Systems and methods of managing access to remote resources

• US 9,665,700 B2
• Filed: 01/16/2013
• Issued: 05/30/2017
• Est. Priority Date: 01/16/2012
• Status: Expired due to Fees

• Current Assignee: Sphere 3D, Inc. (Sphere 3D Corporation)
• Original Assignee: Sphere 3D, Inc. (Sphere 3D Corporation)
• Inventors: Morelli, Jr., Giovanni
• Primary Examiner(s): Vaughan, Michael R
• Assistant Examiner(s): Savenkov, Vadim
• Application Number:
  US13/742,585
• Publication Number:
  US 20130185774A1
• Time in Patent Office: 1,595 Days
• Field of Search: 726 1- 2, 726 4, 726 17, 726 27- 30, 713182-186
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

A method and system are provided for managing access to resources available remotely from at least one computing device. The resources include at least one software application and at least one hardware component. The method and system involve storing access level indicators for indicating different types of access; storing identifiers for identifying different users with access to the at least one computing device and possible access to the resources; for each resource and each identifier, storing an access level indicator for that resource and that user; and before granting access to a resource for a user seeking access to the resource, operating a processor to: determine an identifier identifying the user; determine the access level indicator stored in the storage module for the identifier and the resource; and if access is consistent with the determined access level indicator, grant access to the resource, otherwise, deny access to the resource.

Claims

1. A method of managing access to a plurality of resources available remotely from at least one computing device, the plurality of resources comprising at least one software application providing at least one computer program and at least one hardware component, the method comprising:

storing, in a memory in electronic communication with the at least one computing device, a plurality of access level indicators for indicating a plurality of different types of access, wherein each access level indicator in the plurality of access level indicators indicates a different type of access in the plurality of different types of access, each different type of access is a type of access to at least one resource in the plurality of resources;

storing in the memory a plurality of identifiers for identifying different users having access to the at least one computing device and possible access to the plurality of resources;

for each resource in the plurality of resources, storing in the memory a resource access level indicator for that resource, wherein the resource access level indicator is selected from the plurality of access level indicators;

for each identifier in the plurality of identifiers, storing in the memory a user access level indicator for that identifier, wherein the user access level indicator is selected from the plurality of access level indicators;

before granting access to a resource in the plurality of resources for a user seeking access to the resource using a computing device in the at least one computing device, operating at least one processor, the at least one processor being in electronic communication with the computing device, to;

determine an identifier identifying the user seeking access to the resource;

determine the user access level indicator stored in the memory for the identifier and the resource access level indicator for the resource, the resource access level indicator being determinable from memory without using the identifier, and the user access level indicator being determinable from memory without identifying the resource being accessed; and

if the user access level indicator determined for the identifier is consistent with the resource access level indicator determined for the resource, grant access to the resource for operating the resource, otherwise, deny access to the resource,

wherein each resource of the plurality of resources is one of the at least one software application and the at least one hardware component.

2. The method as defined in claim 1, wherein the at least one software application is a plurality of software applications.

3. The method as defined in claim 1, wherein the at least one hardware component is a plurality of hardware components.

4. The method as defined in claim 1, wherein the plurality of resources are stored remotely from the at least one computing device.

5. The method as defined in claim 1, wherein:

the plurality of resources comprises a plurality of computer products available to be provided in an emulation session;

the method further comprises;

receiving a request from the computing device to establish an emulation session of a computer product from the plurality of computer products, the request comprising a requested computer product identifier identifying the computer product being requested; and

operating the at least one processor to determine the resource access level indicator in the memory for the computer product based on the requested computer product identifier.

6. The method as defined in claim 1 wherein:

the plurality of identifiers comprises an administrator identifier for identifying an administrator;

the method further comprises;

receiving a request to change the user access level indicator for an identifier and the resource access level indicator for a resource, wherein the request comprises a requestor identifier;

operating the processor to determine if the requestor identifier is the administrator identifier;

if the requestor identifier is the administrator identifier, changing the user access level indicator for the identifier and the resource access level indicator for the resource according to the request.

7. The method as defined in claim 6 further comprises:

in response to determining the requester identifier is not the administrator identifier, generating a denied access response indicating the request is denied, the denied access response includes at least one of redirecting a display of the computing device to a predetermined user interface and shutting down the computing device.

8. The method as defined in claim 1 wherein:

the plurality of identifiers comprises a user identifier for identifying a user, and an administrator identifier for identifying an administrator;

the user access level indicator for the administrator identifier provides an unlimited access to each resource in the plurality of resources, the unlimited access provides access to a resource without restrictions; and

the user access level indicator for the user identifier provides a limited access to each resource in the plurality of resources, the limited access provides access to a resource with at least one restriction.

9. The method as defined in claim 8, wherein the limited access includes at least one of a time restricted access granting the user access to the resource for a predefined time period, an operation restricted access granting the user access to the resource for conducting at least one predefined operation and a user type restricted access granting the user access to the resource as defined for each user type in a plurality of user types.

10. The method as defined in claim 9, wherein the operation restricted access includes at least one of a user interface restriction granting the user access to modify at least a portion of a user interface of the resource, a user display restriction granting the user access to modify at least one display setting of the computing device and an output port restriction granting the user access to modify at least one output setting of the computing device.

11. The method as defined in claim 1, wherein:

the user access level indicator is associated with a variable access threshold, the variable access threshold being a minimum availability level required at the at least one computing device in order for the at least one computing device to access the resource;

operating the at least one processor to determine the user access level indicator for the identifier comprises;

detecting an availability level of the at least one computing device, the availability level representing an operating capacity of the at least one computing device; and

determining whether the detected availability level satisfies the variable access threshold; and

operating the at least one processor to grant access to the resource comprises granting access to the resource in response to (i) determining the user access level indicator is consistent with the resource access level indicator and (ii) determining the detected availability level satisfies the variable access threshold.

12. The method as defined in claim 9, wherein the plurality of user types comprises a junior user having a lowest level of access to the resource, an intermediate user having an intermediate level of access to the resource and a senior user having a highest level of access to the resource.

13. The method as defined in claim 1, wherein the at least one processor is provided on the computing device.

14. The method as defined in claim 1, wherein the at least one processor is provided separate from the computing device.

15. The method as defined in claim 1, wherein operating the resource comprises operating the resource at a usage level associated with the resource access level indicator determined for that resource, each resource access level indicator being associated with a respective usage level.

16. A system of managing access to a plurality of resources available remotely from at least one computing device, the plurality of resources comprising at least one software application providing at least one computer program and at least one hardware component, the system comprising:

a controller in electronic communication with the at least one computing device, the controller comprising a control processor and a control memory having instructions stored thereon for configuring the control processor to;

store in the control memory a plurality of access level indicators for indicating a plurality of different types of access, wherein each access level indicator in the plurality of access level indicators indicates a different type of access in the plurality of different types of access, each different type of access is a type of access to at least one resource in the plurality of resources;

store in the control memory a plurality of identifiers for identifying different users having access to the at least one computing device and possible access to the plurality of resources;

for each resource in the plurality of resources, store in the control memory a resource access level indicator for that resource, wherein the resource access level indicator is selected from the plurality of access level indicators;

for each identifier in the plurality of identifiers, storing in the memory a user access level indicator for that identifier, wherein the user access level indicator is selected from the plurality of access level indicators; and

before granting access to a resource in the plurality of resources for a user seeking access to the resource using a computing device in the at least one computing device;

determine an identifier identifying the user seeking access to the resource;

determine the access level indicator stored in the control storage component for the identifier and the resource, the resource access level indicator being determinable from memory without using the identifier, and the user access level indicator being determinable from memory without identifying the resource being accessed; and

if the user access level indicator determined for the identifier is consistent with the resource access level indicator determined for the resource, grant access to the resource for operating the resource, otherwise, deny access to the resource,

wherein each resource of the plurality of resources is one of the at least one software application and the at least one hardware component.

17. The system as defined in claim 16, wherein the at least one software application is a plurality of software applications.

18. The system as defined in claim 16, wherein the at least one hardware component is a plurality of hardware components.

19. The system as defined in claim 16, wherein the plurality of resources are stored remotely from the at least one computing device.

20. The system as defined in claim 16, wherein:

the plurality of resources comprises a plurality of computer products available to be provided in an emulation session;

the control processor is further configured to;

receive a request from the computing device to establish an emulation session of a computer product from the plurality of computer products, the request comprising a requested computer product identifier identifying the computer product being requested; and

operate the at least one processor to determine the resource access level indicator in the memory for the computer product based on the requested computer product identifier.

21. The system as defined in claim 16 wherein:

the plurality of identifiers comprises an administrator identifier for identifying an administrator;

the control processor is further configured to;

receive a request to change the user access level indicator for an identifier and the resource access level indicator for a resource, wherein the request comprises a requestor identifier;

operate the processor to determine if the requestor identifier is the administrator identifier;

if the requestor identifier is the administrator identifier, change the user access level indicator for the identifier and the resource access level indicator for the resource according to the request.

22. The system as defined in claim 21, wherein the control processor is further configured to:

in response to determining the requester identifier is not the administrator identifier, generate a denied access response indicating the request is denied, the denied access response includes at least one of redirecting a display of the computing device to a predetermined user interface and shutting down the computing device.

23. The system as defined in claim 16 wherein:

the plurality of identifiers comprises a user identifier for identifying a user, and an administrator identifier for identifying an administrator

the user access level indicator for the administrator identifier provides an unlimited access to each resource in the plurality of resources, the unlimited access provides access to a resource without restrictions; and

the user access level indicator for the user identifier provides a limited access to each resource in the plurality of resources, the limited access provides access to a resource with at least one restriction.

24. The system as defined in claim 23, wherein the limited access includes at least one of a time restricted access granting the user access to the resource for a predefined time period, an operation restricted access granting the user access to the resource for conducting at least one predefined operation and a user type restricted access granting the user access to the resource as defined for each user type in a plurality of user types.

25. The system as defined in claim 24, wherein the operation restricted access includes at least one of a user interface restriction granting the user access to modify at least a portion of a user interface of the resource, a user display restriction granting the user access to modify at least one display setting of the computing device and an output port restriction granting the user access to modify at least one output setting of the computing device.

26. The system as defined in claim 16, wherein:

the user access level indicator is associated with a variable access threshold, the variable access threshold being a minimum availability level required at the at least one computing device in order for the at least one computing device to access the resource;

the control processor is further configured to;

detect an availability level of the at least one computing device, the availability level representing an operating capacity of the at least one computing device; and

determine whether the detected availability level satisfies the variable access threshold; and

grant access to the resource in response to (i) determining the user access level indicator is consistent with the resource access level indicator and (ii) determining the detected availability level satisfies the variable access threshold.

27. The system as defined in claim 24, wherein the plurality of user types comprises a junior user having a lowest level of access to the resource, an intermediate user having an intermediate level of access to the resource and a senior user having a highest level of access to the resource.

28. The system as defined in claim 16, wherein the controller is provided on the computing device.

29. The system as defined in claim 16, wherein the controller is provided separate from the computing device.

30. The system as defined in claim 16, wherein operating the resource comprises operating the resource at a usage level associated with the resource access level indicator determined for that resource, each resource access level indicator being associated with a respective usage level.