Endpoint identification and security

• US 20060130127A1
• Filed: 12/10/2004
• Published: 06/15/2006
• Est. Priority Date: 12/10/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Kaler, Christopher G., Dunn, Melissa W., Della-Libera, Giovanni M., Janczuk, Tomasz, Hasha, Richard L., Walter, Douglas A.
• Granted Patent: US 7,636,939 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/16 Implementing security features at a particular protocol layer

Abstract

A data structure with endpoint address and security information. The data structure includes an address field that includes one or more endpoint addresses for an entity. The data structure further includes a security field that includes one or more keys for facilitating secure communications with the entity. The data structure may also be such that the contents of the address field and the security field are serialized in the data structure. The data structure may be extensible such that new address fields and security fields may be added.

Claims

1. A data structure comprising:

an address field that comprises one or more endpoint addresses for an entity;

a security field that comprises one or more keys for facilitating secure communications with the entity at least one of the one or more endpoint addresses; and

wherein the contents of the address field and the security field are serialized in the data structure and wherein the data structure is extensible such that new address fields and security fields may be added.

2. The data structure of claim 1, further comprising an identity field that identifies the entity.

3. The data structure of claim 1, wherein the address field contains one or more references including addresses and security information.

4. The data structure of claim 1, wherein the endpoint addresses comprise at least one of a MAC address, a URL, a URI, an email address, a phone number, an IM address and a physical mail address.

5. The data structure of claim 1, wherein the address field contains an address for a delegate entity identified for the entity.

6. The data structure of claim 1, wherein the security field comprises at least one of a SPN, a UPN, an X.509 thumbprint, a security token, an issuer and serial number, a public key, an embedded certificate, and a verifiable DNS claim.

7. The data structure of claim 1, wherein the security field comprises biometric authentication data including at least one of data representing a fingerprint, an iris scan, voice recognition, and DNA recognition.

8. The data structure of claim 1, wherein the data structure is serialized in an XML block.

9. The data structure of claim 1, wherein the security field comprises security rules.

10. The data structure of claim 9, wherein the security rules comprise Boolean combinations of security information.

11. The data structure of claim 9, wherein the security rules use addressable fields such as “

To,”

“

From,” and

“

Reply To”

fields from web services communications.

12. The data structure of claim 1, further comprising policies describing when a particular endpoint address is used to send messages to the entity.

13. The data structure of claim 12, wherein the policies comprise criteria including at least one of date and/or time ranges, sensitivity of data, urgency or priority of data, classification of data, topic of data, user selection as a result of prompting, a machine registered default, an application registered default, a user registered default, application specific logic, custom registered extensions, recipient attributes, and presence of an entity.

14. The data structure of claim 13, wherein presence of an entity is determined by at least one of published IM data, an endpoint reference, a WSDL contract, an Endpoint contract, presence of a machine on a network, time-of-day, an attempt to contact, peer to peer presence data, specific applications running, and an application mode.

15. The data structure of claim 1, wherein the data structure is enveloped by an embedded signature.

16. The data structure of claim 15, wherein the embedded signature is an XML enveloped signature.

17. The data structure of claim 1, further comprising an embedded security header.

18. The data structure of claim 1, wherein one or more endpoint addresses in the address field are designated as shareable or non-sharable.

19. A data structure comprising:

an identity field that identifies an entity;

an address field that comprises one or more endpoint addresses for the entity; and

wherein the contents of the identity field and the address field are serialized in the data structure and wherein the data structure is extensible such that new identity fields and new address fields may be added.

20. The data structure of claim 19, wherein the address field contains references.

21. The data structure of claim 19, wherein the endpoint addresses comprise at least one of a MAC address, a URL, a URI, an email address, a phone number, an IM address and a physical mail address.

22. The data structure of claim 19, wherein the address field contains an address for a delegate entity identified for the entity.

23. The data structure of claim 19, wherein the data structure is serialized in an XML block.

24. The data structure of claim 19, further comprising policies describing when a particular endpoint address is used to send messages to the entity.

25. The data structure of claim 24, wherein the policies comprise criteria including at least one of date and/or time ranges, sensitivity of data, urgency or priority of data, classification of data, topic of data, user selection as a result of prompting, a machine registered default, an application registered default, a user registered default, application specific logic, custom registered extensions, recipient attributes, and presence of an entity.

26. The data structure of claim 25, wherein presence of an entity is determined by at least one of published IM data, an endpoint reference, a WSDL contract, an Endpoint contract, presence of a machine on a network, time-of-day, an attempt to contact, peer to peer presence data, specific applications running, and an application mode.

27. The data structure of claim 19, wherein the data structure is enveloped by an embedded signature.

28. The data structure of claim 27, wherein the embedded signature is an XML enveloped signature.

29. The data structure of claim 19, further comprising an embedded security header.

30. The data structure of claim 19, wherein one or more endpoint addresses in the address field are designated as shareable or non-sharable.

31. The data structure of claim 19, further comprising a global identity version comprising a value that may be incremented when the contents of the address field are changed.

32. A method of creating a reference data structure, the method comprising acts of:

creating an address field that comprises one or more endpoints addresses for an entity;

creating a security field that comprises one or more keys for facilitating secure communications with the entity at least one of the one or more endpoint addresses; and

serializing data in the address field and the security field to create a serialized extensible data structure.

33. The method of claim 32, further comprising creating an identity field that identifies the entity.

34. The method of claim 32, further comprising merging the serialized data structure with another serialized data structure such that at least one additional endpoint address is added to the address field and/or one additional key is added to the security field.

35. The method of claim 34, further comprising resolving conflicts between endpoint address in the address field and in the another serialized data structure.

36. The method of claim 35, wherein resolving conflicts comprises at least one of securely prompting a user to resolve the conflict, using machine registered defaults, using application registered defaults, using user registered defaults, invoking application specific logic, using custom registered extensions, considering various aspects of the data being sent to an entity or actions desired and selecting the most recently entered endpoint address.

37. A computer readable medium having computer executable instructions for performing the acts recited in claim 32.

38. A method of creating a reference data structure, the method comprising acts of:

creating an identity field that comprises data identifying an entity;

creating an address field that comprises one or more endpoints addresses for the entity; and

serializing data in the identity field and the address field to create a serialized extensible data structure.

39. The method of claim 38, further comprising merging the serialized data structure with another serialized data structure such that at least one additional endpoint address is added to the address field.

40. The method of claim 39, further comprising resolving conflicts between endpoint address in the address field and in the another serialized data structure.

41. The method of claim 40, wherein resolving conflicts comprises at least one of securely prompting a user to resolve the conflict, using machine registered defaults, using application registered defaults, using user registered defaults, invoking application specific logic, using custom registered extensions, considering various aspects of the data being sent to an entity or actions desired and selecting the most recently entered endpoint address.

42. A computer readable medium having computer executable instructions for performing the acts recited in claim 38.

43. A method of communicating between endpoints on a network, the method comprising;

accessing a serialized extensible data structure to obtain an endpoint address for an entity on a network;

accessing the serialized extensible data structure to obtain a security key;

encrypting data using the security key; and

sending the data to the endpoint address for the entity on the network.

44. The method of claim 43, further comprising accessing security rules in the serialized extensible data structure to determine the appropriate security key to obtain.

45. The method of claim 43, further comprising receiving the serialized extensible data structure from a third party.

46. The method of claim 43, wherein accessing the serialized extensible data structure to obtain an endpoint address comprises accessing policy rules to determine which endpoint address to select from a plurality of endpoint addresses for the entity.

47. The method of claim 46, wherein determining which endpoint address to select comprises implementing rules based on at least one of a set of transport protocols available, date and/or time ranges, sensitivity of the data being sent, urgency or priority of the data, classification of the data, and the topic of the data.