System and method for delivering external data to a process running on a virtual machine

• US 8,695,019 B2
• Filed: 12/07/2004
• Issued: 04/08/2014
• Est. Priority Date: 02/14/2003
• Status: Active Grant

• Current Assignee: Actividentity Corporation (Assa Abloy AB)
• Original Assignee: Actividentity Corporation (Assa Abloy AB)
• Inventors: Sandland, Carl, Herscovitch, Matthew Patrick, Dingwall, Timothy Brian
• Primary Examiner(s): Anya, Charles E
• Application Number:
  US11/005,895
• Publication Number:
  US 20050198488A1
• Time in Patent Office: 3,409 Days
• Field of Search: 709201-207, 709217-219, 715/501.1, 715/513, 715736-749, 715760-763, 718/1, 719/311, 719/328, 719/318, 726 2- 8, 726 27- 30, 726/26, 713155-185
• US Class Current: 719/328
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

In a computer system including a computer terminal, an operating system installed on said computer terminal, a virtual machine running on the operating system, a server communicatively coupled to the computer terminal and a process including instructions that when executed on a virtual machine define a user interface; a Single Sign On (SSO) system comprising a database of authentication credentials accessible to the computer terminal, and instructions executable on the virtual machine operative to: obtain user interface state data from the process; query the virtual machine to obtain component data related to the user interface state data; and manipulate the component data so as to deliver authentication credentials to the process.

Claims

1. A computer system, comprising:

a computer workstation having an operating system installed thereon and having a virtual machine running under the operating system;

a server communicatively coupled to the workstation;

a process having instructions that define a user interface when executed on the virtual machine;

a database of authentication credentials accessible to and stored on the computer workstation;

a component for registering a single sign-on hook with an accessibility application programming interface in the virtual machine;

wherein the accessibility application programming interface obtains user interface state data from the process;

wherein the accessibility application programming interface notifies the single sign-on hook of the user interface state data;

wherein the single sign-on hook examines the user interface state data to determine whether a log-in opportunity of the process is detected based on the notification, and wherein the examining include a plurality of attributes of the user interface state data; and

wherein upon the log-in opportunity being detected, queries the virtual machine to obtain component data related to the user interface state data and manipulates the component data to deliver authentication credentials from the database of authentication credentials to the log-in opportunity of the process, wherein attribute data is used to obtain proper authentication credentials from the database.

2. The computer system claimed in claim 1, wherein the process comprises an applet stored at the server, the applet includes the instructions to define a user interface.

3. The computer system claimed in claim 2, wherein the computer system further includes a browser installed on said computer workstation that downloads the applet from the server and run the applet on the virtual machine.

4. The computer system claimed in claim 1, wherein the process comprises an application which includes the instructions to define a user interface.

13. The computer system claimed in claim 3, wherein the applet includes instructions for presenting an object in the user interface that prompts a user of the workstation to authenticate themselves to a resource provided by the server, the virtual machine instructions automatically delivering the authentication credentials to the object to effect the authentication.

5. A method for delivering external data to a process running on a virtual machine running on an operating system of a computer workstation, comprising:

registering a single sign-on hook with an accessibility application programming interface in the virtual machine;

obtaining, by the accessibility application programming interface, user interface state data from the process;

notifying, by the accessibility application programming interface, the single sign-on hook of the user interface state data;

examining, by the single sign-on hook, the user interface state data to determine whether a log-in opportunity of the process is detected based on the notification, wherein the examining include a plurality of attributes of the user interface state data; and

upon the log-in opportunity being detected, querying the virtual machine to obtain component data related to the state data and manipulating, using the component running on the virtual machine, the component data to deliver the external data to the log-in opportunity of the process, wherein the process calls out an external process to retrieve information carried by the external data and wherein the component data includes a database of authentication credentials that are stored on the computer workstation and wherein attribute data is used to obtain proper authentication credentials from the database.

6. The method of claim 5 wherein, the information carried by the external data includes a login script or authentication credentials.

7. The method of claim 6, wherein, in order to retrieve correct information, code running within the virtual machine determines a unique identifier for identifying the process running in the virtual machine.

8. The method of claim 7, wherein the unique identifier for identifying the process running in the virtual machine is selected from one of:

a class name of a window, a thread group of the window, textual information provided by an accessibility applications program interface (API) about the window, and a title of the window.

9. The method of claim 5, wherein the process implements a user interface and the state data is user interface state data.

10. The method of claim 9, wherein the user interface is a graphical user interface (GUI) and the user interface state data indicates creation of a window in the GUI.

11. The method of claim 5, wherein the process is either an applet or an application.

12. A computer system, comprising:

a computer workstation having an operating system installed thereon and having a virtual machine running under the operating system;

a server communicatively coupled to the workstation;

a process having instructions that define a user interface when executed on the virtual machine;

a component for registering a single sign-on hook with an accessibility application programming interface in the virtual machine;

wherein the accessibility application programming interface obtains user interface state data from the process;

wherein the accessibility application programming interface notifies the single sign-on hook of the user interface state data;

wherein the single sign-on hook examines the user interface state data to determine whether a log-in opportunity of the process is detected based on the notification, and wherein the examining include a plurality of attributes of the user interface state data; and

wherein upon the log-in opportunity being detected, queries the virtual machine to obtain component data related to the user interface state data and manipulates the component data stored on the computer workstation so as to deliver authentication credentials to the log-in opportunity of the process, wherein attribute data is used to obtain proper authentication credentials for the log-in opportunity.