Access control center auto launch

• US 8,707,397 B1
• Filed: 09/10/2008
• Issued: 04/22/2014
• Est. Priority Date: 09/10/2008
• Status: Active Grant

• Current Assignee: United Services Automobile Association
• Original Assignee: United Services Automobile Association
• Inventors: Scott, Jeremy Ryan, Sternitzke, Steven Dale, Wilkinson, Christopher Thomas, Francovich, Edward Allen
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): Ho, Thomas
• Application Number:
  US12/208,323
• Time in Patent Office: 2,050 Days
• Field of Search: 726/4, 726/12, 705/26.41, 705/26.4, 709/203
• US Class Current: 726/4
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 9/465 Distributed object oriented systems remote method invocation [RMI] G06F9/548
• CPC Class Codes: G06Q 10/103 Workflow collaboration or project management
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/025 for remote control or remote monitoring of applications
• CPC Class Codes: H04L 67/08 specially adapted for terminal emulation, e.g. Telnet
• CPC Class Codes: H04L 67/1085 involving dynamic management of active down- or uploading connections
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/59 Providing operational support to end devices by off-loading in the network or by emulation, e.g. when they are unavailable

Abstract

Methods and systems provide indirect and temporary access to a company'"'"'s IT infrastructure and business applications. The methods/systems involve establishing an access control center (ACC) to control the access that technical support personnel may have to the company'"'"'s IT infrastructure and business applications. Thin client terminals with limited functionality may then be set up in the ACC for use by the technical support personnel. The thin client terminals connect the technical support personnel to workstations outside the ACC that operate as virtual desktops. The virtual desktops in turn connect the technical support personnel to the IT infrastructure and business applications. An ACC application may be used to automatically establish the connection between the thin client terminals and the virtual desktops and the virtual desktops and the IT infrastructure and business applications.

Claims

1. A system for controlling access by technical support personnel to a company'"'"'s computing device, the system comprising:

a thin client configured to send identification information from the technical support personnel, the technical support personnel and the thin client being located in an access control center (ACC) that is physically and logically isolated from the company'"'"'s computing device;

a proxy server configured to receive communications from the thin client and forward the communications to an ACC server;

the ACC server configured to;

authorize the technical support personnel to request a first approval from an authentication server after the ACC server receives the identification information from the proxy server;

request the first approval from the authentication server;

obtain the first approval from the authentication server for the technical support personnel, the first approval authorizing the technical support personnel to request a second approval from the authentication server and to access a virtual desktop wherein the virtual desktop functions as a workstation device;

connect the thin client to the virtual desktop in a first session;

obtain the second approval from the authentication server for the technical support personnel after obtaining the first approval, the second approval authorizing the technical support personnel to access the company'"'"'s computing device;

the virtual desktop configured to automatically establish a remote access session for the technical support personnel from the virtual desktop to the company'"'"'s computing device after obtaining the second approval wherein the virtual desktop is provided by a virtual desktop manager that provides a number of virtual desktops to a number of technical support personnel; and

the company'"'"'s computing device.

2. The system of claim 1, wherein the virtual desktop configured to automatically establish the remote access session is further configured to obtain access credentials for the company'"'"'s computing device.

3. The system of claim 2, wherein the access credentials are automatically obtained based on the company'"'"'s computing device.

4. The system of claim 2, wherein at least one access credential is manually selected for the company'"'"'s computing device by an authorized person.

5. The system of claim 1, wherein the virtual desktop configured to automatically establish the remote access session is further configured to execute a launch routine that is configured to automatically establish a remote session between the technical support personnel in the company'"'"'s computing device.

6. The system of claim 5, wherein the launch routine is executed automatically upon the second approval being obtained.

7. The system of claim 1, wherein the launch routine is initiated manually by the technical support personnel.

8. A method of controlling access by technical support personnel to a company'"'"'s computing device, the method comprising:

receiving identification information from the technical support personnel via a thin client at a proxy server, the technical support personnel and the thin client being located in an access control center (ACC) that is physically and logically isolated from the company'"'"'s computing device;

authorizing the technical support personnel to request a first approval from an authentication server after an ACC server receives the identification information from the proxy server;

request the first approval from the authentication server;

obtaining the first approval from the authentication server for the technical support personnel, the first approval authorizing the technical support personnel to request a second approval from the authentication server and to access a virtual desktop wherein the virtual desktop functions as a workstation device;

connecting the thin client to the virtual desktop in a first session wherein the virtual desktop is provided by a virtual desktop manager that provides a number of virtual desktops to a number of technical support personnel;

obtaining the second approval from the authentication server for the technical support personnel after obtaining the first approval, the second approval authorizing the technical support personnel to access the company'"'"'s computing device; and

automatically establishing a remote access session for the technical support personnel from the virtual desktop to the company'"'"'s computing device after obtaining the second approval.

9. The method of claim 8, wherein automatically establishing a remote access session includes obtaining access credentials for the company'"'"'s computing device.

10. The method of claim 9, wherein the access credentials are automatically obtained based on the company'"'"'s computing device.

11. The method of claim 9, wherein at least one access credential is manually selected for the company'"'"'s computing device by an authorized person.

12. The method of claim 8, wherein automatically establishing a remote access session includes executing a launch routine that is configured to automatically establish a remote session between the technical support personnel in the company'"'"'s computing device.

13. The method of claim 12, wherein the launch routine is executed automatically upon the second approval being obtained.

14. The method of claim 8, wherein the launch routine is initiated manually by the technical support personnel.

15. A non-transitory computer-readable medium encoded with computer-readable instructions for controlling access by technical support personnel to a company'"'"'s computing device, the computer-readable instructions comprising instructions for causing a computer to:

receive identification information from the technical support personnel via the thin client at a proxy, the technical support personnel and the thin client being located in an access control center (ACC) that is physically and logically isolated from the company'"'"'s computing device;

authorize the technical support personnel to request a first approval from an authentication server after an ACC server receives the identification information from the proxy server;

request the first approval from the authentication server;

obtain the first approval from the authentication server for the technical support personnel, the first approval authorizing the technical support personnel to request a second approval from the authentication server and to access a virtual desktop wherein the virtual desktop functions as a workstation device;

connecting the thin client to the virtual desktop in a first session wherein the virtual desktop is provided by a virtual desktop manager that provides a number of virtual desktops to a number of technical support personnel;

obtain the second approval from the authentication server for the technical support personnel after obtaining the first approval, the second approval authorizing the technical support personnel to access the company'"'"'s computing device; and

automatically establish a remote access session for the technical support personnel from the virtual desktop to the company'"'"'s computing device after obtaining the second approval.

16. The computer-readable medium of claim 15, wherein the instructions for causing a computer to automatically establish a remote access session cause the computer to obtain access credentials for the company'"'"'s computing device.

17. The computer-readable medium of claim 16, wherein the access credentials are automatically obtained based on the company'"'"'s computing device.

18. The computer-readable medium of claim 16, wherein at least one access credential is manually selected for the company'"'"'s computing device by an authorized person.

19. The computer-readable medium of claim 15, wherein the instructions for causing a computer to automatically establish a remote access session cause the computer to execute a launch routine that is configured to automatically establish a remote session between the technical support personnel in the company'"'"'s computing device.

20. The computer-readable medium of claim 19, wherein the launch routine is executed automatically upon the second approval being obtained.

21. The computer-readable medium of claim 15, wherein the launch routine is initiated.