# US 2013/0160013 A1 · User management framework for multiple environments on a computing device

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2013/0160013 A1
- Document ID: US20130160013A1
- Status: Published application
- Kind: A1
- Application number: 13/809,411
- Filed: 2010-07-01
- Published: 2013-06-20
- Earliest claimed: 2010-07-01
- Assignees: Hewlett-Packard Development Company, L.P.
- Inventors: Jose Paulo Pires; Valiuddin Y. Ali; Boris Balacheff; James M. Mann; Eduardo Moschetta
- Web page: https://patentgrep.com/patent/US20130160013A1

## CPC

- H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity}
- G06F 9/45533: {Hypervisors; Virtual machine monitors}
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 21/30: Authentication, i.e. establishing the identity or authorisation of security principals
- G06F 21/41: where a single sign-on provides access to a plurality of computers
- G06F 21/45: Structures or tools for the administration of authentication
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/102: {Entity profiles}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

An environment manager in a computer executes multiple environments concurrently. A user management framework (UMF) virtual machine an the computer runs an authentication domain that supports user profile management of the multiple environments.

## Claims

### Claim 1

A computing device, comprising:
an environment manager to execute multiple environments concurrently;
an authentication domain to run in a user management framework (UMF) virtual machine and to support user profile management of the multiple environments.

### Claim 2 (depends on 1)

The computing device of claim 1, wherein the authentication domain further comprises:
a global environment user identity module to maintain a global environment user identity for a user and a credential associated with the global environment user identity; and
an authentication policy for each environment.

### Claim 3 (depends on 1)

The computing device of claim 1, wherein an environment on the computing device comprises:
an authentication proxy to register a user profile for the user with the authentication domain, the user profile associated with the environment.

### Claim 4 (depends on 2)

The computing device of claim 2, the global environment user identity module further to support multiple global environment user identifies.

### Claim 5 (depends on 2)

The computing device of claim 2, wherein the UMF virtual machine further comprises:
a switching module to allow the user to switch between environments to which the user is registered according to the global environment user identity.

### Claim 6 (depends on 1)

The computing device of claim 1, the authentication domain to communicate with the multiple environments via at least one of:
a remote procedure call (RPC);
a web service;
a remote function call (RFC).

### Claim 7 (depends on 1)

The computing device of claim 1, further comprising:
a firmware Interface; and
the authentication domain further to provide a credential to the firmware interface.

### Claim 8

A method, comprising;
maintaining, in a privileged virtual machine associated with an environment manager on a computer, a global environment user identity for a user, the global environment user identity including a global environment user identity credential; and
enrolling an environment with the global environment user identity.

### Claim 9 (depends on 8)

The method of claim 8, therein the global environment user identity is maintained by an authentication domain in the privileged virtual machine, and wherein enrolling the environment further comprises:
the environment communicating a user profile and a user profile credential to the authentication domain via an authentication proxy; and
binding the user profile and the user profile credential to the global environment user identity.

### Claim 10 (depends on 8)

The method of claim 8, wherein the communicating comprises:
the authentication domain and the authentication proxy communicating via at least one of:
a remote procedure call (RFC);
a web service;
a remote function call (RFC).

### Claim 11 (depends on 9)

The method of claim 9, further comprising:
the authentication domain enrolling multiple profiles for the user with the global environment user identity, the profiles associated with different isolated virtual environments.

### Claim 12 (depends on 11)

The method of claim 11, further comprising:
the authentication domain maintaining an access policy for each enrolled profile.

### Claim 13 (depends on 11)

The method of claim 11, further comprising:
the authentication domain automatically distributing credentials associated with enrolled profiles to respective virtual environments in response to the user successfully providing the global environment user identity credential as input to the computer.

### Claim 14 (depends on 11)

The method of claim 11, further comprising:
the authentication domain automatically distributing a credential to a firmware interface in response to the user successfully providing the global environment user identity credential as input to the computer.

### Claim 15 (depends on 11)

The method of claim 11, further comprising:
maintaining additional global environment user identities in the privileged virtual machine on the computer.

### Claim 16

A computer-readable storage medium containing instructions that, when executed, cause a computer to:
maintain. In a privileged virtual machine associated with a hypervisor on a computer, a global environment user identity for a user, the global environment user identify including a global environment user identity credential; and
register an isolated virtual environment with the global environment user identity.

### Claim 17 (depends on 16)

The computer-readable storage medium of claim 16, wherein the global environment user identity is maintained by an authentication domain in the privileged virtual machine, and wherein the instructions that cause the enrolling comprise further instructions that cause the computer to:
send a user profile and a user profile credential to the authentication domain via an authentication proxy; and
link the user profile and the user profile credential to the global environment user identity.

### Claim 18 (depends on 17)

The computer-readable storage medium of claim 17, comprising further instructions that cause the computer to:
automatically push the user profile credential to the isolated virtual environment in response to the user providing the global environment user identity credential as input to the computer.

### Claim 19 (depends on 17)

The computer-readable storage medium of claim 17, comprising further instructions that cause the computer to:
automatically pull the user profile credential to the isolated virtual environment in response to a user request to access the isolated virtual environment.

### Claim 20 (depends on 16)

The computer-readable storage medium of claim 16, comprising further instructions that cause the computer to:
maintain additional hypervisor user identities in the privileged virtual machine;
register additional user profiles for different isolated virtual environments with respective hypervisor user identities; and
grant access to the different isolated virtual environments in view of an access policy for each user profile.