 - Document ID: US10372924B2 - Status: Granted - Kind: B2 - Application number: 12/151,853 - Filed: 2008-05-12 - Published: 2009-12-31 - Granted: 2019-08-06 - Earliest claimed: 2008-05-12 - Applicants: George Madathilparambil George; Nikhil George - Inventors: George Madathilparambil George; Nikhil George - Web page: https://patentgrep.com/patent/US10372924B2 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 9/468: {Specific access rights for resources, e.g. using capability register} - G06F 2221/2101: Auditing as a secondary aspect - G06F 2221/2129: Authenticate client device independently of the user - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06F 2221/2147: Locking files - G06F 2221/2149: Restricted operating environment - G06F 2221/2153: Using hardware token as a secondary aspect - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Computer protection is weak with the methods currently available and there are risks of malicious users getting access to computers, corrupting important data, including system data. We are proposing a method for improving access protection, more particularly, by using a slave device that will enable or disable protection for applications as required. The device supports one or more users, none or more user groups, none or one or more Application Security Environments for each user or user group and one or more states for each Application Security Environment. The state of the hardware is manually controlled by the users. Depending on the configuration, each hardware state corresponding to an Application Security Environment corresponds to a set of privileges the processes running in that Application Security Environment have while that Application Security Environment is in that state. ## Claims ### Claim 1 A method implemented in a first apparatus implemented in hardware for controlling users in a first plurality of second apparatuses, wherein configuration of at least a first user of said first plurality of second apparatuses is to be stored in a second plurality of third apparatuses if said first user is created, said method comprising: a) sending a first command to each apparatus in said second plurality of third apparatuses to create said first user; b) receiving either a first synchronisation message or a first negative acknowledgement for said first command from each apparatus in said second plurality of third apparatuses; c) sending a second command to each apparatus in said second plurality of third apparatuses to discard said first command to create said first user if said first negative acknowledgement is received from at least one apparatus in said second plurality of third apparatuses, wherein each apparatus in said second plurality of third apparatuses discards said first command to create said first user when said second command is received; and d) sending a third command to each apparatus in said second plurality of third apparatuses to complete operation specified in said first command to create said first user if said first synchronisation message is received from each apparatus in said second plurality of third apparatuses, wherein each apparatus in said second plurality of third apparatuses updates said configuration to create said first user when said third command is received. ### Claim 2 (depends on 1) The method of claim 1 further comprising: receiving manual action from a second user to create said first user of said first plurally of second apparatuses before said first command is sent to each apparatus in said second plurality of third apparatuses. ### Claim 3 (depends on 2) The method of claim 2, wherein software running in each apparatus in said first plurality of second apparatuses cannot delete said first user. ### Claim 4 (depends on 2) The method of claim 2 further comprising: sending a seventh command to each apparatus in said second plurality of third apparatuses to create a fourth user of said first plurality of second apparatuses. ### Claim 5 (depends on 1) The method of claim 1 further comprising: a) sending a fourth command to each apparatus in said second plurality of third apparatuses to assign privileges to a third user; b) receiving either a second synchronisation message or a second negative acknowledgement for said fourth command from each apparatus in said second plurality of third apparatuses; c) sending a fifth command to each apparatus in said second plurality of third apparatuses to discard said fourth command to assign privileges to said third user if said second negative acknowledgement is received from at least one apparatus in said second plurality of third apparatuses, wherein each apparatus in said second plurality of third apparatuses discards said fourth command to assign privileges to said third user when said fifth command is received; and d) sending a sixth command to each apparatus in said second plurality of third apparatuses to complete operation specified in said fourth command to assign privileges to said third user if said second synchronisation message is received from each apparatus in said second plurality of third apparatuses, wherein each apparatus in said second plurality of third apparatuses updates said configuration to assign privileges to said third user when said sixth command is received.