Credential roaming

• US 20050257072A1
• Filed: 04/09/2004
• Published: 11/17/2005
• Est. Priority Date: 04/09/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Cross, David B., Hallin, Philip J., Su, Xiaohong, Zhuang, Hao
• Granted Patent: US 7,984,488 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

Implementations are described and claimed herein to enable credential roaming among a plurality of different computing devices. An exemplary system may include an event handler to receive event notifications such as, e.g., a client logon. The event handler may invoke a management service in response to receiving an event notification. The management service may include a synchronizing module to synchronize a user'"'"'s credentials with a remote directory service, such as, e.g., Active Directory, so that the user'"'"'s credentials are available from any of a number of different computing devices.

Claims

1. A method comprising:

enumerating local credentials and remote credentials in response to receiving an event notification; and

synchronizing the local credentials and remote credentials.

2. The method of claim 1, wherein synchronizing the local credentials and the remote credentials is based on at least one time-stamp associated with the local credentials and at least one time-stamp associated with the remote credentials.

3. The method of claim 1, wherein synchronizing the local credentials and the remote credentials is based on a comparison of hash values.

4. The method of claim 1, wherein synchronizing includes error handling.

5. The method of claim 1, wherein synchronizing includes writing at least one of the local credentials to a remote credential cache.

6. The method of claim 1, wherein synchronizing includes writing at least one of the remote credentials to a local credential cache.

7. The method of claim 1, wherein synchronizing includes deleting at least one of the local credentials from a local credential cache.

8. The method of claim 1, wherein synchronizing includes deleting at least one of the remote credentials from a remote credential cache.

9. The method of claim 1, wherein synchronizing includes modifying at least one of the local credentials at a local credential cache based on at least one of the remote credentials.

10. The method of claim 1, wherein synchronizing includes modifying at least one of the remote credentials at a remote credential cache based on at least one of the local credentials.

11. The method of claim 1, further comprising updating a list of local credentials.

12. The method of claim 1, further comprising updating a list of remote credentials.

13. The method of claim 1, further comprising determining a state of the remote credentials dynamically.

14. The method of claim 1, further comprising maintaining a state file for the remote credentials.

15. The method of claim 1, further comprising maintaining a state file for the local credentials.

16. The method of claim 1, further comprising resolving a conflict of state between the local credentials and the remote credentials.

17. A computer program product encoding a computer program for executing on a computer system a computer process, the computer process comprising:

enumerating local credentials and remote credentials in response to receiving an event notification; and

synchronizing the local credentials and remote credentials.

18. The computer program product of claim 17 wherein the computer process further comprises synchronizing the local credentials and the remote credentials is based on at least one time-stamp associated with the local credentials and at least one time-stamp associated with the remote credentials.

19. The computer program product of claim 17 wherein the computer process further comprises synchronizing the local credentials and the remote credentials is based on a comparison of hash values.

20. The computer program product of claim 17 wherein the computer process further comprises writing at least one of the local credentials to a remote credential cache.

21. The computer program product of claim 17 wherein the computer process further comprises writing at least one of the remote credentials to a local credential cache.

22. The computer program product of claim 17 wherein the computer process further comprises removing at least one of the local credentials from a local credential cache.

23. The computer program product of claim 17 wherein the computer process further comprises removing at least one of the remote credentials from a remote credential cache.

24. The computer program product of claim 17 wherein the computer process further comprises modifying at least one of the local credentials at a local credential cache.

25. The computer program product of claim 17 wherein the computer process further comprises modifying at least one of the remote credentials at a remote credential cache.

26. The computer program product of claim 17 wherein the computer process further comprises updating a list of local credentials.

27. The computer program product of claim 17 wherein the computer process further comprises updating a list of remote credentials.

28. The computer program product of claim 17 wherein the computer process further comprises maintaining a state of the remote credentials.

29. The computer program product of claim 17 wherein the computer process further comprises determining a state of the remote credentials dynamically.

30. The computer program product of claim 17 wherein the computer process further comprises maintaining a state of the local credentials.

31. The computer program product of claim 17 wherein the computer process further comprises error handling.

32. The computer program product of claim 17 wherein the computer process further comprises resolving a conflict of state between the local credentials and the remote credentials.

33. A system comprising:

an event handler to receive event notifications; and

a synchronizing module operatively associated with the event handler to synchronize local credentials and remote credentials when the event handler receives an event notification and if the local and remote credentials are different from one another

34. The system of claim 33, wherein the event notification is at least one of the following:

a session event, a logon event, a logout event, a lock event, an unlock event, a timer event, a policy application event, and a credential update event.

35. The system of claim 33, wherein the credentials include at least one of the following:

an encryption credential, a token, an asymmetric key pair, a symmetric key, a digital certificate, an XrML license, an authentication credential, an authorization credential.

36. The system of claim 33, further comprising a local store manager to enumerate the local credentials for the synchronizing module.

37. The system of claim 33, further comprising a remote store manager to enumerate the remote credentials for the synchronizing module.

38. The system of claim 33, wherein the local credentials are stored in a local cache.

39. The system of claim 33, wherein the local credentials are stored in a local cache provided at any number (n) of clients.

40. The system of claim 33, wherein the local credentials are encrypted using a master key.

41. The system of claim 33, wherein the remote credentials are stored in a remote cache.

42. The system of claim 33, wherein the local credentials are stored in a remote cache provided at any number (n) of hosts.

43. The system of claim 33, wherein the remote credentials are maintained by a remote directory service.

44. The system of claim 33, wherein the remote credentials are encrypted.