Secure access supersession on shared workstations

• US 9,251,354 B2
• Filed: 10/15/2013
• Issued: 02/02/2016
• Est. Priority Date: 10/15/2012
• Status: Active Grant

• Current Assignee: Imprivata Incorporated
• Original Assignee: Imprivata Incorporated
• Inventors: Ting, David M. T., Boone, Pieter-Jan, Ford, Timothy
• Primary Examiner(s): AVERY, JEREMIAH L
• Application Number:
  US14/054,270
• Publication Number:
  US 20140109243A1
• Time in Patent Office: 840 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/60 Protecting data

Abstract

Transitions between users at shared workstations that permit access to private health information or other secure data may be handled, without incurring unnecessary delays due to shut-down of all applications used by the departing user, by selectively hiding applications with sensitive information on a shared desktop while allowing temporary system access for the interrupting user.

Claims

1. A workstation configured for transitioning access to a shared desktop, the workstation comprising:

a user-authentication device for electronically detecting and obtaining data from an authentication token;

a network interface;

at least one user interface device; and

a computer processor in electronic communication with the user-authentication device and the at least one user interface device and which;

(i) runs at least one application launched at a request of a first user and visible on the at least one user interface device;

(ii) determines that at least one application launched by the first user is sensitive based on data accessed thereby;

(iii) recognizes a signal from the user-authentication device indicative of a use request by a second user, the use request including an identifier associated with the second user;

(iv) transmits, via the network interface, the identifier associated with the second user to a server;

(v) receives, via the network interface, an authorization from the server for the second user to access the shared desktop on the workstation;

(vi) launches a screen saver before allowing the second user to log on;

(vii) hides on the at least one user interface device, without shutting down and while the screen saver is active, the at least one sensitive application launched by the first user;

(viii) allows the second user to log on to the workstation via the at least one user interface device and the network interface to thereby access the shared desktop;

(ix) launches at least one application requested by the second user;

(x) allows the second user to log off the workstation via the at least one user interface device and the network interface, and following log-off of the second user,

(xi) unhides the at least one sensitive application launched at the request of the first user.

2. The workstation of claim 1, wherein the computer processor selectively hides only applications that have access to secure data and which the second user is not authorized to view.

3. The workstation of claim 1, wherein the computer processor requires a secondary form of authentication from the second user prior to allowing the second user to log on to the workstation.

4. The workstation of claim 1, wherein the computer processor automatically launches, following log-on of the second user, at least one application.

5. The workstation of claim 4, wherein the at least one automatically launched application is specified by a database record of the second user accessed by the server.

6. The workstation of claim 4, wherein the at least one automatically launched application is determined at least in part based on activity logs of the second user.

7. The workstation of claim 1, wherein the computer processor prevents the second user from unhiding the at least one application launched at the request of the first user.