Method and systems for dynamically providing communities of interest on an end user workstation
AssigneeAPI Technologies Corp.
InventorsTimothy C. Williams, Randall Breeden, Richard Holtslander, Edward Browdy
Life of this patent
Estimating the term…
Abstract
A method and system provide dynamic communities of interest on an end user workstation utilizing commercial off the shelf products, with central management and the ability for a users to log on only once (also known as “single sign on” or “SSO”). The software images that make up the virtual machine can be patched and updated with other required changes from a central storage area where the image can be administratively updated just once. A digital signature can be applied to the software images to ensure authenticity and integrity, along with determining whether a software image is up to date.
Claims23
A workstation that dynamically provides an authorized user logged in through an authentication server with access to a plurality of security domains over a network, each of the security domains providing the authorized user access to secure information associated with each of the respective security domains, the workstation comprising:
- a storage component that protectively stores a plurality of virtual machine appliances local to the workstation, each of the plurality of virtual machine appliances operatively configured to provide secured access to the secure information associated with at least one of the plurality of security domains over the network;
- and
- a virtual machine environment, operative on the workstation, that executes any one or more of the plurality of virtual machine appliances stored local to the workstation, wherein the virtual machine environment further comprises:
- an authentication component operative within the virtual machine environment that provides the user with a single sign on, and that receives a role associated the user, each role having a description that specifies a level of access the user has to one or more of the plurality of security domains,
- a monitoring component operative within the virtual machine environment that monitors changes to the role or its description, and
- an instantiating component operative with the virtual machine environment that instantiates a virtual machine on the workstation within the virtual machine environment for each of at least a first plurality of the plurality of the virtual machine appliances based on the role of the user, and that, based on changes to the role, dynamically instantiates another virtual machine on the workstation within the virtual machine environment and/or removes at least one of the instantiated virtual machines from the workstation within the virtual machine environment while the user is logged in,
- whereby the virtual machine environment dynamically controls access of the user to the plurality of security domains.
A method for authenticating a user of an end user workstation accessing one or more communities of interest over a network, comprising:
- determining, by a workstation, authentication data required for the user to access one or more of the communities of interest over the network;
- receiving, by the workstation, authentication data from the user;
- creating, by the workstation, a validation request;
- transmitting, by the workstation, the validation request to an authentication management server;
- providing, by the authentication management server, access to authentication information from the one or more communities of interest;
- accessing, by the authentication management server, a multi-domain Lightweight Directory Access Protocol (LDAP) server for authentication information;
- receiving, by the workstation, a response from the authentication management server;
- determining, by the workstation, if the user is a valid user;
- and
- if the user is determined to be a valid user, authorizing the user workstation to execute a virtual machine locally stored on the workstation, the virtual machine being associated with the one or more communities of interest.
A method for dynamically providing an authorized user logged in through an authentication server with access to a plurality of security domains over a network, each of the security domains providing the authorized user access to secure information associated with each of the respective security domains, the method comprising:
- receiving, by a workstation, authentication information from a user via a single sign on, the authentication information authenticating the user by logging the user in through the authentication server;
- receiving, by the workstation, a role associated with the authenticated user;
- retrieving, by the workstation, based on the received role, a plurality of virtual machine appliances stored local to the workstation, each of the plurality of virtual machine appliances stored local to the workstation and associated with one of the plurality of security domains to which the user has access;
- instantiating, by the workstation, a plurality of virtual machines in a virtual machine environment, each of the plurality of virtual machines corresponding to one of the plurality of retrieved virtual machine appliances, the virtual machine environment providing secured access to the secure information associated with each of the plurality of security domains via a corresponding one of the plurality of instantiated virtual machines;
- receiving, by the workstation, a change to the role of the user;
- and
- in response to and based on the received change and without further sign on, instantiating another virtual machine within the virtual machine environment thereby providing the user with access to another security domain or removing at least one of the instantiated virtual machines within the virtual machine environment thereby excluding the user from access to at least one of the plurality of security domains.
Dependencies are inferred from the claim text.