Techniques for binding user identities to appropriate virtual machines with single sign-on
AssigneeHysolate Ltd.
InventorsTomer Trabelsi, Oleg Zlotnik, Nir Adler, Tai Zamir
Life of this patent
Estimating the term…
Abstract
A method for binding a user account operable on an air-gapped computer to an appropriate virtual machine (VM), comprising: monitoring a plurality of VMs to determine an associated user account for each of the plurality of VMs, wherein the plurality of VMs are executed over the air-gapped computer, and wherein each of the plurality of VMs is a distinct security zone in the air-gapped computer; determining a current VM from the plurality of VMs to bind an associated user account thereto; and displaying user specific indications on desktop items associated with each user account.
Claims21
A method for binding a user account operable on an air-gapped computer to an appropriate already executing virtual machine (VM), comprising:
- monitoring a plurality of already executing VMs, wherein the plurality of already executing VMs are executed over the air-gapped computer, and wherein each of the plurality of already executing VMs is a distinct security zone in the air-gapped computer;
- determining a VM from the plurality of already executing VMs to bind to a user account;
- capturing user credentials associated with the user account from a guest operating system (OS) executing within a primary security zone:
- logging onto the determined VM with the user credentials in a different guest OS executing within a secondary security zone, wherein the user credentials are provided by an hypervisor, wherein the hypervisor automatically provides the user credentials to all guest operating systems that have been booted within other security zones;
- binding the user account to the determined VM, thereby associating the user account with the virtual machine;
- and
- causing at least one user specific indication that at least identifies a bound user account to be displayed on at least one desktop item that is associated with the bound user account.
A non-transitory computer readabe medium having stored thereon instructions for causing a processing circuitry of an air-gapped computer having at least an appropriate executing virtual machine (VM) to perform a process, the process comprising:
- monitoring a plurality of already executing VMs, wherein the plurality of already executing VMs are executed over the air-gapped computer, and wherein each of the plurality of already executing VMs is a distinct security zone in the air-gapped computer;
- determining a VM from the plurality of already executing VMs to bind to a user account;
- capturing user credentials associated with the user account from a guest operating system (OS) executing within a Primary security zone;
- logging onto the determined VM with the user credentials in a different guest OS executing within a secondary security zone, wherein the user credentials are Provided by an hypervisor, wherein the hypervisor automatically provides the user credentials to all guest operating systems that have been booted within other security zones;
- binding the user account to the determined VM, thereby associating the user account with the virtual machine;
- and
- causing at least one user specific indication that at least identifies a bound user account to be displayed on at least one desktop item that is associated with the bound user account.
An air gapped computer, comprising:
- a processing circuitry;
- and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
- monitor a plurality of already executing virtual machines (VMs), wherein the plurality of already executing VMs are executed over the air-gapped computer, and wherein each of the plurality of already executing VMs is a distinct security zone in the air-gapped computer determine a VM from the plurality of already executing VMs to bind to a user account;
- capture user credentials associated with the user account from a guest operating system (OS) executing within a Primary security zone;
- log onto the determined VM with the user credentials in a different guest OS executing within a secondary security zone, wherein the user credentials are provided by an hypervisor, wherein the hypervisor automatically provides the user credentials to all guest operating systems that have been booted within other security zones;
- bind the user account to the determined VM, thereby associating the user account with the virtual machine;
- and
- cause at least one user specific indication that at least identifies a bound user account to be displayed on at least one desktop item that is associated with the bound user account.
Dependencies are inferred from the claim text.