Method and apparatus for creating switchable desktops with separate authorizations
View Patent ↗A system and method for creating switchable desktops each with its own authorization. The system provides a custom authentication and authorization data store that defines permission sets called roles, and lists which roles each user may assume. The system also provides a custom virtual desktop manager that creates new virtual desktops using the permissions defined by the roles. When a user requests a new virtual desktop and role from the desktop manager, the manager requests new virtual desktop components from the operating system. The desktop manager intercepts a request by the operating system to the Local Security Authority module for permissions to grant the new virtual desktop. The manager substitutes the user's requested role permissions for the permissions granted by the LSA module. The LSA module and operating system grant those role permissions in a newly created virtual desktop.
1. A system for creating switchable virtual desktops each requiring a different user authorization comprising:
a) at least one memory;
b) a custom authentication and authorization (A&A) data store configured to store roles assigned to each user in said at least one memory;
c) a custom virtual desktop manager including a desktop management agent and a virtual desktop application configured to provide a user interface to enable a user to manage said virtual desktops on a single user device and specify a role for each said virtual desktop, said custom virtual desktop manager configured to enable creating, switching, and destroying virtual desktops and to specify custom process tokens for each said virtual desktop, said process tokens defining different permissions within a single session, and are obtained from a Local Security Authority (LSA) module that requests and assigns process tokens to an executing process, wherein the virtual desktop application launches when a user logs onto a computer and provides a set of controls to enable the user to create a new virtual desktop, specify a role for each new desktop, and switch from one virtual desktop to another;
wherein said A&A data store and virtual desktop manager operate cooperatively to generate a plurality of data structures stored in said at least one memory, each representing one of said virtual desktops with an associated custom process token, so that when a user switches from a first one of said virtual desktops to a second one of said virtual desktops, and each of said first and second virtual desktops require a different user authorization, the user's authorization changes to an authorization associated with said switched virtual desktop without requiring the user to re-authenticate with said switched virtual desktop, and
wherein the desktop management agent is connected to the custom A&A data store and the LSA module, said agent configured to create and destroy virtual desktops and create custom process tokens for new virtual desktops when the user requests a new virtual desktop and specifies a role for the new virtual desktop, and the desktop management agent looks at a user account in the custom A&A data store to determine if the role is allowed, and
i) when said role is not allowed, the desktop management agent causes the virtual desktop application to prompt the user to use a different role,
ii) when said role is allowed, the desktop management agent creates a new desktop object and an accompanying user shell process to implement the new virtual desktop.
2. The system defined by claim 1 wherein the custom A&A data store when storing said assigned user roles defines a set of permissions assigned to a user in a virtual desktop, which permissions are interpreted by said the custom virtual desktop manager to create a corresponding process token.
3. The system defined by claim 1 wherein the virtual desktop application defines hot-key combinations to automatically switch from one virtual desktop to another.
4. The system defined by claim 1 wherein the desktop management agent is connected to the custom A&A data store and said desktop management agent is configured to determine the roles a logged-in user is allowed to use.
5. The system defined by claim 1 wherein the desktop management agent is connected to the LSA module and is configured via an LSA shim layer to intercept requests for process tokens when an operating system creates new processes and specifies a list of groups used to create the requested process token, wherein the list of groups defines the permissions associated with the role for a created virtual desktop.
6. The system defined by claim 5 wherein the created virtual desktop has an associated user shell process with a custom process token that gives the created virtual desktop the permissions granted by the role specified for the created virtual desktop, and when the user launches a new process in the created virtual desktop, the operating system assigns the virtual desktop's process token to the new process enabling switching between two virtual desktops with different roles to also switch permission sets.
7. A method for creating switchable virtual desktops each requiring a different user authorization comprising:
a) requesting a new virtual desktop with a new role;
b) receiving the request and querying a custom authentication and authorization (A&A) data store to determine if a user making the request has permission to use the requested role, said data store looking up the user's account for a list of roles the user is assigned and returning the results to a custom virtual desktop manager, said A&A data store including roles assigned to each user;
c) using the returned results to determine if the requested role is allowed or not, wherein
1) when the role is not allowed, denying the request for the new virtual desktop and prompting the user to use a different role; and
2) when the role is allowed,
i) requesting an operating system for a new desktop object with an accompanying user shell instance, said operating system creating the requested desktop object and user shell instance;
ii) requesting a Local Security Authority (LSA) module for permissions to use the user shell instance;
iii) intercepting the request to the LSA module and requesting the custom A&A data store for a role definition for the requested role;
iv) locating the role definition for the requested role and returning the role definition, the role definition specifying at least one of a user account and a group list; and
v) using the returned role definition to specify new permissions for the user shell instance and returning those permissions to create a new process token for the user shell instance using the received permissions, so that when a user on a single user device switches from a first virtual desktop to a second virtual desktop, and said first and second virtual desktops require a different user authorization, the user's authorization changes to an authorization associated with said switched virtual desktop without requiring the user to re-authenticate with said switched virtual desktop.
8. The method defined by claim 7 further comprising:
requesting a switch from a virtual desktop corresponding to a first role to a second virtual desktop corresponding to a second, different role, by switching a display from a first desktop object and corresponding user shell instance and first process token to a second desktop object and corresponding user shell instance and second process token, wherein the first and second process tokens define a different set of permissions.
9. The system defined by claim 1 wherein the desktop management agent is connected to the LSA module and is configured via an LSA shim layer to intercept requests for process tokens when an operating system creates new processes and specifies a user name used to create the requested process token, wherein the user name defines the permissions associated with the role for a created virtual desktop.