Patent Application
20070016958
1. Technical Field
The present invention relates in general to improved data processing systems and in particular to limiting use of a computer system by a any user. Still more particularly, the present invention relates to allowing any computer users access to use only a selection of the available applications at a computer system without requiring a log in.
2. Description of the Related Art
Computer users today often have access to and use of many different computer systems on a single day. In addition, many computers today are often accessed and used by more than one user on a consistent basis. Because of the diversity of users that may access and attempt to use a particular computer system, an owner of a computer system may desire that other users of the computer system or unauthorized users of the computer system only receive limited use, if any, of the computer system.
In one example, some computer systems limit use of the functions of the computer system by requiring any user to log in to the system under a particular profile, where each profile specifies access privileges. For example, an operating system of a computer system may locally store multiple user profiles, where each user has a log in password and protected files accessible under the profile. In another example, other computer systems are attached via a network to a security server that only allows users that enter network identifiers and passwords to use a computer system. In both systems that use local and network based profiles to control use of a computer system, one of the profiles may be a guest profile that any user accessing the computer system uses to log in and receive limited system use under the guest profile.
In another example, some computer systems limit use of the functions of the computer system by running demonstration software that renders the user interface of the computer system accessing for a single purpose specified by the demonstration software. For example, a vendor may include a computer system in a store-front and run software on that computer system specifically designed to guide the user through a customer service questionnaire, a product demonstration, or other vendor specified purpose, and not display options that allow the user to access any other functions of the underlying computer system.
While profile-based access and vendor-specific software are methods for limiting some users from accessing the full functions of a computer system provide, these methods are limited. In particular, profile-based access is limited because it requires that a user have administrator access to create a profile, it requires that each user log in under a particular profile and that a user log out to switch between profiles and that if a guest profile is offered, that a guest know that they can log in under the guest profile. Further, under a guest log in, the user is typically able to access all applications and files that are not specifically password protected. Further, vendor-specific software is limited because it limits the user to the demonstration or customer service provided by the software, is expensive because it is specified for a particular vendor, and blocks the vendor from providing customer access to any other applications accessible at the computer system. In many situations, however, with both personal computers in a home, network computers within an office, and terminal computers within a store-front, it would be advantageous to provide any user with access to a limited selection of the applications already accessible to the computer system without requiring a guest log in or running an expensive vendor-specific software application, while still allowing authorized users full, normal access to the computer system.
In view of the foregoing limitations, it would be advantageous to provide a method, system, and program for enabling an authorized user to select a link or enter other input to switch the computer system to a selective lock mode, wherein in selective lock mode the display interface includes a selective lock folder of a selection of available application links from among all the applications available at the computer system, such that any user accessing the computer system in selective lock mode is able to use any of the applications with application links without having to log in. In addition, it would be advantage to provide a method, system, and program for enabling an authorized user to easily select the “all access” applications by dragging application links into the selective lock folder and for enabling authorized users to trigger the selective lock mode by selecting an selective lock icon or by designating settings for automatically triggering the selective lock mode, such as on user log out. Further, it would be advantageous to provide a method, system, and program for enabling an authorized user to easily select to return to normal mode by selecting an unlock icon or entering another input that triggers a password prompt sequence, such that authorized users are in control of placing the computer system in and out of selective lock mode, but all other users receive the benefit of access to a selection of applications without a log in under a particular profile.
Therefore, the present invention provides for improved data processing system and in particular provides an improved method, system, and program for limiting use of a computer system by a non-authorized user. Still more particularly, the present invention provides a method, system, and program for allowing any computer users access to use only a selection of the available applications at a computer system without a system log in.
In one embodiment, a computer system operates in normal mode where all applications and files are accessible to an authorized user, where an authorized user enters a required log in to access all applications. When a trigger to change the control access from normal mode to selective lock mode is detected, access to the applications and files is blocked and the content within the user interface is cleared to initiate the selective lock mode. Next, content is added to the user interface including a folder with only a selection of the applications each accessible through a separate selectable link, where the selectable links are designated in the particular folder by an authorized user during normal mode. During selective lock mode, any user may only select to open one of the selection of applications by selecting a displayed selectable link for the application. Responsive to a selection of a selectable link, a wrapper function is called that opens the application, wherein any user is enabled to fully access only the wrappered application and the wrapper blocks access to the remainder of the computer system, such that during selective lock mode any user is presented with access, without first logging in, to a fully functioning version of each of the selection of applications designated by the authorized user in the particular folder.
During selective lock mode, an authorized user may request to switch to normal mode by triggering the switch and entering a password that indicates authorization to access the computer system in normal mode. In particular, a display interface during the selective lock mode may include a selectable object, the selection of which triggers the password authorization prompt to switch from selective lock mode to normal mode.
The trigger to change access from normal mode to selective lock mode may be detected from a user selection of a selective lock icon or from an automatic trigger if a setting for automatically triggering the change to selective lock mode is met. For example, a setting may specify an idle time at which selective lock mode is triggered or that a user log out triggers selective lock mode.
Additionally, an authorized user may specify a selection of secondary applications. During selective lock mode, a wrapper function is called to open each of the selection of secondary applications, but a selectable link for the application is not included in the user interface during selective lock mode for selection by a non-authorized user.
The novel features believed characteristic of the invention are set forth in the appended claims. The invention itself however, as well as a preferred mode of use, further objects and advantages thereof, will best be understood by reference to the following detailed description of an illustrative embodiment when read in conjunction with the accompanying drawings, wherein:
Referring now to the drawings and in particular to
Computer system 100 includes a bus 122 or other communication device for communicating information within computer system 100, and at least one processing device such as processor 112, coupled to bus 122 for processing information. Bus 122 preferably includes low-latency and higher latency paths that are connected by bridges and adapters and controlled within computer system 100 by multiple bus controllers. When implemented as a server system, computer system 100 typically includes multiple processors designed to improve network servicing power.
Processor 112 may be a general-purpose processor such as IBM's PowerPC (PowerPC is a registered trademark of International Business Machines Corporation) processor that, during normal operation, processes data under the control of an operating system 160 and application software 164 accessible from a dynamic storage device such as random access memory (RAM) 114. Although not depicted, operating system 160 and application software 164 may also be accessible from static storage device such as Read Only Memory (ROM) 116. The operating system 160 facilitates a user interface via at least one input and output device. For example, operating system 160 may facilitate a graphical user interface (GUI) via a display 124 for output of graphical images and a cursor control device 130 for facilitating user inputs through the selection of a positioned a cursor within display 124. In one embodiment, application software 164 contains machine executable instructions that when executed on processor 112 carry out the operations depicted in the flowchart of
The present invention may be provided as a computer program product, included on a machine-readable medium having stored thereon the machine executable instructions used to program computer system 100 to perform a process according to the present invention. The term “machine-readable medium” as used herein includes any medium that participates in providing instructions to processor 112 or other components of computer system 100 for execution. Such a medium may take many forms including, but not limited to, non-volatile media, volatile media, and transmission media. Common forms of non-volatile media include, for example, a floppy disk, a flexible disk, a hard disk, magnetic tape or any other magnetic medium, a compact disc ROM (CD-ROM) or any other optical medium, punch cards or any other physical medium with patterns of holes, a programmable ROM (PROM), an erasable PROM (EPROM), electrically EPROM (EEPROM), a flash memory, any other memory chip or cartridge, or any other medium from which computer system 100 can read and which is suitable for storing instructions. In the present embodiment, an example of a non-volatile medium is mass storage device 118 which as depicted is an internal component of computer system 100, but will be understood to also be provided by an external device. Volatile media include dynamic memory such as RAM 114. Transmission media include coaxial cables, copper wire or fiber optics, including the wires that comprise bus 122. Transmission media can also take the form of acoustic or light waves, such as those generated during radio frequency or infrared data communications.
Moreover, the present invention may be downloaded as a computer program product, wherein the program instructions may be transferred from a remote computer such as a server 140 to requesting computer system 100 by way of data signals embodied in a carrier wave or other propagation medium via a network link 134 (e.g. a modem or network connection) to a communications interface 132 coupled to bus 122. Communications interface 132 provides a two-way data communications coupling to network link 134 that may be connected, for example, to a local area network (LAN), wide area network (WAN), or directly to an Internet Service Provider (ISP). In particular, network link 134 may provide wired and/or wireless network communications to one or more networks.
Network link 134 in turn provides data communication services through network 102. Network 102 may refer to the worldwide collection of networks and gateways that use a particular protocol, such as Transmission Control Protocol (TCP) and Internet Protocol (IP), to communicate with one another. Network link 134 and network 102 both use electrical, electromagnetic, or optical signals that carry digital data streams. The signals through the various networks and the signals on network link 134 and through communication interface 132, which carry the digital data to and from computer system 100, are exemplary forms of carrier waves transporting the information.
When implemented as a server system, computer system 100 typically includes multiple communication interfaces accessible via multiple peripheral component interconnect (PCI) bus bridges connected to an input/output controller. In this manner, computer system 100 allows connections to multiple network computers, such as client 150, via network 102.
In addition, computer system 100 typically includes multiple peripheral components that facilitate communication. These peripheral components are connected to multiple controllers, adapters, and expansion slots coupled to one of the multiple levels of bus 122. For example, an audio output device 128 and audio input device 129 are connectively enabled on bus 122 for controlling audio outputs and inputs. A display device 124 is also connectively enabled on bus 122 for providing visual, tactile or other graphical representation formats and a cursor control device 130 is connectively enabled on bus 122 for controlling the location of a pointer within display device 124. A keyboard 126 is connectively enabled on bus 122 as an interface for user inputs to computer system 100. In alternate embodiments of the present invention, additional input and output peripheral components may be added.
Those of ordinary skill in the art will appreciate that the hardware depicted in
Referring now to
In the example, for purposes of describing the present invention, applications layer 204 includes multiple applications accessible to the computer system represented by application 206 and a selective lock application 208. In addition, it will be understood that applications layer 204 may include additional types of application software.
Applications 206 includes applications that are selectable, individually, for use by a user. In a normal operating mode, a user authorized to use computer system 100 by operating system 160 is allowed access to use any of applications 206. Selective lock application 208 is an application that places the computer system in selective lock mode and locks the user interface from any user access to any applications or files, except those applications included in a particular selective lock folder displayed within an output interface of device layer 212. Thus, when selective lock application 208 is running the selective lock mode, any user can only choose to run a designated selection of applications 206. As will be further described, selective lock application 208 detects user selection of one of the designated selection of applications and calls a wrapper that opens the selected application to allow the user to access the full functionality of the application, but limits accesses to applications or files outside the wrappered application.
It is important to note that throughout the description of the invention, the term authorized user is used in association with users who are able to use a computer system when it is in a normal mode, meaning in a mode not controlled by selective lock application 208 in selective lock mode. An authorized user may include, but is not limited to, a user who has access to the computer system after entering a user identifier and password or selecting a particular profile. An authorized user may include those users with access to the password that enables changing a system from selective lock mode back to normal mode. In contrast, a non-authorized user is one who uses the computer system while it is in selective lock mode. An authorized user and non-authorized user may be physically the same user, using a computer system in different capacities or different people.
With reference now to
Referring now to
In particular, selective lock application 208 includes a settings controller 406 that an authorized user can run and that prompts the authorized user to select preferences for triggering the selective lock mode and preferences for performance during selective lock mode. In particular, an authorized user may select preferences that are stored as application lock settings 404 as to the amount of time that a system may remain idle before automatically triggering application lock controller 402 and whether an authorized user log out should automatically trigger application lock controller 402. In addition, settings controller 406 may direct an authorized user to select a preference as to the location and display attributes of selective lock folder 408 that specifies those applications that are to be accessible to any user during selective lock mode. Further, settings controller 406 may direct a user to select which applications are to be included in selective lock folder 408 by selecting from an application directory, for example. In particular, while selective lock folder 408 is illustrated as a component of selective lock application 208, selective lock folder 408 may be any folder located on any accessible system that is designated in application lock settings 404 as the folder where selected application links for selective lock mode are located. Further, selective lock folder 408 may be displayed within the user interface in normal mode and selective lock mode, or only during selective lock mode. Additionally, settings controller 406 may guide an authorized user to select applications to place in selective lock folder 408 or an authorized user may place links to selected applications in selective lock folder 408 through any of the methods enabled by operating system 160 for placement of links, such as a dragging and dropping icons that open applications into selective lock folder 408.
In addition, in blocking access during selective lock mode, application lock controller 402 directs operating system 160 to clear the contents within a user interface of any selectable display objects other than selective lock folder 408, the selectable application links included in selective lock folder 408, and a selectable unlock icon. Selection of the selectable unlock icon, as will be further described, triggers applications lock controller 402 to control a password prompt required to return to normal mode. As an alternative to displaying a selectable unlock icon, a user may enter a key sequence of a particular voice command to trigger the password prompt.
Additionally, an authorized user may select in application lock settings 404, through settings controller 406, at least one secondary applications that is enabled to run during selective lock mode other than the operating system, but which is not included in the selective lock folder. For example, a user may choose to enable a screen saver application to run during selective lock mode as a secondary application, but would not want non-authorized users to have access to the screen saver application to change its settings. After blocking access during selective lock mode, application lock controller 402 may trigger a wrapper function to open secondary applications designated in application lock settings 404 to run but not be accessible to the user.
From among the selectable application links in selective lock folder 408, a non-authorized user may select to open an application. For purposes of example, the non-authorized user selects a link associated with application 1 from selective lock folder 408. Application lock controller 402 calls a wrapper function that opens application 1. The wrapper fimction allows the non-authorized user full access to the functionality of application 1, but no memory accesses beyond wrappered application 1.
Next, if an authorized user selects to unlock the selective lock mode and return to normal mode, by selecting an unlock icon or through other input, application lock controller 402 prompts the authorized user for a password. If the authorized user enters the required password, then application lock controller 402 closes wrappered applications and may redirect the operating system to restore the memory to the system status before the selective lock mode initiated. A password may include alphanumeric entries, voice entries, biometric entries, and other input that identifies the user as authorized to unlock the screen.
It is important to note that the components of selective lock application 208 may be included as functional components of operating system 160, rather than as a stand-alone application or may be included as functional components of a Java applet or other component triggered from a web site. Further, it is important to note that the components of selective lock application 208 may be distributed across multiple computer systems and may be accessed by a computer system from a server system, such as server 140 in
In one example of the advantage of the invention, an authorized user may trigger selective lock application 208 and without having to log out from a network connection, limit other non-authorized users to access to selected applications, but not the underlying network access.
In another example of the advantage of the invention, a network may trigger selective lock application 208 automatically on detecting a user log out from a network controlled system, such that when an authorized user is not logged in at a network controlled computer system, a selection of applications are displayed and selectable by any other non-authorized user accessing the computer system.
In yet another example of an advantage of the invention, an authorized user may loan a laptop to a non-authorized colleague where the colleague needs the laptop to give a multimedia presentation. The authorized user may add the multimedia application needed by the colleague to selective lock folder 408, trigger selective lock mode and hand off the laptop, assured that the colleague can use the computer system for the specified purpose, without access to other applications and files.
In another example, a computer vendor may add multiple applications that the vendor would like for non-authorized customers to be able to try out on a computer system to selective lock folder 408 and trigger selective lock mode so that customers can choose to run the actual full version of an application that the customer may be interested in purchasing, without allowing customers access to the complete underlying functions of the computer system. Further, a computer vendor may add demonstration applications that block the user from accessing other functions of the computer system to selective lock folder and open that demonstration application while selective lock application 208 is controlling the computer system in selective lock mode, to rely on the security features of selective lock application 208 to block user accesses to the underlying system, rather than relying on outdated vendor-specific software that may not include updates to security holes.
With reference now to
Additionally, user interface 500 includes an icon 520 representing selective lock folder 408 showing the selectable links included in the selective lock folder. In one embodiment, an authorized user may drag and drop a listing in directory window 530 onto icon 520 to create a selectable link to the application in selective lock folder 408. In addition, an authorized user may select to places copies of application icons or other display objects that trigger the start of an application onto icon 520 for placement in selective lock folder 520. As will be further described with reference to
User interface also includes a selective lock icon 526, that when selected by the authorized user through the positioning of cursor 528, triggers selective lock application 208. It will be understood that a user may also trigger selective lock application 208 by selecting the listing for selective lock application 208 in directory window 530. Additionally, selective lock application 208 may be automatically triggered if settings for automatic triggering are met.
Referring now to
Additionally, user interface 600 includes an unlock icon 610. A user, and in particular an authorized user, may select unlock icon 610 by positioning cursor 612 over unlock icon 610 and entering an input. Responsive to a user selection of unlock icon 610, selective lock application 208 triggers a password entry window, as illustrated in
Referring now to
Block 804 illustrates the selective lock application blocking use of the interfaces of the computer system. Next, block 806 depicts the selective lock application clearing the content within a user interface of all selectable options except the selective lock folder and a selected unlock trigger, and the process passes to block 808. In particular, in clearing the content within the user interface, the selective lock application may overlay the display interface layer during normal mode with a blank screen and add new content to the user interface including the selective lock folder and selected unlock trigger. In addition, in particular, the selective lock settings may specify whether a trigger icon, password window, or other selectable display object for triggering switching from selective lock mode are to be displayed during selective lock mode.
Block 808 depicts calling a wrapper function to open any applications designated in the selective lock settings as applications to open during selective lock mode, but not include the selective lock folder for user access. Next, block 812 illustrates a determination by the selective lock application whether a user selection from a selectable application link in the selective lock folder is detected. If a user selection from a selectable application link in the all access folder is detected, then the process passes to block 814. Block 814 depicts calling a wrapper function to open the selected application, and the process returns to block 812.
Otherwise, at block 812, if no user selection from a selectable application link is detected, then the process passes to block 818. Block 818 depicts a determination by the selective lock application whether a user selection to unlock or change from selective lock mode to normal mode is detected. If no user selection to unlock is detected, then the process returns to block 812. If a user selection to unlock is detected, then the process passes to block 820. Block 820 depicts prompting the user for a password. Next, block 822 illustrates a determination by the screen lock application whether a correct password is entered. If a correct password is not entered, then the process returns to block 820. If a correct password is entered, then the process passes to block 824. Block 824 depicts closing any open wrappers, and thus closing any open applications. Next, block 826 illustrates restoring user access to the content within the user interface in normal mode and closing the application lock controller of the selective lock application and the process ends.
While the invention has been particularly shown and described with reference to a preferred embodiment, it will be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the invention.
