# US 12,225,018 B2 · Systems and methods for managing workspace capabilities > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,018 B2 - Document ID: US12225018B2 - Status: Granted - Kind: B2 - Application number: 18/157,160 - Filed: 2023-01-20 - Published: 2024-07-25 - Granted: 2025-02-11 - Earliest claimed: 2023-01-20 - Assignees: Dell Products L.P. - Applicants: Dell Products, L.P. - Inventors: Charles D. Robison; Girish S. Dhoble; Nicholas D. Grobelny; Jason Kolodziej - Web page: https://patentgrep.com/patent/US12225018B2 ## CPC - H04L 63/105: {Multiple levels of security} - H04L 63/102: {Entity profiles} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods are provided for managing capabilities of workspaces operating on an Information Handling System (IHS). A request is received from a user of the IHS for access to a protected resource. A security context and a productivity context are determined for operation of a primary workspace on the IHS. Two or more applications are identified for operation within the primary workspace, where the applications provide access to the protected resource, and where the applications include overlapping capabilities. Based on the security context and the productivity context for the primary workspace deployment, two or more of the applications with overlapping capabilities are selected for operation within the primary workspace. ## Claims ### Claim 1 A method for supporting workspaces on an Information Handling System (IHS), the method comprising: receiving a request from a user of the IHS for access to a protected resource; determining a security context and a productivity context for operation of a primary workspace on the IHS; identifying two or more applications for operation within the primary workspace, wherein the two or more applications provide access to the protected resource, and wherein the two or more applications comprise overlapping capabilities; and based on the security context and the productivity context, selecting the two or more applications comprising overlapping capabilities for operation within the primary workspace. ### Claim 2 (depends on 1) The method of claim 1, further comprising: generating a primary workspace definition in response to the request for access to the protected resource; including the selected two more applications within the workspace definition; and transmitting the primary workspace definition to the IHS for instantiation of the primary workspace on the IHS based on the primary workspace definition. ### Claim 3 (depends on 2) The method of claim 2, wherein the primary workspace is instantiated to operate using one or more CPUs and system memory of the IHS. ### Claim 4 (depends on 2) The method of claim 2, further comprising: receiving an inventory of peripheral devices coupled to the IHS; and selecting a first of the peripheral devices for operation of a subordinate workspace that is orchestrated by the primary workspace; generating a subordinate workspace definition for operation of the subordinate workspace on the first of the peripheral devices; and transmitting the subordinate workspace definition to the IHS. ### Claim 5 (depends on 4) The method of claim 4, wherein, upon being initiated, the subordinate workspace is instantiated for operation using logic and memory resources of the first of the peripheral devices. ### Claim 6 (depends on 4) The method of claim 4, further comprising: identifying an application for operation in the subordinate workspace, wherein capabilities of the application for operation in the subordinate workspace overlap with capabilities of applications for operation within the primary workspace; and based on a security context and a productivity context of the peripheral device, selecting the identified application for operation in the subordinate workspace, wherein the selected application is specified in the subordinate workspace definition. ### Claim 7 (depends on 1) The method of claim 1, wherein the overlapping capabilities of the two or more applications are determined based on overlapping entitlements required to operate each of the applications. ### Claim 8 (depends on 6) The method of claim 6, wherein the overlapping capabilities of the applications of the subordinate workspace and the primary workspace are determined based on overlapping entitlements required to operate each of the applications. ### Claim 9 (depends on 1) The method of claim 1, wherein the overlapping capabilities of the two or more applications of the primary workspace comprise overlapping security capabilities of the applications. ### Claim 10 (depends on 9) The method of claim 9, wherein the applications with overlapping security capabilities comprise at least two of a: antivirus application, firewall, malware detection, ransomware detection, multifactor authentication, encryption, VPN (Virtual Private Network) and secured data storage. ### Claim 11 (depends on 1) The method of claim 1, wherein the overlapping capabilities of the two or more applications of the primary workspace comprise overlapping file editing capabilities. ### Claim 12 (depends on 11) The method of claim 11, wherein the overlapping capabilities of the two or more applications of the primary workspace comprise overlapping keyboard entry and voice recognition capabilities. ### Claim 13 An Information Handling System (IHS) comprising: a processor; and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution, cause the processor to: issue a request to a remote orchestrator for access to a protected resource by a user of the IHS; report, to the remote orchestrator, a security context and a productivity context for operation of a primary workspace on the IHS; receive a primary workspace definition from a remote orchestrator, wherein the primary workspace definition specifies two or more applications for operation within the primary workspace, and wherein the two or more applications comprise overlapping capabilities and are selected by the remote orchestrator for providing access to the protected resource based on the reported security context and the productivity context; and instantiate the primary workspace on the IHS based on the received primary workspace definition. ### Claim 14 (depends on 13) The IHS of claim 13, wherein the overlapping capabilities of the two or more applications are determined based on overlapping entitlements required to operate each of the applications. ### Claim 15 (depends on 13) The IHS of claim 13, wherein the overlapping capabilities of the two or more applications of the primary workspace comprise overlapping security capabilities of the applications. ### Claim 16 (depends on 13) The IHS of claim 13, wherein execution of the program instructions further causes the processor to: report an inventory of peripheral devices coupled to the IHS; receive a subordinate workspace definition generated by the remote orchestrator in response to the reported inventory of peripheral devices; instantiate the subordinate workspace based on the subordinate workspace definition, wherein capabilities of an application specified in the subordinate workspace definition overlap with capabilities of applications for operation within the primary workspace. ### Claim 17 A system comprising: an Information Handling System (IHS) comprising: a processor; and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution, cause the processor to: issue a request to a remote orchestrator for access to a protected resource by a user of the IHS; report, to the remote orchestrator, a security context and a productivity context for operation of a primary workspace on the IHS; receive a primary workspace definition from a remote orchestrator, wherein the primary workspace definition specifies two or more applications for operation within the primary workspace, and wherein the two or more applications comprise overlapping capabilities and are selected by the remote orchestrator for providing access to the protected resource based on the reported security context and the productivity context; and instantiate the primary workspace on the IHS based on the received primary workspace definition; and the remote orchestrator configured to: generate the primary workspace definition in response to the requests for access to the protected resource; identify two or more applications for operation within the primary workspace, wherein the two or more applications provide access to the protected resource, and wherein the two or more applications comprise overlapping capabilities. ### Claim 18 (depends on 17) The system of claim 17, wherein the overlapping capabilities of the two or more applications are determined based on overlapping entitlements required to operate each of the applications. ### Claim 19 (depends on 17) The system of claim 17, wherein the overlapping capabilities of the two or more applications of the primary workspace comprise overlapping security capabilities of the applications. ### Claim 20 (depends on 17) The system of claim 17, wherein the primary workspace is instantiated to operate using one or more CPUs and system memory of the IHS.