Portable computer accounts

• US 20080034091A1
• Filed: 08/04/2006
• Published: 02/07/2008
• Est. Priority Date: 08/04/2006
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Gaya, Bruce
• Granted Patent: US 8,307,425 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect

Abstract

User accounts, authentication information and user home directories are stored on an external storage media that can be transferred from one device to another. Measures are included for detecting tampering of stored information and for preventing possibly conflicting or damaging account and file information from entering a host device.

Claims

1. A method, comprising:

providing a login screen for presentation on a display screen of a host device, the login screen including a list of accounts available for log in, where at least one account is associated with an external storage media operatively coupled to the host device;

receiving a first input from a user of the host device, the input specifying for log in the local account associated with the external storage media;

responsive to the first input, determining if the local account has a corresponding network account;

if the local account has a corresponding network account,

using the network account and associated authentication methods to authenticate the user of the host device; and

if the local account does not have a corresponding network account,

using information locally accessible by the host device to authenticate the user.

2. The method of claim 1, where using information locally accessible by the host device to authenticate the user, further comprises:

using an encrypted password stored on the external storage media to authenticate the user.

3. The method of claim 2, further comprising:

if the user is authenticated, prompting the user for information identifying an administrator of the host device;

if the information identifying the administrator is correct, adding the local account to an approved account list; and

allowing the login to proceed.

4. The method of claim 1, further comprising:

if the local account has a corresponding network account, overwriting account information stored on the external storage media with network account information.

5. The method of claim 4, further comprising:

adding the local account to an approved account list; and

allowing the login to proceed.

6. The method of claim 5, further comprising:

synchronizing the local account with the network account.

7. The method of claim 1, further comprising:

creating a directory on an external storage media;

making a near-copy of network account information;

storing the near-copy in the directory;

encrypting a password associated with the network account; and

storing the encrypted password on the external storage media, where the encrypted password is information locally accessible by the host device to authenticate the user.

8. The method of claim 7, further comprising:

encrypting the directory.

9. The method of claim 1, further comprising:

determining if the external storage media is coupled to the host device;

if the external storage media is coupled to the host device,

mounting the external storage media;

searching the external storage media for account information;

determining if an account corresponding to the account information can be displayed in the login window;

if the account can be displayed in the login window, adding the account to a local directory on the external storage media; and

displaying the account in the login window.

10. A computer-readable medium having instructions stored thereon, which, when executed by a processor, causes the processor to perform the operations of:

providing a login screen for presentation on a display screen of a host device, the login screen including a list of accounts available for log in, where at least one account is associated with an external storage media operatively coupled to the host device;

receiving a first input from a user of the host device, the input specifying for log in the local account associated with the external storage media;

responsive to the first input, determining if the local account has a corresponding network account;

if the local account has a corresponding network account,

using the network account and associated authentication methods to authenticate the user of the host device; and

if the local account does not have a corresponding network account,

using information locally accessible by the host device to authenticate the user.

11. The computer-readable medium of claim 10, where using information locally accessible by the host device to authenticate the user, further comprises:

using an encrypted password stored on the external storage media to authenticate the user.

12. The computer-readable medium of claim 11, further comprising:

if the user is authenticated, prompting the user for information identifying an administrator of the host device;

if the information identifying the administrator is correct, adding the local account to an approved account list; and

allowing the login to proceed.

13. The computer-readable medium of claim 10, further comprising:

if the local account has a corresponding network account, overwriting account information stored on the external storage media with network account information.

14. The computer-readable medium of claim 13, further comprising:

adding the local account to an approved account list; and

allowing the login to proceed.

15. The computer-readable medium of claim 10, further comprising:

creating a directory on an external storage media;

making a near-copy of network account information;

storing the near-copy in the directory;

encrypting a password associated with the network account; and

storing the encrypted password on the external storage media, where the encrypted password is information locally accessible by the host device to authenticate the user.

16. The computer-readable medium of claim 15, further comprising:

encrypting the directory.

17. The computer-readable medium of claim 10, further comprising:

determining if the external storage media is coupled to the host device;

if the external storage media is coupled to the host device,

mounting the external storage media;

searching the external storage media for account information;

determining if an account corresponding to the account information can be displayed in the login window;

if the account can be displayed in the login window, adding the account to a local directory on the external storage media; and

displaying the account in the login window.

18. A system, comprising:

means for providing a login screen for presentation on a display screen of a host device, the login screen including a list of accounts available for log in, where at least one account is associated with an external storage media operatively coupled to the host device;

means for receiving a first input from a user of the host device, the input specifying for log in the local account associated with the external storage media;

responsive to the first input, determining if the local account has a corresponding network account;

if the local account has a corresponding network account,

means for using the network account and associated authentication methods to authenticate the user of the host device; and

if the local account does not have a corresponding network account,

means for using information locally accessible by the host device to authenticate the user.

19. An apparatus, comprising:

a port configured for operatively coupling to a host device, where the host device is configured for operatively coupling with a network;

a directory storing user account information; and

authentication information, the authentication information for authenticating a user of the host device if a matching user account is not accessible on the network.

20. The apparatus of claim 19, where the directory is encrypted.