# US 12,111,894 B2 · User experience container level identity federation and content security

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,111,894 B2
- Document ID: US12111894B2
- Status: Granted
- Kind: B2
- Application number: 17/200,731
- Filed: 2021-03-12
- Published: 2021-09-16
- Granted: 2024-10-08
- Earliest claimed: 2020-03-12
- Assignees: Haworth, Inc.
- Applicants: Haworth, Inc.
- Inventors: Steven Churchill; Rupen Chanda; Jingqi Ao; Madhuvanthi Guruprasad
- Web page: https://patentgrep.com/patent/US12111894B2

## CPC

- G06F 21/31: User authentication
- H04L 63/10: {for controlling access to devices or network resources}
- G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]}
- H04W 12/08: Access security
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Systems and methods are provided for controlling display of a workspace. The system includes logic to establish a first level authorization at a display client enabling access to a workspace data set. The workspace data set can have a plurality of entries identifying respective digital assets and locations in the workspace for graphical objects representing the respective digital assets. The plurality of entries can include a particular entry identifying a particular digital asset requiring a second level authorization. The system includes logic to render, for the particular entry, a placeholder graphical object and a prompt. The system includes logic to detect user input indicating selection of the prompt, and in response executing a protocol to establish the second level authorization. Upon establishment of the second level authorization the placeholder graphical object is replaced with a second graphical object to reveal content of the particular digital asset.

## Claims

### Claim 1

A method for controlling display of a workspace, comprising:
during a shared collaboration session sharing the workspace with multiple client nodes, executing a protocol to establish a first level authorization at a display client on a network node participating in the shared collaboration session for a participant operative identity (OID), the first level authorization enabling access to a workspace data set of the workspace during the shared collaboration session, the workspace data set having a plurality of entries that identify respective digital assets and locations in the workspace for graphical objects representing the respective digital assets, and wherein the plurality of entries includes a particular entry identifying a particular digital asset requiring a second level authorization;
parsing the workspace data set to identify entries for digital assets having locations within a client viewport region of the workspace;
displaying graphical objects on a display at the display client representing the identified digital assets accessible with the first level authorization;
for the particular digital asset, communicating with an authorization server to return a result indicating status of second level authorization, and
in response to a status indication that second level authorization is not established, displaying a placeholder graphical object at the display client, and
in response to a status indication that second level authorization is established,
displaying a graphical object representing the particular digital asset at the display client; and,
when a placeholder graphical object is displayed, presenting a user interface object at the display client prompting execution of a protocol to establish second level authorization, and in dependence upon establishment of the second level authorization, replacing the placeholder graphical object with the graphical object representing the particular digital asset.

### Claim 2 (depends on 1)

The method of claim 1, wherein
the particular digital asset is a file stored by a resource server, and
the graphical object is controlled by an external resource server.

### Claim 3 (depends on 1)

The method of claim 1, wherein
the particular digital asset is a file stored by a resource server, and
the graphical object representing the particular digital asset is a thumbnail object.

### Claim 4 (depends on 1)

The method of claim 1, wherein
the particular entry includes a resource link identifying the particular digital asset, and
the communicating with the authorization server includes sending the resource link to the authorization server.

### Claim 5 (depends on 1)

The method of claim 1, wherein
the protocol to establish second level authorization includes
presenting a request login prompt with the placeholder graphical object, selection of which launches a user interface object for login of the display client to a resource server storing the particular digital asset.

### Claim 6 (depends on 1)

The method of claim 1, wherein
the protocol to establish second level authorization includes
presenting a request permission prompt with the placeholder graphical object, selection of which launches a user interface object for requesting permission from an owner account for access to the particular digital asset from a resource server storing the particular digital asset.

### Claim 7 (depends on 1)

The method of claim 1, including
displaying a prompt on the display for adding a digital asset to the workspace, and in response to the prompt, executing the second level authorization protocol to deliver a resource access token for the added digital asset requiring second level authorization to the authorization server with a scope of permissions for the participant OID, and adding an entry to the workspace data set including a resource link identifying the added digital asset.

### Claim 8 (depends on 7)

The method of claim 7, wherein
the resource link identifying the added digital asset includes an owner account identifier, a storage server identifier, and an access scope identifier.

### Claim 9 (depends on 7)

The method of claim 7, wherein
the resource link identifying the added digital asset includes an owner account identifier, a storage server identifier, an access group identifier, and an access scope identifier.

### Claim 10 (depends on 1)

The method of claim 1, wherein
the workspace includes a canvas object defining a region in the workspace, and the workspace data set includes entries for digital assets having locations within the region defined by the canvas object;
and the method further including:
displaying, at the display client, a placeholder canvas graphical object and a canvas access prompt for requesting access to digital assets in the region defined by the canvas object; and
detecting user input indicating selection of the canvas access prompt, and in response executing a protocol to establish a canvas second level authorization; and
in dependence upon establishment of the canvas second level authorization, replacing the placeholder canvas graphical object with graphical objects representing the digital assets having locations within the region defined by the canvas object.

### Claim 11

A system including one or more processors coupled to memory, the memory loaded with computer instructions to control display of a workspace, the instructions, when executed on the processors, implement actions comprising:
during a shared collaboration session sharing the workspace with multiple client nodes, executing a protocol to establish a first level authorization at a display client on a network node participating in the shared collaboration session for a participant operative identity (OID), the first level authorization enabling access to a workspace data set of the workspace during the shared collaboration session, the workspace data set having a plurality of entries that identify respective digital assets and locations in the workspace for graphical objects representing the respective digital assets, and wherein the plurality of entries includes a particular entry identifying a particular digital asset requiring a second level authorization;
parsing the workspace data set to identify entries for digital assets having locations within a client viewport region of the workspace;
displaying graphical objects on a display at the display client representing the identified digital assets accessible with the first level authorization;
for the particular digital asset, communicating with an authorization server to return a result indicating status of second level authorization, and
in response to a status indication that second level authorization is not established, displaying a placeholder graphical object at the display client, and
in response to a status indication that second level authorization is established,
displaying a graphical object representing the particular digital asset at the display client; and,
when a placeholder graphical object is displayed, presenting a user interface object at the display client prompting execution of a protocol to establish second level authorization, and in dependence upon establishment of the second level authorization, replacing the placeholder graphical object with the graphical object representing the particular digital asset.

### Claim 12 (depends on 11)

The system of claim 11, wherein
the particular digital asset is a file stored by a resource server, and
the graphical object is controlled by an external resource server.

### Claim 13 (depends on 11)

The system of claim 11, wherein
the particular digital asset is a file stored by a resource server, and
the graphical object representing the particular digital asset is a thumbnail object.

### Claim 14 (depends on 11)

The system of claim 11, wherein
the particular entry includes a resource link identifying the particular digital asset, and the communicating with the authorization server includes sending the resource link to the authorization server.

### Claim 15 (depends on 11)

The system of claim 11, wherein
the protocol to establish second level authorization includes
presenting a request login prompt with the placeholder graphical object, selection of which launches a user interface object for login of the display client to a resource server storing the particular digital asset.

### Claim 16 (depends on 11)

The system of claim 11, wherein
the protocol to establish second level authorization includes
presenting a request permission prompt with the placeholder graphical object, selection of which launches a user interface object for requesting permission from an owner account for access to the particular digital asset from a resource server storing the particular digital asset.

### Claim 17 (depends on 11)

The system of claim 11, further implementing actions comprising:
displaying a prompt on the display for adding a digital asset to the workspace, and in response to the prompt,
executing the second level authorization protocol to deliver a resource access token for the added digital asset requiring second level authorization to the authorization server with a scope of permissions for the participant OID, and
adding an entry to the workspace data set including a resource link identifying the added digital asset.

### Claim 18 (depends on 17)

The system of claim 17, wherein
the resource link identifying the added digital asset includes an owner account identifier, a storage server identifier, and an access scope identifier.

### Claim 19 (depends on 17)

The system of claim 17, wherein
the resource link identifying the added digital asset includes an owner account identifier, a storage server identifier, an access group identifier, and an access scope identifier.

### Claim 20 (depends on 11)

The system of claim 11, wherein
the workspace includes a canvas object defining a region in the workspace, and the workspace data set includes entries for digital assets having locations within the region defined by the canvas object; and further implementing actions comprising:
displaying, at the display client, a placeholder canvas graphical object and a canvas access prompt for requesting access to digital assets in the region defined by the canvas object; and
detecting user input indicating selection of the canvas access prompt, and in response executing a protocol to establish a canvas second level authorization; and
in dependence upon establishment of the canvas second level authorization, replacing the placeholder canvas graphical object with graphical objects representing the digital assets having locations within the region defined by the canvas object.

### Claim 21

A non-transitory computer readable storage medium impressed with computer program instructions to control display of a workspace, the instructions, when executed on a processor, implement a method comprising:
during a shared collaboration session sharing the workspace with multiple client nodes, executing a protocol to establish a first level authorization at a display client on a network node participating in the shared collaboration session for a participant operative identity (OID), the first level authorization enabling access to a workspace data set of the workspace during the shared collaboration session, the workspace data set having a plurality of entries that identify respective digital assets and locations in the workspace for graphical objects representing the respective digital assets, and wherein the plurality of entries includes a particular entry identifying a particular digital asset requiring a second level authorization;
parsing the workspace data set to identify entries for digital assets having locations within a client viewport region of the workspace;
displaying graphical objects on a display at the display client representing the identified digital assets accessible with the first level authorization;
for the particular digital asset, communicating with an authorization server to return a result indicating status of second level authorization, and
in response to a status indication that second level authorization is not established, displaying a placeholder graphical object at the display client, and
in response to a status indication that second level authorization is established,
displaying a graphical object representing the particular digital asset at the display client; and,
when a placeholder graphical object is displayed, presenting a user interface object at the display client prompting execution of a protocol to establish second level authorization, and in dependence upon establishment of the second level authorization, replacing the placeholder graphical object with the graphical object representing the particular digital asset.

### Claim 22 (depends on 21)

The non-transitory computer readable storage medium of claim 21, wherein
the particular digital asset is a file stored by a resource server, and
the graphical object is controlled by an external resource server.

### Claim 23 (depends on 21)

The non-transitory computer readable storage medium of claim 21, wherein the particular digital asset is a file stored by a resource server, and the graphical object representing the particular digital asset is a thumbnail object.

### Claim 24 (depends on 21)

The non-transitory computer readable storage medium of claim 21, wherein
the particular entry includes a resource link identifying the particular digital asset, and
the communicating with the authorization server includes sending the resource link to the authorization server.

### Claim 25 (depends on 21)

The non-transitory computer readable storage medium of claim 21, wherein
the protocol to establish the second level authorization includes:
presenting a request login prompt with the placeholder graphical object, selection of which launches a user interface object for login of the display client to a resource server storing the particular digital asset.

### Claim 26 (depends on 21)

The non-transitory computer readable storage medium of claim 21, wherein
the protocol to establish second level authorization includes:
presenting a request permission prompt with the placeholder graphical object, selection of which launches a user interface object for requesting permission from an owner account for access to the particular digital asset from a resource server storing the particular digital asset.

### Claim 27 (depends on 21)

The non-transitory computer readable storage medium of claim 21, implementing the method further comprising:
displaying a prompt on the display for adding a digital asset to the workspace, and in response to the prompt, executing the second level authorization protocol to deliver a resource access token for the added digital asset requiring second level authorization to the authorization server with a scope of permissions for the participant OID, and adding an entry to the workspace data set including a resource link identifying the added digital asset.

### Claim 28 (depends on 27)

The non-transitory computer readable storage medium of claim 27, wherein the resource link identifying the added digital asset includes an owner account identifier, a storage server identifier, and an access scope identifier.

### Claim 29 (depends on 27)

The non-transitory computer readable storage medium of claim 27, wherein the resource link identifying the added digital asset includes an owner account identifier, a storage server identifier, an access group identifier, and an access scope identifier.

### Claim 30 (depends on 21)

The non-transitory computer readable storage medium of claim 21, wherein
the workspace includes a canvas object defining a region in the workspace, and the workspace data set includes entries for digital assets having locations within the region defined by the canvas object; and implementing the method further comprising:
displaying a placeholder canvas graphical object and a canvas access prompt for requesting access to digital assets in the region defined by the canvas object; and
detecting user input indicating selection of the canvas access prompt, and in response executing a protocol to establish a canvas second level authorization; and
in dependence upon establishment of the canvas second level authorization, replacing the placeholder canvas graphical object with graphical objects representing the digital assets having locations within the region defined by the canvas object.

### Claim 31

A method for controlling display of a virtual workspace, comprising:
during a shared collaboration session sharing the virtual workspace with multiple client nodes, using a first level authorization protocol for at least one participant operative identity (OID) to authenticate and authorize at least one respective display client participating in the shared collaboration session to access the virtual workspace including a workspace data set stored on a server;
sending, from the server, data from the workspace data set to the at least one respective display client participating in the shared collaboration session, the workspace data set having a plurality of entries that identify respective digital assets and locations in the shared virtual workspace for graphical objects representing the digital assets, and wherein the plurality of entries includes an entry identifying a particular digital asset requiring second level authorization; and
accessing an authorization server that maintains resource access tokens usable to establish second level authorizations for display clients authorized to access the virtual workspace for content of the particular digital asset.

### Claim 32 (depends on 31)

The method of claim 31, including
storing an authorization table accessible by the authorization server,
the authorization table including entries for the at least one participant OID storing the resource access tokens.

### Claim 33 (depends on 32)

The method of claim 32, wherein
accessing the authorization server includes:
determining on behalf of a participant OID whether the authorization table includes valid access tokens for access to the particular digital asset by requesting participant OID, and if not, to
(i) cause display of a placeholder graphical object at the display client, and
(ii) cause display of a prompt at the display client linked to the requesting participant OID to launch a procedure to obtain a valid access token.

### Claim 34 (depends on 31)

The method of claim 31, wherein
accessing the authorization server includes
determining on behalf of the at least one participant OID whether the display client seeking access to the particular digital asset is authenticated for access to a resource server storing the particular digital asset, and if not, to
(i) cause display of a prompt at a display client linked to the participant OID to login to the resource server, and
(ii) cause display of a prompt at a display client linked to the participant OID to launch a procedure to obtain a valid access token.

### Claim 35 (depends on 31)

The method of claim 31, wherein
accessing the authorization server includes:
storing refresh tokens at an authorization table, and
executing a procedure in the authorization server to refresh the access tokens for participant OIDs.

### Claim 36 (depends on 31)

The method of claim 31, wherein
the resource access tokens are virtual long-lived tokens.

### Claim 37

A collaboration system, comprising
a workspace server including one or more processors coupled to memory, the memory loaded with computer instructions to control display of at least a portion of a virtual workspace, the instructions, when executed on the processors, implement actions comprising:
during a shared collaboration session sharing the virtual workspace with multiple client nodes, using a first level authorization protocol for at least one participant operative identity (OID) to authenticate and authorize at least one respective display client participating in the shared collaboration session to access the virtual workspace including a workspace data set stored on the workspace server; and
sending, from the workspace server, data from the workspace data set to the at least one respective display client participating in the shared collaboration session, the workspace data set having a plurality of entries that identify respective digital assets and locations in the virtual workspace for graphical objects representing the digital assets, and wherein the plurality of entries includes an entry identifying a particular digital asset requiring second level authorization; and
an authorization server, including one or more processors coupled to memory, the memory loaded with computer instructions, the instructions, when executed on the processors, implement actions comprising:
maintaining resource access tokens usable to establish second level authorizations for display clients authorized to access the virtual workspace for content of the particular digital asset.

### Claim 38 (depends on 37)

The collaboration system of claim 37, the authorization server including
an authorization table in memory accessible by the authorization server,
the authorization table including entries for the at least one participant OID storing the resource access tokens.

### Claim 39 (depends on 38)

The collaboration system of claim 38, wherein actions implemented using the authorization server include:
determining on behalf of a participant OID whether the authorization table includes valid access tokens for access to the particular digital asset by requesting participant OID, and if not, to
(i) cause display of a placeholder graphical object at the display client, and
(ii) cause display of a prompt at the display client linked to the requesting participant OID to launch a procedure to obtain a valid access token.

### Claim 40 (depends on 37)

The collaboration system of claim 37, wherein
actions implemented using the authorization server include:
determining on behalf of the at least one participant OID whether the display client seeking access to the particular digital asset is authenticated for access to a resource server storing the particular digital asset, and if not, to
(i) cause display of a prompt at a display client linked to the participant OID to login to the resource server, and
(ii) cause display of a prompt at a display client linked to the participant OID to launch a procedure to obtain a valid access token.

### Claim 41 (depends on 37)

The collaboration system of claim 37, wherein
actions implemented using the authorization server include:
storing refresh tokens at an authorization table, and
executing a procedure in the authorization server to refresh the access tokens for participant OIDs.

### Claim 42 (depends on 37)

The collaboration system of claim 37, wherein
the resource access tokens are virtual long-lived tokens.

### Claim 43

A non-transitory computer readable storage medium impressed with computer program instructions to control display of at least a portion of a virtual workspace, the instructions, when executed on a processor or processors implementing actions comprising:
during a shared collaboration session sharing the virtual workspace with multiple client nodes, using a first level authorization protocol for at least one participant operative identity (OID) to authenticate and authorize at least one respective display client participating in the shared collaboration session to access the virtual workspace including a workspace data set stored on a server;
sending data from the workspace data set on the server to the at least one respective display client participating in the shared collaboration session, the workspace data set having a plurality of entries that identify respective digital assets and locations in the shared virtual workspace for graphical objects representing the digital assets, and wherein the plurality of entries includes an entry identifying a particular digital asset requiring second level authorization; and
accessing an authorization server that maintains resource access tokens usable to establish second level authorizations for display clients authorized to access the virtual workspace for content of the particular digital asset.

### Claim 44 (depends on 43)

The computer readable storage medium of claim 43, wherein the actions implemented include:
storing an authorization table accessible by the authorization server,
the authorization table including entries for the at least one participant OID storing the resource access tokens.

### Claim 45 (depends on 44)

The computer readable storage medium of claim 44, wherein the actions implemented at the authorization server include:
determining on behalf of a participant OID whether the authorization table includes valid access tokens for access to the particular digital asset by requesting participant OID, and if not, to
(i) cause display of a placeholder graphical object at the display client, and
(ii) cause display of a prompt at the display client linked to the requesting participant OID to launch a procedure to obtain a valid access token.

### Claim 46 (depends on 43)

The computer readable storage medium of claim 43, wherein the actions implemented at the authorization server include:
determining on behalf of the at least one participant OIDs whether the display client seeking access to the particular digital asset is authenticated for access to a resource server storing the particular digital asset, and if not, to
(i) cause display of a prompt at a display client linked to the participant OID to login to the resource server, and
(ii) cause display of a prompt at a display client linked to the participant OID to launch a procedure to obtain a valid access token.

### Claim 47 (depends on 43)

The computer readable storage medium of claim 43, wherein the actions implemented at the authorization server include:
storing refresh tokens at an authorization table, and
executing a procedure in the authorization server to refresh the access tokens for participant OIDs.

### Claim 48 (depends on 43)

The computer readable storage medium of claim 43, wherein the resource access tokens are virtual long-lived tokens.