Caching user network access information within a network

• US 20020095497A1
• Filed: 01/17/2001
• Published: 07/18/2002
• Est. Priority Date: 01/17/2001
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Brace, Colin H., Brown, Mark R., Satagopan, Murli D.
• Granted Patent: US 7,085,833 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 67/2895 Intermediate processing functionally located close to the data provider application, e.g. reverse proxies
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 67/62 Establishing a time schedule for servicing the requests
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A network system server, at a first network site, maintains network access information that identifies users authorized to access a network and a network controller, at a second network site, caches the network access information for individual users that request access to the network from the second network site. The network controller tracks the individual users that request access to the network from the second network site and updates the cached network access information for the individual users that request access to the network from the second network site within a defined time interval.

Claims

1. A network system, comprising:

a network server configured to maintain network access information corresponding to users authorized to access the network system;

a domain controller remotely located from the network server and communicatively linked with the network server, the domain controller configured to cache the network access information; and

the domain controller further configured to track individual users that request access to the network system from the domain controller.

2. A network system as recited in claim 1, wherein the domain controller is further configured to cache the network access information only for the individual users that request access to the network system from the domain controller.

3. A network system as recited in claim 1, wherein the domain controller is further configured to update the network access information at the domain controller for the individual users that request access to the network system from the domain controller.

4. A network system as recited in claim 1, wherein the domain controller is further configured to update the network access information at the domain controller for the individual users that request access to the network system from the domain controller within a defined time interval.

5. A network system as recited in claim 1, wherein the domain controller is further configured to receive a network access request from a user and validate the network access request with the network access information cached at the domain controller.

6. A network system as recited in claim 1, wherein:

the domain controller is further configured to receive a network access request from a user and validate the network access request with the network access information maintained in the network server before the domain controller caches the network access information; and

the domain controller is further configured to receive a second network access request from the user and validate the second network access request with the network access information cached at the domain controller.

7. A network system as recited in claim 1, wherein:

the domain controller is further configured to receive a network access request from a user and validate the network access request with the network access information maintained in the network server before the domain controller caches the network access information; and

the domain controller is further configured to receive a second network access request from the user and validate the second network access request with the network access information cached at the domain controller if the second network access request is within a defined time interval.

8. A network system as recited in claim 1, wherein:

the network access information comprises identifiers to indicate network group memberships that an individual user is a member of in the network system; and

the domain controller is further configured to maintain user objects associated with the individual users that request access to the network system from the domain controller, and cache the identifiers to the user objects.

9. A network system, comprising:

a network server configured to maintain network access information corresponding to users authorized to access the network system;

a domain controller remotely located from the network server and communicatively linked with the network server, the domain controller configured to cache the network access information; and

the domain controller further configured to update the network access information at the domain controller for individual users authorized to access the network system from the domain controller.

10. A network system as recited in claim 9, wherein the domain controller is further configured to track the individual users that access the network system from the domain controller.

11. A network system as recited in claim 9, wherein the domain controller is further configured to cache the network access information only for the individual users authorized to access the network system from the domain controller.

12. A network system as recited in claim 9, wherein the domain controller is further configured to update the network access information at the domain controller for the individual users that access the network system from the domain controller within a defined time interval.

13. A network system as recited in claim 9, wherein the domain controller is further configured to receive a network access request from a user and validate the network access request with the network access information cached at the domain controller if the user accessed the network system from the domain controller within a defined time interval.

14. A network system as recited in claim 9, wherein:

the network access information comprises identifiers that indicate universal group memberships that an individual user is a member of in the network system; and

the domain controller is further configured to maintain user objects associated with the individual users authorized to access the network system from the domain controller, and cache the identifiers to the user objects.

16. A network as recited in claim 15, wherein the remote server is further configured to update the network information at the remote server for users that access the network from the remote server within a defined time interval.

17. A network as recited in claim 15, wherein the remote server is further configured to receive a user request to access the network and validate the user request with the network information cached at the remote server if the user accessed the network from the remote server within a defined time interval.

18. A network as recited in claim 15, wherein the remote server is further configured to track individual users that request access to the network information cached at the remote server.

19. A network as recited in claim 15, wherein the remote server is further configured to receive a user request to access the network information cached at the remote server and validate the user request if the user accessed the network from the remote server within a defined time interval.

15. A network, comprising:

a global information server configured to maintain network information corresponding to users of the network;

a remote server communicatively linked with the global information server, the remote server configured to;

cache the network information;

track individual users that request access to the network from the remote server; and

update the network information at the remote server for users that access the network from the remote server.

20. A method, comprising:

maintaining, at a first site, network access information that identifies users authorized to access a network;

caching the network access information at a second site; and

tracking individual user requests to access the network from the second site.

21. A method as recited in claim 20, wherein said caching comprises storing the network access information at the second site only for the individual users that request access to the network from the second site.

22. A method as recited in claim 20, further comprising updating the network access information at the second site for the individual users that periodically request access to the network from the second site.

23. A method as recited in claim 20, further comprising updating the network access information at the second site for the individual users that request access to the network from the second site within a defined time interval.

24. A method as recited in claim 20, further comprising validating a network access request from a user at the second site with the network access information maintained at the first site, wherein said validating occurs before said caching.

25. A method as recited in claim 20, further comprising:

validating a network access request from a user at the second site with the network access information maintained at the first site, wherein said validating occurs before said caching; and

validating a second network access request from the user at the second site, said validating the second request with the network access information cached at the second site.

26. A method as recited in claim 20, farther comprising:

validating a network access request from a user at the second site with the network access information maintained at the first site, wherein said validating occurs before said caching; and

validating a second network access request from the user at the second site, said validating the second request with the network access information cached at the second site if the second request is within a defined time interval.

27. A computer-readable medium comprising computer executable instructions that, when executed, direct a computing system to perform the method of claim 20.

29. A method as recited in claim 28, further comprising validating a network access request from a user at the second site with the network access information cached at the second site if the requests is within a defined time interval.

30. A computer-readable medium comprising computer executable instructions that, when executed, direct a computing system to perform the method of claim 28.

31. A computer-readable medium comprising computer executable instructions that, when executed, direct a computing system to perform the method of claim 29.

28. A method, comprising:

maintaining, at a first site, network access information that identifies users authorized to access a network;

caching the network access information at a second site for individual users that request access to the network from the second site;

tracking individual user requests to access the network from the second site; and

updating the network access information at the second site for the individual users that request access to the network from the second site within a defined time interval.

32. A method, comprising:

maintaining, at a first site, network access information that identifies users authorized to access a network;

caching the network access information at a second site; and

updating the network access information at the second site for individual users authorized to access the network from the second site.

33. A method as recited in claim 32, further comprising tracking the individual users that access the network from the second site.

34. A method as recited in claim 32, wherein said caching comprises storing the network access information at the second site only for the individual users that access the network from the second site.

35. A method as recited in claim 32, further comprising updating the network access information at the second site for the individual users that access the network from the second site within a defined time interval.

36. A method as recited in claim 32, further comprising validating a network access request at the second site with the network access information cached at the second site if the request is within a defined time interval.

37. A computer-readable medium comprising computer executable instructions that, when executed, direct a computing system to perform the method of claim 32.

39. A method as recited in claim 38, further comprising:

receiving a user request to access the network; and

validating the user request with the network information cached at the remote server.

40. A method as recited in claim 38, further comprising:

receiving a user request to access the network; and

validating the user request with the network information cached at the remote server if the request is received within a defined time interval.

41. A method as recited in claim 38, further comprising:

tracking users that access the cached network information; and

updating the network information cached at the remote server with the network information maintained at the global information server for users authorized to access the network information from the remote server, and that accessed the network information within a defined time interval.

42. A method as recited in claim 38, further comprising:

receiving a user request to access the network information; and

validating the user request at the remote server.

43. A method as recited in claim 38, further comprising:

receiving a user request to access the network information; and

validating the user request at the remote server if the request is received within a defined time interval.

44. A computer-readable medium comprising computer executable instructions that, when executed, direct a computing system to perform the method of claim 38.

46. A method as recited in claim 45, wherein said caching comprises storing the network security information at the network controller only for the accounts that access the network from the network controller.

47. A method as recited in claim 45, further comprising tracking the accounts that access the network from the network controller.

48. A method as recited in claim 45, further comprising tracking the accounts that access the network from the network controller, and wherein said caching comprises storing the network security information at the network controller only for the accounts identified when said tracking.

49. A method as recited in claim 45, further comprising updating the network security information at the network controller for accounts that access the network from the network controller within a defined time interval.

50. A method as recited in claim 45, further comprising:

receiving an account request to access the network; and

validating the request with the network security information cached at the network controller.

51. A method as recited in claim 45, further comprising:

receiving an account request to access the network; and

validating the request with the network security information cached at the network controller if the request is within a defined time interval.

38. A method, comprising:

maintaining, at a network global information server, network information corresponding to users of the network;

caching the network information at a remote server;

tracking users that access the remote server; and

updating the network information cached at the remote server with the network information maintained at the global information server for users authorized to access the network from the remote server, and that accessed the remote server within a defined time interval.

45. A method, comprising:

caching network security information at a network controller from a central network data store; and

updating the network security information at the network controller for accounts authorized to access a network from the network controller.

52. A computer-readable medium comprising computer executable instructions that, when executed, direct a computing system to perform the method of claim 45.