US5999711A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and system for providing certificates holding authentication and authorization information for users/machines
Assignee: Microsoft Technology Licensing LLC
•
Filing: 1994-07-18
•
Granted: 1999-12-07
•
Expires: 2014-07-18
Abstract
Abstract Logon certificates are provided to support disconnected operation within the distributed system. Each logon certificate is a secure package holding credentials information sufficient to establish the identity and rights and privileges for a user/machine in a domain that is not their home domain. When a user/machine attempts to connect to the system at a domain other than the home domain of the user/machine, the user/machine presents a logon certificate that evidences his credentials. The domain where the user/machine attempts to connect to the system, decrypts and unseals the secure package as required to obtain the credentials information contained therein. If the user/machine has sufficient credentials, the user/machine is permitted to connect to the system. If the user/machine lacks sufficient credentials, the user/machine is not permitted to connect to the system.
Inventors
- 👤 Pradyumna K. Misra
- 👤 Arnold S. Miller
- 👤 Richard B. Ward
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-01 23:22
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/08; H04L63/0823; G; G06; G06F; G06F21/00; G06F21/30; G06F21/31; G06F21/33; G06F21/60; G06F21/62; G06F21/6218; G06F21/6236; G06Q; G06Q20/00; G06Q20/38; G06Q20/382; G06Q20/3821; H04L63/12; H04L63/04; H04L63/0428
Claims Analysis
Total Claims: 20
Claim 1
Independent Claim
182 words
In a distributed system having computer resources and a facility for checking credentials information to authenticate principals and provide with authorization data, a method for authenticating and authorizing principals comprising the computer implemented steps of: providing a principal with a secure package holding credentials information for a client; receiving a principal request to connect to the distributed system at a location in the distributed system that lacks credentials information about the principal to gain access to at least some of the computing resources; accessing the credentials information held in the secure package to enable the facility for checking credentials information to determine whether the principal is authorized and authenticated to be connected to the distributed system without obtaining credentials information about the principal from a source other than the secure package; where the principal is not authorized or not authenticated to connect to the distributed system, denying the principal request to be connected to the distributed system; and where the principal is authorized and authenticated to connect to the distributed system, granting the principal request to be connected to the distributed system.
Claim 2
Dependent Claim
182 words
In a distributed system having computer resources and a facility for checking credentials information to authenticate principals and provide with authorization data, a method for authenticating and authorizing principals comprising the computer implemented steps of: providing a principal with a secure package holding credentials information for a client; receiving a principal request to connect to the distributed system at a location in the distributed system that lacks credentials information about the principal to gain access to at least some of the computing resources; accessing the credentials information held in the secure package to enable the facility for checking credentials information to determine whether the principal is authorized and authenticated to be connected to the distributed system without obtaining credentials information about the principal from a source other than the secure package; where the principal is not authorized or not authenticated to connect to the distributed system, denying the principal request to be connected to the distributed system; and where the principal is authorized and authenticated to connect to the distributed system, granting the principal request to be connected to the distributed system.
Claim 3
Dependent Claim
11 words
The method of claim 1 wherein the principal is a user.
Claim 4
Dependent Claim
12 words
The method of claim 1 wherein the principal is a portable computer.
Claim 5
Dependent Claim
54 words
The method of claim 1 wherein the distributed system includes a portable computer having memory and the step of providing the principal with the secure package holding credentials information for the client further comprises a step of loading the secure package holding credentials information for the client into the memory of the portable computer.
Claim 6
Dependent Claim
36 words
The method of claim 1 wherein the step of providing the principal with the secure package holding credentials information for the client further comprises a step of storing the secure package on a portable storage medium.
Claim 7
Dependent Claim
39 words
The method of claim 5 wherein the portable storage medium is a floppy disk and the step of storing the secure package on the portable storage medium comprises a step of storing the secure package on the floppy disk.
Claim 8
Dependent Claim
39 words
The method of claim 1 wherein the step of providing the principal with the secure package holding credentials information for the client comprises a step of providing the principal with an encrypted package holding credentials information for the client.
Claim 9
Dependent Claim
43 words
The method of claim 1 wherein the step of providing the principal with the secure package holding credentials information for the client comprises a step of providing a digitally signed and sealed package holding credentials information for a user of the distributed system.
Claim 10
Dependent Claim
55 words
The method of claim 1 wherein determining whether the principal is authenticated to be connected to the distributed system comprises the steps of: (i) determining whether the secure package is authentic; and (ii) where the secure package is determined to be authentic, determining that the principal is authenticated to be connected to the distributed system.
Claim 11
Dependent Claim
121 words
In a distributed system logically partitioned into domains, wherein each user has an associated home domain, a method of maintaining secure access to the distributed system, comprising the computer implemented steps of: providing a user with a secure package holding credentials information for the user; receiving a user request to logon to the distributed system in a domain other than the associated home domain of the user, said domain lacking credentials information about the user; accessing the secure package to examine the credentials information for the user; and without obtaining credentials information about the user from another source, based on the credentials information for the user provided in the secure package, deciding whether to allow the user to logon or not.
Claim 12
Dependent Claim
121 words
In a distributed system logically partitioned into domains, wherein each user has an associated home domain, a method of maintaining secure access to the distributed system, comprising the computer implemented steps of: providing a user with a secure package holding credentials information for the user; receiving a user request to logon to the distributed system in a domain other than the associated home domain of the user, said domain lacking credentials information about the user; accessing the secure package to examine the credentials information for the user; and without obtaining credentials information about the user from another source, based on the credentials information for the user provided in the secure package, deciding whether to allow the user to logon or not.
Claim 13
Dependent Claim
50 words
The method of claim 10 wherein the distributed system includes a portable computer having memory and the step of providing the user with the secure package holding credentials information for the user comprises loading the secure package holding credentials information for the user into the memory of the portable computer.
Claim 14
Dependent Claim
33 words
The method of claim 10 wherein the step of providing the user with the secure package holding credentials information for the user further comprises storing the secure package on a portable storage medium.
Claim 15
Dependent Claim
36 words
The method of claim 10 wherein the step of providing the user with the secure package holding credentials information for the user comprises providing the user with an encrypted package holding credentials information for the user.
Claim 16
Dependent Claim
36 words
The method of claim 10 wherein the step of providing the user with the secure package holding credentials information for the user comprises providing a digitally signed and sealed package holding credentials information for the user.
Claim 17
Dependent Claim
155 words
In a distributed system having a facility for checking credentials information, a method of authorizing connections to the distributed system, comprising the computer implemented steps of: providing a portable computer with a secure package holding credentials information for the portable computer; requiring the portable computer to present the secure package when the portable computer wishes to connect to the distributed system at a location lacking credentials information about the portable computer to become part of the distributed system; examining the credentials information contained within the secure package by the facility for checking credentials information to determine whether the portable computer is authorized to connect to the distributed system, wherein the portable computer is authorized to connect to the distributed system, allowing the portable computer to connect to the distributed system; and wherein the portable computer is not authorized to correct to the distributed system, not allowing the portable computer to connect to the distributed system.
Claim 18
Dependent Claim
155 words
In a distributed system having a facility for checking credentials information, a method of authorizing connections to the distributed system, comprising the computer implemented steps of: providing a portable computer with a secure package holding credentials information for the portable computer; requiring the portable computer to present the secure package when the portable computer wishes to connect to the distributed system at a location lacking credentials information about the portable computer to become part of the distributed system; examining the credentials information contained within the secure package by the facility for checking credentials information to determine whether the portable computer is authorized to connect to the distributed system, wherein the portable computer is authorized to connect to the distributed system, allowing the portable computer to connect to the distributed system; and wherein the portable computer is not authorized to correct to the distributed system, not allowing the portable computer to connect to the distributed system.
Claim 19
Dependent Claim
157 words
In a distributed system that is logically partitioned into domains and having a plurality of computers, wherein each computer in the distributed system has an associated home domain, a method of authorizing access to the distributed system, comprising the computer implemented steps of: providing a secure package at the home domain of a selected computer to the selected computer, said secure package holding credentials information for the selected computer; receiving a request from the selected computer, to connect to the distributed system at a target domain other than the home domain of the selected computer said target domain lacking credentials information about the selected computer; and examining the credentials information contained in the secure package to determine whether the selected computer is authorized to be connected to the distributed system at the target domain to become part of the distributed system without obtaining credentials information about the selected computer from a source other than the secure package.
Claim 20
Dependent Claim
157 words
In a distributed system that is logically partitioned into domains and having a plurality of computers, wherein each computer in the distributed system has an associated home domain, a method of authorizing access to the distributed system, comprising the computer implemented steps of: providing a secure package at the home domain of a selected computer to the selected computer, said secure package holding credentials information for the selected computer; receiving a request from the selected computer, to connect to the distributed system at a target domain other than the home domain of the selected computer said target domain lacking credentials information about the selected computer; and examining the credentials information contained in the secure package to determine whether the selected computer is authorized to be connected to the distributed system at the target domain to become part of the distributed system without obtaining credentials information about the selected computer from a source other than the secure package.
References Cited (Backward Citations)
US4896319A
Cited
US5335346A
Cited
US5560008A
Cited
EP0421409A2
Cited
US4993068A
Cited
GB2238636A
Cited
US5224163A
Cited
US5235642A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2002-12-06 | 2003-06-07 | 2003-12-07 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2006-12-06 | 2007-06-07 | 2007-12-07 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2010-12-06 | 2011-06-07 | 2011-12-07 | $7700.00 | Window Closed / Lapsed |