Method and apparatus for creating switchable desktops with separate authorizations
A system and method for creating switchable desktops each with its own authorization. The system provides a custom authentication and authorization data store that defines permission sets called roles, and lists which roles each user may assume. The system also provides a custom virtual desktop manager that creates new virtual desktops using the permissions defined by roles allowed for each user. When a user requests a new virtual desktop and role from the desktop manager, the manager requests new virtual desktop components from the operating system. The desktop manager intercepts a request by the operating system to the Local Security Authority module for permissions to grant the new virtual desktop. The manager substitutes the user's requested role permissions (if the user may assume the rule) for the permissions granted by the LSA module. The LSA module and operating system grant those role permissions to the user's activities in a newly created virtual desktop.
1. A system for creating switchable virtual desktops each requiring a different user authorization comprising:
a) at least one memory;
b) an authentication and authorization (A&A) data store configured to store roles assigned to each user in said at least one memory;
c) a virtual desktop manager including a desktop management agent and a virtual desktop application configured to provide a user interface to enable a user to manage said virtual desktops on a single user device and specify a role for each said virtual desktop, said virtual desktop manager configured to enable creating, switching, and destroying virtual desktops and to specify process tokens for each said virtual desktop, said process tokens defining different permissions with a single session, wherein the virtual desktop application launches when said user i) logs onto a computer, ii) creates a new virtual desktop, and requests a role for said new virtual desktop, and upon request by said user, initiates a switch from said new virtual desktop to another virtual desktop;
wherein said A&A data store and virtual desktop manager operate cooperatively to generate a plurality of data structures stored in said at least one memory, each representing one of said virtual desktops, so that when said user requests said switch from a first virtual desktop to a second virtual desktop, each requiring a different user authorization, the user's authorization automatically changes to an authorization associated with said second virtual desktop without requiring the user to re-authenticate with said second virtual desktop, and
wherein the desktop management agent is connected to the A&A data store to determine if the requested role is allowed, and
i) when said requested role is determined to be allowed, the desktop management agent creates said new virtual desktop, a desktop object and an accompanying user shell process to implement the new virtual desktop,
ii) when said role is determined to not be allowed, the desktop management agent causes the virtual desktop application to prompt the user to use a different role,
wherein the desktop management agent is connected to an LSA module and is configured to intercept requests for process tokens when an operating system creates new processes.
2. The system defined by claim 1 wherein the A&A data store when storing said assigned user roles defines a set of permissions assigned to a user in a virtual desktop, which permissions are interpreted by said virtual desktop manager to create a corresponding process token.
3. The system defined by claim 1 wherein said desktop management agent is configured to create process tokens for said new virtual desktops.
4. The system defined by claim 1 wherein the virtual desktop application defines hot-key combinations to automatically switch from one virtual desktop to another.
5. The system defined by claim 1 wherein the desktop management agent is connected to the A&A data store and said desktop management agent is configured to determine the roles a logged-in user is allowed to use.
6. The system defined by claim 1 wherein the desktop management agent being connected to the LSA module is configured via an LSA shim layer to intercept said requests for process tokens when the operating system creates new processes and specifies a list of groups used to create the requested process tokens wherein the list of groups defines the permissions associated with the role for a created virtual desktop.
7. The system defined by claim 6 wherein the created virtual desktop has an associated user shell process with a process token that gives the created virtual desktop the permissions granted by the role specified for the created virtual desktop, and when the user launches a new process in the created virtual desktop, the operating system assigns the desktop's process token to the new process enabling switching between two virtual desktops with different roles to also switch permission sets.
8. The system defined by claim 1 wherein the desktop management agent being connected to the LSA module is configured via an LSA shim layer to intercept said requests for process tokens when the operating system creates new processes and specifies a user name used to create the requested process tokens wherein the user name defines the permissions associated with the role for a created virtual desktop.
9. A method for creating switchable virtual desktops each requiring a different user authorization comprising:
a) requesting a new virtual desktop with a new role from a first virtual desktop;
b) receiving the request and querying an authentication and authorization (A&A) data store to selectively determine if a user making the request has permission to use the requested role, and when said user making the request is determined to have said permission, said data store looking up the user's account in the A&A data store for a list of roles the user is assigned and returning the results to a virtual desktop manager, said A&A data store including roles assigned to each user;
the virtual desktop manager creating, switching, and destroying virtual desktops and specifying process tokens for each said virtual desktop, said process tokens defining different permissions within a single session,
c) the virtual desktop manager including a desktop management agent connected to the A&A data store and the desktop management agent looking at a user account in the A& A data store to determine if the requested role is allowed, and when the role requested is determined to be allowed,
i) requesting an operating system for a new desktop object, said operating system creating the requested desktop object;
ii) requesting the A&A data store for a role definition for the requested role;
iii) locating the role definition for the requested role and returning the role definition, the role definition specifying at least one of a user account and a group list; and
iv) using the returned role definition to create the new virtual desktop so that when a user on a single user device switches from the first virtual desktop to a second virtual desktop, and said first and second virtual desktops require a different user authorization, the user's authorization automatically changes to an authorization associated with said second virtual desktop without requiring the user to re-authenticate with said second virtual desktop, and
wherein the desktop management agent is connected to the A&A data store and the desktop management agent looks at a user account in the A&A data store to determine if the requested role is allowed, and
when said role is determined to not be allowed,
the desktop management agent causes the virtual desktop application to prompt the user to use a different role,
wherein the desktop management agent is connected to an LSA module and is configured to intercept requests for process tokens when an operating system creates new processes.
10. The method defined by claim 9 further comprising:
requesting a switch from a first virtual desktop corresponding to a first role to a second virtual desktop corresponding to a second, different role, by switching a display from a first desktop object to a second desktop object.