Selective container use for device usage sessions

• US 10,592,689 B2
• Filed: 10/20/2016
• Issued: 03/17/2020
• Est. Priority Date: 10/20/2016
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Brady, Kyle Thomas, Gordon, John C., Schultz, Benjamin M., Hajy, Ali, Olugbade, Morakinyo Korede, Pulapaka, Hari R., Bozzay, Paul, Smith, Frederick J., Iyigun, Mehmet
• Primary Examiner(s): Patel, Haresh N
• Application Number:
  US15/299,107
• Publication Number:
  US 20180114034A1
• Time in Patent Office: 1,244 Days
• Field of Search: 726 26
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 9/4451 User profiles; Roaming
• CPC Class Codes: G06F 9/44594 Unloading
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines

Abstract

Different containers are used for different usage sessions, a container referring to a virtualization layer for a computing device and used for isolation as well as hardware resource partitioning. A usage session refers to the time span beginning when one or more users begin to use the computing device, and ending when the one or more users cease using the computing device. During a particular usage session that uses a container, all interaction with the computing device is maintained in the container. The container is deleted when the usage session ends, leaving no data from the usage session behind after the usage session ends. Additionally, some usage sessions need not be run in containers, so data generated during such usage sessions is maintained after usage session ends. The host operating system automatically determines which usage sessions to run in containers and which usage sessions to run separate from any containers.

Claims

1. A method implemented in a computing device, the method comprising:

determining whether a user attempting to access the computing device is included in a set of known users;

responsive to a determination that the user is included in the set of known users, running a usage session in which the user accesses the computing device separate from any containers on the computing device; and

responsive to a determination that the user is not included in the set of known users;

associating the usage session with a container;

performing actions for the usage session in the container;

determining the usage session is ending; and

deleting, in response to the usage session ending, the container associated with the usage session and content generated during the usage session.

2. The method as recited in claim 1, wherein determining whether the user is included in the set of known users is based on identifying the user with one or more recognition techniques.

3. The method as recited in claim 1, further comprising determining the usage session is ending in response to no user being detected in close physical proximity to the computing device or in response to a shutdown of the computing device being imminent.

4. The method as recited in claim 1, further comprising:

determining that the user is included in the set of known users;

performing the actions for the usage session separate from any containers on the computing device;

determining the usage session is ending; and

ending the usage session while maintaining content generated during the usage session.

5. The method as recited in claim 1, wherein determining whether the user attempting to access the computing device is included in the set of known users is in response to the computing device being unlocked.

6. The method as recited in claim 1, wherein determining whether the user attempting to access the computing device is included in the set of known users is in response to a user input to unlock the computing device.

7. The method as recited in claim 1, further comprising:

determining whether an additional user attempting to access the computing device is included in the set of known users;

responsive to a determination that the additional user is included in the set of known users, running an additional usage session in which the additional user accesses the computing device separate from any containers in the computing device; and

responsive to a determination that the additional user is not included in the set of known users;

associating the additional usage session with an additional container, the container and the additional container being two different containers;

performing actions for the additional usage session in the additional container; and

determining the additional usage session is ending, and deleting, in response to the additional usage session ending, the additional container and content generated during the usage session.

8. The method as recited in claim 1, wherein determining whether the user attempting to access the computing device is included in the set of known users is based on a particular user input being received at the computing device.

9. The method as recited in claim 1, wherein determining whether the user attempting to access the computing device is included in the set of known users is based on a particular user input not being received at the computing device.

10. The method as recited in claim 1, wherein deleting the content generated during the usage session includes deleting at least some of the content from physical memory of the computing device.

11. The method as recited in claim 1, wherein deleting the content generated during the usage session includes deleting content from a storage device of the computing device.

12. The method as recited in claim 1, further comprising:

determining a class or group of the user; and

selecting, as the container associated with the usage session, a type of container that is associated with the class or group of the user.

13. A computing device comprising:

a usage session determination module implemented at least partially in hardware of the computing device to determine that a first usage session for a first user accessing the computing device is beginning;

an access mode determination module implemented at least partially in the hardware of the computing device to determine whether the first user is included in a set of known users, determine to run the first usage session without a container in response to a determination that the first user is included in the set of known users, and determine to run the first usage session in a first container in response to a determination that the first user is not included in the set of known users;

a virtualization module implemented at least partially in the hardware of the computing device to support performing actions for the first usage session in the first container; and

the virtualization module further configured to delete the first container and content generated during the first usage session in response to the first usage session that is running in the first container ending.

14. The computing device as recited in claim 13, wherein the usage session determination module is further configured to determine the first usage session is beginning in response to detecting at least one user in close physical proximity to the computing device or in response to detecting a user input to the computing device that is not unlocking the computing device.

15. The computing device as recited in claim 13, wherein the virtualization module is further configured to, in response to the first usage session running in the first container ending, delete content from a storage device of the computing device and overwrite memory allocated to the first container.

16. A computing device comprising:

a processor; and

a computer-readable storage media having stored thereon multiple instructions that, when executed by the processor, cause the processors to;

determine whether to run a first usage session in a container based on receipt of a particular input;

run the first usage session separate from any containers in response to a determination made not to run the first usage session in a container based on the particular input being received; and

run the first usage session in a first container in response to a determination made to run the first usage session in a first container based on the particular input not being received.

17. The computing device as recited in claim 16, wherein the multiple instructions further cause the processor to:

determine whether to run a second usage session in a container based on receipt of the particular input;

run the second usage session separate from any containers in response to a determination made not to run the second usage session in a container based on the particular input being received; and

run the second usage session in a second container in response to a determination made to run the second usage session in a second container based on the particular input not being received.

18. The computing device as recited in claim 17, wherein the multiple instructions further cause the processor to:

determine that the second usage session is to be run in the second container based on the particular input not being received, the first container and the second container being two different containers;

perform actions for the second usage session in the second container;

determine the second usage session is ending; and

delete, in response to the second usage session ending, the second container and content generated during the second usage session.

19. The computing device as recited in claim 16, wherein the multiple instructions further cause the processor to delete the content generated during the first usage session in response to the first usage session running in the first container ending, wherein the deletion is to delete at least some of the content from a storage device of the computing device.

20. The computing device as recited in claim 19, wherein to delete the content generated during the first usage session is further to overwrite portions of the storage device where the content generated during the first usage session was stored.