UPDATING RESOURCE ACCESS PERMISSIONS IN A VIRTUAL COMPUTING ENVIRONMENT

• US 20130086648A1
• Filed: 11/27/2012
• Published: 04/04/2013
• Est. Priority Date: 02/08/2011
• Status: Abandoned Application

• Current Assignee: Aventura HQ Incorporated (Koninklijke Philips N.V.)
• Original Assignee: Aventura HQ Incorporated (Koninklijke Philips N.V.)
• Inventors: Jaudon, Joe, Lowrey, David, Williams, Adam
• Application Number:
  US13/686,647
• Publication Number:
  US 20130086648A1
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS

Abstract

Methods, systems, and devices are described for updating resource access permissions in a virtual computing environment. In these methods, systems, and devices, a host computer system determines that a user associated with an existing session has moved from a first location associated with a first set of access permissions to a second location associated with a second set of access permissions. The second set of access permissions is applied at the host computer to the existing session based on the determination that the user has moved to the second location. The user is then allowed to access the existing session from the second location according to the second set of access permissions.

Claims

1. A system for implementing a virtual computing environment, comprising:

a host computer system configured to;

host a session associated with a user;

determine that a user associated with an existing session has moved from a first location associated with a first set of access permissions to a second location associated with a second set of access permissions;

apply the second set of access permissions to the existing session based on the determination that the user has moved to the second location; and

allow the user to access the existing session from the second location according to the second set of permissions; and

a client device configured to communicate with the host computer system to provide a user interface to the existing session for the user at the second location.

2. The system of claim 1, wherein the host computer system is further configured to:

retrieve at least one access permission rule associated with the second location from a data store;

wherein the applying the second set of access permissions to the existing session comprises applying the at least one access permission rule to the existing session.

3. The system of claim 2, wherein the at least one access permission rule is associated with at least one action, wherein the host computer system is further configured to:

initiate the at least one action with respect to the existing session at the host computer system in response to the determination that the user has moved to the second location.

4. The system of claim 3, wherein the host computer system is further configured to:

authenticate the user at the second location;

wherein the initiating the at least one action with respect to the existing session at the host computer system occurs during the authentication of the user at the second location.

5. The system of claim 3, wherein the host computer system is further configured to:

prevent the user from accessing the session at the host computer system until after the at least one action has completed.

6. The method of updating resource access permissions in a virtual computing environment, comprising:

determining at a host computer system that a user associated with an existing session has moved from a first location associated with a first set of access permissions to a second location associated with a second set of access permissions;

applying the second set of access permissions at the host computer system to the existing session based on the determination that the user has moved to the second location; and

allowing the user to access the existing session from the second location according to the second set of access permissions.

7. The method of claim 6, further comprising:

retrieving at least one access permission rule associated with the second location from a data store; and

wherein the applying the second set of access permissions to the existing session comprises applying the at least one access permission rule to the existing session.

8. The method of claim 7, wherein the at least one access permission rule is associated with at least one action, the method further comprising:

initiating the at least one action with respect to the existing session at the host computer system in response to the determination that the user has moved to the second location.

9. The method of claim 8, wherein the at least one action comprises:

allowing the user to access a system resource based on the second location.

10. The method of claim 8, wherein the at least one action comprises:

preventing the user from accessing a system resource based on the second location.

11. The method of claim 8, wherein the at least one action comprises:

opening an application associated with the session based on the second location

12. The method of claim 8, wherein the at least one action comprises:

closing an application associated with the session based on the second location.

13. The method of claim 8, further comprising:

authenticating the user at the second location;

wherein the initiating the at least one action with respect to the existing session at the host computer system occurs during the authentication of the user at the second location.

14. The method of claim 8, further comprising:

preventing the user from accessing the session at the host computer system until after the at least one action has completed.

15. The method of claim 6, further comprising:

initiating the existing session at the host computer system in response to the user logging on to a first client device.

16. The method of claim 15, wherein the determining that the user has moved to the second location comprises:

determining at the host computer system that the user has logged on to a second client device associated with the second location.

17. A host computer system, comprising:

a location identification module configured to determine that a user associated with an existing session has moved from a first location associated with a first set of access permissions to a second location associated with a second set of access permissions;

an access permission module configured to apply the second set of access permissions to the existing session based on the determination that the user has moved to the second location; and

a session module configured to allow the user to access the existing session from the second location according to the second set of access permissions.

18. The host computer system of claim 17, further comprising:

a rule detection module configured to retrieve at least one access permission rule associated with the second location from a data store; and

a rule application module configured to apply the at least one access permission rule to the existing session.

19. The host computer system of claim 18, wherein the at least one access permission rule is associated with at least one action, the access permission module being further configured to:

initiate the at least one action with respect to the existing session at the host computer system in response to the determination that the user has moved to the second location.

20. The host computer system of claim 19, wherein the at least one action comprises:

allowing the user to access a system resource based on the second location.

21. The host computer system of claim 19, wherein the at least one action comprises:

preventing the user from accessing a system resource based on the second location.

22. The host computer system of claim 19, wherein the at least one action comprises:

opening an application associated with the session based on the second location.

23. The host computer system of claim 19, wherein the at least one action comprises:

closing an application associated with the session based on the second location.

24. The host computer system of claim 19, wherein:

the location identification module is further configured to authenticate the user at the second location; and

the initiating the at least one action with respect to the existing session at the host computer system occurs during the authentication of the user at the second location.

25. The host computer system of claim 19, wherein the access permission module is further configured to:

prevent the user from accessing the session at the host computer system until after the at least one action has completed.

26. The host computer system of claim 17, wherein the session module is further configured to:

initiate the existing session at the host computer system in response to the user logging on to a first client device.

27. The host computer system of claim 26, wherein location determining module is further configured to:

determine that the user has moved to the second location by determining that the user has logged on to a second client device associated with the second location.