Account synchronization for common identity in an unmanaged network

• US 20070016630A1
• Filed: 07/12/2005
• Published: 01/18/2007
• Est. Priority Date: 07/12/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Samji, Mohammed, Guzak, Chris, Brezak, John, Yadav, Anil, van der Bogert, Giles, Tomacelli, Nicholas
• Granted Patent: US 7,958,543 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/306 User profiles

Abstract

A platform supports an unmanaged secured workgroup, without a server, for common user access and secure resource sharing among the computers in the group. User accounts are synchronized by replicating and modifying the accounts at each computer of the unmanaged secured workgroup. A computer advertises a change in account information to other computers in an unmanaged secured workgroup. If one of computers in the unmanaged secured workgroup determines that the change is not reflected in the current account information, the computer requests the updated account information from the advertising computer. Any conflicts between user accounts at different computers are resolved before synchronizing the user account in the unmanaged secured workgroup. Also, an application program interface (API) enables an application to query properties of a networked computer system and an unmanaged secured workgroup and to join the unmanaged secured workgroup.

Claims

1. A computer-readable medium having computer-executable instructions stored thereon in a first computer, said instructions configured to perform a method comprising the steps of:

(a) joining the first computer to an unmanaged secured workgroup;

(b) providing first account information that is associated with the first computer to a second computer for replication, the second computer being a member of the unmanaged secured workgroup;

(c) obtaining second account information that is associated with the second computer; and

(d) replicating the second account information.

2. The computer-readable medium of claim 1, having further computer-executable instructions to perform:

(e) determining that a change in the first account information has occurred; and

(f) providing the change to each other computer that is a member of the unmanaged secured workgroup.

3. The computer-readable medium of claim 2, wherein (f) includes computer-executable instructions to perform:

(f)(1) advertising the change to said each other computer.

4. The computer-readable medium of claim 3, wherein (f) includes computer-executable instructions to perform:

(f)(2) receiving account version information from the second computer; and

(f)(3) in response to (f)(2), sending a list of newer user accounts.

5. The computer-readable medium of claim 3, wherein (f) includes computer-executable instructions to perform:

(f)(2) receiving a first request for a list of user accounts from the second computer; and

(f)(3) in response to (f)(2), sending the list of user accounts with corresponding information to the second computer.

(f)(4) receiving a second request for associated account information for a specified user account from the second computer; and

(f)(5) in response to (f)(4), sending the associated account information to the second computer.

6. The computer-readable medium of claim 5, wherein at least one property of the specified user account has been modified.

7. The computer-readable medium of claim 5, wherein the specified user account has been added to the first account information.

8. The computer-readable medium of claim 1, having further computer-executable instructions to perform:

(e) determining that a change in associated account information has occurred at a computer other than the first computer that is a member of the unmanaged secured workgroup;

(f) obtaining specified account information from the computer other than the first computer; and

(g) automatically synchronizing the specified account information between the first computer and the computer other than the first computer.

9. The computer-readable medium of claim 8 wherein (g) includes computer-executable instructions to perform:

(g)(1) detecting whether there is a conflict with the specified account information;

(g)(2) resolving a detected conflict;

(g)(3) updating a user account data structure with the specified account information; and

(g)(4) publishing a resolved conflict to other members of the unmanaged secured workgroup.

10. The computer-readable medium of claim 8 wherein (e) includes computer-executable instructions to perform:

(e)(1) receiving an advertisement from the computer other than the first computer.

11. The computer-readable medium of claim 8 wherein (f) includes computer-executable instructions to perform:

(f)(1) in response to (d), requesting the computer other than the first computer to provide a list of user accounts in accordance with version information.

12. The computer-readable medium of claim 11 wherein (f) includes computer-executable instructions to perform:

(f)(2) receiving the list with newer user accounts from the computer other than the first computer.

13. The computer-readable medium of claim 2, wherein the first account information is deleted.

14. A computer system that supports an unmanaged secured workgroup, the computer system comprising:

a secured group service module that handles creation, joining, and operations of the unmanaged secured workgroup; and

an application program interface (API) module that enables an application to obtain information about unmanaged secured workgroups in the computer network, to create the unmanaged secured workgroup, to join the unmanaged secured workgroup, and to leave the unmanaged secured workgroup.

15. The computer system of claim 14, wherein the application program interface module provides a list of unmanaged secured workgroups and unaffiliated computers within the computer network to the application by querying the secured group service module.

16. The computer system of claim 14, wherein the application program module provides information about a selected unmanaged secured workgroup that includes attributes of the selected unmanaged workgroup and a list of member computers of the selected unmanaged workgroup to the application by querying the secured group service module.

17. The computer system of claim 14, wherein the application program module provides information about a computer within an unmanaged secured workgroup to the application by querying the secured group service module.

18. The computer system of claim 14, wherein the application program module allows creation of a new unmanaged workgroup in the computer network from the application by instructing the secured group service module.

19. The computer system of claim 14, wherein the application program module allows the computer system to join or leave the unmanaged workgroup in the computer network from the application by instructing the secured group service module.

20. A computer-readable medium having computer-executable instructions stored thereon in a first computer, said instructions configured to perform a method comprising the steps of:

(a) sending a self-signed certificate to a second computer to establish an associated account for the first computer, wherein the second computer is a member of an unmanaged secured workgroup and the first computer is a non-member of the unmanaged secured workgroup;

(b) storing an associated certificate of the second computer, a shared secret, and a copied certificate of the unmanaged secured workgroup;

(c) creating a corresponding account for the second computer on the first computer;

(d) broadcasting that the first computer is a workgroup member of the unmanaged secured workgroup; and

(e) synchronizing account information with the second computer.