US 12,608,223 B2Granted

Systems and methods for migrating users and modifying workspace definitions of persona groups

AssigneeDell Products L.P.

InventorsJoseph Kozlowski, Nicholas D. Grobelny

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems and methods for migrating users and modifying workspace definitions of persona groups are described. In some embodiments, a memory storage device may have program instructions stored thereon that, upon execution by a workspace orchestration service, cause the service to: distribute a first workspace definition based upon a first persona group associated with a user to a client device operated by the user, where the user IHS is configured to instantiate a first workspace based upon the first workspace definition; and in response to a change in a productivity or security metric of the first workspace, determine whether to: (a) migrate the user to an existing second persona group, (b) create a third persona group and migrate the user to the third persona group, (c) modify the first persona group and migrate the user to the modified first persona group, or (d) identify a potential security threat.

Claims18

Dependent claims

An Information Handling System (IHS) of a workspace orchestration service, the IHS comprising:

a processor;
and
a memory coupled to the processor, the memory configured to store program instructions structured that, upon execution by the processor, cause the IHS to perform operations that comprise:
intercept a request received from a client device for access to a managed resource;
determine a security metric for a user of the client device, based at least in part on context information captured from the intercepted request;
determine a first persona group for the user, based at least in part on the security metric and the captured context information;
build a first workspace definition based at least in part on the first persona group;
distribute the first workspace definition to the client device;
in response to a change in user behavior determined based at least in part on telemetry received from the client device, determine whether to either:
(a) migrate the user to an existing second persona group based, at least in part, upon a determination that the changed user behavior matches a behavior of at least a second user in the existing second persona group, or (b) create a third persona group and migrate the user to the third persona group based, at least in part, upon a determination that the changed user behavior matches a changed user behavior of a selected number of users in the first persona group and that the changed user behavior is distinct from behavior of users in the existing second persona group, wherein the selected number of users of the first persona group is greater than a threshold value defined in a persona group management policy, and wherein at least one of the first, second, or third persona groups comprises at least one of:
software developer, business user, or customer support;
periodically determine whether a security risk score of the first workspace crossed one or more security risk threshold values, based at least in part on telemetry received from the client device;
and
in response to a determination the security risk score did not cross the one or more security risk threshold values, take a snapshot of the first workspace, and in response to a determination migration failed, rollback a workspace associated with the failed migration, based at least in part on the snapshot.

11 more elements

A memory storage device configured to store program instructions structured that, upon execution by one or more processors of an Information Handling System (IHS) of a workspace orchestration service, cause the IHS to perform operations that comprise:

intercept a request received from a client device for access to a managed resource;
determine a productivity metric for a user of the client device, based at least in part on context information captured from the intercepted request;
determine a first persona group for the user, based at least in part on the productivity metric and the captured context information;
build a first workspace definition based at least in part on the first persona group;
distribute the first workspace definition to the client device, wherein the client device is configured to instantiate a first workspace based upon the first workspace definition;
in response to a change in the productivity metric determined based at least in part on telemetry received from the client device, determine whether to either:
(a) migrate the user to an existing second persona group based, at least in part, upon a determination that the changed productivity metric matches a productivity metric of at least a second user in the existing second persona group, or (b) create a new persona group distinct from any existing persona group and migrate the user to the new persona group based, at least in part, upon a determination that the changed productivity metric matches a changed productivity metric of a selected number of users in the first persona group and that the changed productivity metric is distinct from a productivity metric of users in the existing second persona group, wherein the selected number of users in the first persona group is greater than a threshold value defined in a persona group management policy, and wherein at least one of the first persona group, the second persona group, or the new persona group comprises at least one of software developer, business user, or customer support;
periodically determine whether a security risk score of the first workspace crossed one or more security risk threshold values, based at least in part on telemetry received from the client device;
and
in response to a determination the security risk score of the first workspace did not cross the one or more security risk threshold values, take a snapshot of the first workspace, and in response to a determination migration to the existing second persona group or the new persona group failed, rollback the first workspace for the client device, based at least in part on the snapshot.

7 more elements

A method, comprising:

intercepting, by a workspace orchestration service, a request received from a client device for access to a managed resource;
determining, by the workspace orchestration service, a productivity metric and a security metric for a user of the client device, based at least in part on context information captured from the intercepted request;
determining, by the workspace orchestration service, a first persona group for the user, based at least in part on the productivity metric, the security metric, and the captured context information;
building, by the workspace orchestration service, a first workspace definition based at least in part on the first persona group;
distributing, by the workspace orchestration service, the first workspace definition to the client device;
receiving, by the client device, the first workspace definition from the workspace orchestration service;
instantiating, by the client device, a first workspace based upon the first workspace definition;
transmitting, from the client device to the workspace orchestration service, telemetry data indicative of a change in the productivity metric or the security metric for the user of the client device;
in response to detecting a change in the productivity metric or the security metric determined by the workspace orchestration service based at least in part on the telemetry data from the client device, determining, by the workspace orchestration service, whether to either:
(a) migrate the user to an existing second persona group based, at least in part, upon a determination that the changed productivity metric or the changed security metric matches a productivity metric or a security metric for at least a second user in the existing second persona group, or (b) create a new persona group distinct from any existing persona group and migrate the user to the new persona group based, at least in part, upon a determination that the changed productivity metric or the changed security metric matches a changed productivity metric or a changed security metric of a selected number of users in the first persona group and that any of the changed productivity metric or the changed security metric are distinct from a productivity metric or a security metric of users in the existing second persona group, wherein the selected number of users in the first persona group is greater than a threshold value defined in a persona group management policy, wherein at least one of the first persona group, the second persona group, or the new persona group comprises at least one of software developer, business user, or customer support, and wherein the threshold value is determined by the persona group management policy based at least in part on a predetermined ratio between a number of persona groups and a total number of users;
receiving, by the client device from the workspace orchestration service, a second workspace definition based at least in part on the existing second persona group or the new persona group, wherein the second workspace definition is configured to migrate the user to the existing second persona group or the new persona group;
periodically determining, by the workspace orchestration service, whether a security risk score of the first workspace crossed one or more security risk threshold values, based at least in part on telemetry received from the client device;
and
in response to determining, by the workspace orchestration service, the security risk score of the first workspace did not cross the one or more security risk threshold values, take a snapshot of the first workspace, and in response to determining, by the workspace orchestration service, migration to the existing second persona group or the new persona group failed, rollback the first workspace for the client device, based at least in part on the snapshot.

11 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/454,749Filed 12 Nov 2021
Published: US 2023/0153150 A118 May 2023
Granted: 21 Apr 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

G06F 9/4875
The task being a mobile agent, i.e. specifically designed to migrate: with migration policy, e.g. auction, contract negotiation
G06F 21/577
Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates…:…
H04L 63/107
For controlling access to devices or network resources: wherein the security policies are location-dependent, e.g. entities privileges depend on…
H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general