Location-based anticipatory resource provisioning

• US 10,656,796 B2
• Filed: 01/10/2019
• Issued: 05/19/2020
• Est. Priority Date: 11/19/2014
• Status: Active Grant

• Current Assignee: Imprivata Incorporated
• Original Assignee: Imprivata Incorporated
• Inventors: Ullrich, Meinhard Dieter
• Primary Examiner(s): Whipple, Brian
• Assistant Examiner(s): Tolchinsky, Gregory P
• Application Number:
  US16/244,587
• Publication Number:
  US 20190212882A1
• Time in Patent Office: 495 Days
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records
• CPC Class Codes: G16H 40/20 for the management or administration of healthcare resources or facilities, e.g. managing hospital staff or surgery rooms
• CPC Class Codes: G16H 40/67 for remote operation
• CPC Class Codes: G16Z 99/00 Subject matter not provided for in other main groups of this subclass
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 4/023 using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 4/33 for indoor environments, e.g. buildings
• CPC Class Codes: H04W 60/04 using triggered events
• CPC Class Codes: H04W 64/00 Locating users or terminals or network equipment for network management purposes, e.g. mobility management

Abstract

In various embodiments, the predicted location of a user within an institutional space is associated with a node at or near that location, and a virtual desktop is prepared before a user has actually logged on and authenticated. Although users are not accorded access to applications and sensitive data until they have properly authenticated themselves, the virtual desktop and associated data are assembled and retrieved in the background in order to eliminate delay following log-on.

Claims

1. A method of anticipatory provisioning of resources for mobile users in an institutional space, the method comprising:

providing a database storing records for a plurality of users, each of the records specifying, for one of the users, data specifying a provisioning policy for the user including at least one location-based triggering event;

detecting entry of a first mobile user into the institutional space;

after detecting entry of the first mobile user, predicting a first network node, within the institutional space, that the first mobile user is likely to access;

in accordance with the provisioning policy stored in the database for the first mobile user, causing a first virtual desktop for the first mobile user to be created within a first hosted session at a server;

delivering the first virtual desktop to the first network node prior to arrival of the first mobile user at the first network node;

after arrival of the first mobile user at the first network node, receiving log-on credentials for the first mobile user, and, upon acceptance of the log-on credentials for the first mobile user, providing network-based access for the first mobile user to the first virtual desktop at the first network node;

thereafter, detecting an electronically detected location-based triggering event indicative of departure of the first mobile user from the first network node; and

in response to the electronically detected location-based triggering event indicative of departure of the first mobile user from the first network node, (i) predicting a second network node, within the institutional space, that the first mobile user is likely to access, and (ii) delivering the first virtual desktop to the second network node prior to arrival of the first mobile user at the second network node.

2. The method of claim 1, wherein each of the records in the database specifies, for one of the users, data specifying a privilege level for the user, the method further comprising:

detecting entry of a second mobile user into the institutional space, the second mobile user having a privilege level different from the privilege level of the first mobile user;

in accordance with the provisioning policy and the privilege level stored in the database for the second mobile user, causing a second virtual desktop for the second mobile user to be created within a second hosted session at a server;

only in response to an electronically detected location-based triggering event indicative of arrival of the second mobile user at a third network node, delivering the second virtual desktop to the third network node; and

receiving log-on credentials for the second mobile user, and, upon acceptance of the log-on credentials for the second mobile user, providing network-based access for the second mobile user to the second virtual desktop at the third network node.

3. The method of claim 2, further comprising, in response to an electronically detected location-based triggering event indicative of departure of the second mobile user from the third network node, delivering the second virtual desktop to a fourth network node only after arrival of the second mobile user at the fourth network node.

4. The method of claim 1, wherein the second network node is predicted based on information accessed by the first mobile user at the first network node.

5. The method of claim 4, wherein the information comprises patient information.

6. The method of claim 1, wherein at least one of the first network node or the second network node is predicted based on a location history, within the institutional space, of the first mobile user.

7. The method of claim 1, wherein the entry of the first mobile user into the institutional space is detected using a perimeter-entry monitoring system.

8. The method of claim 1, further comprising, after detecting the electronically detected location-based triggering event indicative of departure of the first mobile user from the first network node and before predicting the second network node:

in response to the electronically detected location-based triggering event indicative of departure of the first mobile user from the first network node, (i) predicting a third network node, within the institutional space, that the first mobile user is likely to access, (ii) detecting use of the third network node by a mobile user other than the first mobile user, and (iii) not delivering the first virtual desktop to the third network node.

9. The method of claim 1, further comprising, after detecting the electronically detected location-based triggering event indicative of departure of the first mobile user from the first network node and before predicting the second network node:

in response to the electronically detected location-based triggering event indicative of departure of the first mobile user from the first network node, (i) predicting a third network node, within the institutional space, that the first mobile user is likely to access, (ii) delivering the first virtual desktop to the third network node prior to arrival of the first mobile user at the third network node, (iii) detecting movement of the first mobile user within the institutional space past the third network node without electronically detecting a location-based triggering event indicative of arrival of the first mobile user at the third network node, and (iv) revoking the first virtual desktop from the third network node.

10. The method of claim 1, wherein the first virtual desktop is created for the first mobile user after a confidence level of the prediction of the first network node exceeds a threshold.

11. The method of claim 1, wherein the at least one location-based triggering event for a particular user depends at least in part on an identity of the user.

12. The method of claim 1, wherein the first virtual desktop comprises data from a previous session of the first mobile user.

13. The method of claim 1, wherein the first virtual desktop, when delivered, includes (i) data from a previous session of the first mobile user when a default-restoration triggering event has not occurred prior to creation of the first virtual desktop, or (ii) default data for the first mobile user when the default-restoration triggering event has occurred prior to creation of the first virtual desktop.

14. The method of claim 13, wherein the default-restoration triggering event comprises a log-off by the first mobile user from the previous session.

15. The method of claim 13, wherein the default-restoration triggering event comprises a period of inactivity associated with the previous session of the first mobile user.

16. The method of claim 13, wherein the default-restoration triggering event comprises detection of the entry of the first mobile user into the institutional space, the previous session of the first mobile user having been initiated at a second institutional space different from the institutional space.