Elevating rights

• US 7,941,848 B2
• Filed: 01/30/2006
• Issued: 05/10/2011
• Est. Priority Date: 01/30/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Scallen, Steve, Koh, Jerry K, Yadav, Anil K
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Durham; Imhotep
• Application Number:
  US11/275,817
• Publication Number:
  US 20070180501A1
• Time in Patent Office: 1,926 Days
• Field of Search: 726/17, 726/21, 726/26, 726/28, 705/8, 705/9
• US Class Current: 726/21
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

System(s), techniques, and/or method(s) (“tools”) are described that enable a user to elevate his or her rights. The tools may do so by switching a user to an account having higher rights or a different, higher-rights context of a same account. The tools may elevate a user'"'"'s rights after a user enters a secure access sequence, such as Control+Alt+Delete, clicks on a button, or enters credentials. The tools may also enable a user to identify tasks that need higher rights to be performed by visually correlating graphic indicia with these tasks.

Claims

1. A method implemented at least in part by a computer, comprising:

intercepting a first task comprising a non-user initiated attempt to install an application downloaded over the internet prior to the first task being performed in order to check the first task against rights of a user;

identifying a second task;

contacting a rights elevator to begin a process for elevating the user'"'"'s rights;

responsive to the user currently being logged on to the computer'"'"'s operating system with an account having rights insufficient to permit the first task or the second task, prompting the user to enter a secure access sequence to elevate the rights of the user to a higher-rights context of the account, wherein the secure access sequence comprises simultaneous keystroke activation of more than one key;

following entry of the secure access sequence and prior to elevating the rights of the user, enabling the user to assent to permit the first task through a user entry in addition to the secure access sequence;

responsive to entry of the secure access sequence, initiating a process to minimally elevate the rights of the user to the higher-rights context of the account that minimally permits the first task without elevating the rights to another higher-rights context that would minimally permit the second task; and

elevating the rights of the user effective to permit the first task, following entry of the secure access sequence and completion of the process to minimally elevate rights.

2. The method of claim 1, wherein the act of elevating is performed following entry of the secure access sequence and prior to another entry by the user.

3. The method of claim 1, wherein the act of enabling allows the user to assent by selecting another user account having rights sufficient to permit the first task and by entering credentials usable to authenticate the another user account.

4. The method of claim 3, further comprising receiving the credentials and authenticating the another user account based on the credentials, wherein the act of elevating changes the rights of the user to that of the another user account.

5. The method of claim 1, wherein the act of enabling the user to assent to permit the first task comprises presenting a graphical user interface, the graphical user interface having:

multiple account regions, each account region identifying an account capable of permitting the first task; and

a credential region capable of receiving a credential for one of the accounts capable of permitting the first task.

16. The method of claim 1, wherein enabling the user to assent allows the user to assent without entering credentials.

17. The method of claim 1, wherein responsive to entry of the secure access sequence, initiating a process to minimally elevate the rights of the account to a higher-rights context of the account that minimally permits the second task without elevating the rights of the account to another higher-rights context that would minimally permit the first task.

6. One or more computer-readable storage media, wherein the computer-readable storage media exclude propagating carrier waves, the computer-readable storage media having computer-readable instructions encoded thereon, that, when executed by a computing device, configure the computing device to perform operations comprising:

presenting a user interface simultaneously comprising;

a first task;

a second task;

a first indicia indicating a need to elevate current user rights to rights sufficient to perform the first task and not sufficient to perform the second task, the first indicia being selectable to initiate a process to elevate the rights to perform the first task corresponding to the first indicia and not the second task; and

a second indicia indicating a need to elevate the current user rights to rights sufficient to perform the second task and not sufficient to perform the first task, the second indicia being selectable to initiate a process to elevate the rights to perform the second task corresponding to the second indicia and not the first task;

identifying the first task or the second task as comprising a non-user initiated attempt to execute instructions from the internet; and

responsive to receiving a selection of the first indicia, initiating the process to elevate the rights to rights sufficient to perform the first task corresponding to selected indicia but not unlimited rights.

7. The one or more computer-readable storage media of claim 6, the user interface further comprising a first region containing the first task and the first indicia and a second region containing the second task and the second indicia, the first region and the second region differentiated sufficient to indicate that the first indicia indicates a need to elevate the current user rights to rights sufficient to perform the first task and not sufficient to perform the second task.

8. The one or more computer-readable storage media of claim 6, wherein the first indicia comprises a triangular graphic.

13. The one or more computer-readable storage media of claim 6, wherein the selection of the first indicia initiates a process for elevating the rights to a level sufficient to perform the first task of a plurality of first tasks and sufficient to perform the second task of a plurality of second tasks, but not sufficient to perform all of the tasks of the plurality of first tasks and the plurality of second tasks.

14. The one or more computer-readable storage media of claim 6, wherein the selection of the second indicia initiates a process for elevating the rights to a level sufficient to perform the first task of a plurality of first tasks and the second task of a plurality of second tasks, but not sufficient to perform all of the tasks of the plurality of first tasks and the plurality of second tasks.

18. The one or more computer-readable storage media of claim 6, wherein, in the user interface, the selection of the second indicia initiates a process for elevating the rights of a user for the second task without being sufficient for the first task.

19. The one or more computer-readable storage media of claim 6, wherein, in the user interface, responsive to receiving the selection of the first indicia, initiating the process to elevate the rights to rights sufficient to perform the first task corresponding to selected indicia but not to rights sufficient to perform the second task.

9. One or more computer-readable storage media, wherein the computer-readable storage media exclude propagating carrier waves, the computer-readable storage media having computer-readable instructions encoded thereon, that, when executed by a computing device, configure the computing device to perform operations comprising:

presenting a first operating system user interface comprising a graphical indication of a single user account having a limited-rights context and a higher-rights context;

while the user account is operating within the limited-rights context;

presenting a graphical indication on the first operating system user interface that a task comprising a non-user initiated attempt to install an application downloaded over the internet requires assent to permit the task, and

enabling selection of the graphical indication to initiate a process to assent to permit the task; and

presenting a second operating system user interface enabling performance of the task responsive to receiving the assent to permit the task, wherein the assent to permit the task facilitates operating within the higher-rights context of the single user account to permit the task and the higher-rights context of the single user account is not sufficient to permit another task.

10. The media of claim 9, wherein the first operating system user interface enables assent to permit the task without any credentials.

11. The media of claim 9, wherein an indicia is selectable to initiate a process to assent to permit the task.

12. The media of claim 9, further comprising, prior to presenting the second operating system user interface, receiving a selection to initiate a process to assent to permit the task, presenting a third operating system user interface enabling entry of a credential , and authenticating the credential.

15. The media of claim 9, wherein the user account operating within the higher-rights context is limited to tasks corresponding to the graphical indication to initiate the process to assent to permit the task that is selected.