Password-authenticated groups

• US 20080013537A1
• Filed: 07/14/2006
• Published: 01/17/2008
• Est. Priority Date: 07/14/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Horton, Noah, Dewey, Jeremy L., Manion, Todd R., Gupta, Rohit
• Granted Patent: US 7,958,368 B2
• Time in Patent Office: Days
• US Class Current: 370/390
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A system, apparatus, method, and computer-readable medium are provided for authorizing a computing node to participate in a group of computing nodes utilizing a shared group password. According to one method described herein, an invitation to join a group is transmitted to a tentative group member node. The invitation is used to establish a connection with a group member node of the group. The tentative group member node generates a hash of a group password and transmits the hash to the group member node. When the group member node receives the hash, the group member node compares the received value to a previously stored hash of the group password. If the previously stored value is identical to the value received from the tentative group member node, then the tentative group member node is authorized as a new member of the group. Otherwise the tentative group member node is not permitted to become a member of the group.

Claims

1. A method for authorizing the granting of authority to a computing node to participate in a group of computing nodes utilizing a shared group password, the method comprising:

transmitting an invitation to join the group to a tentative group member node;

transmitting a group password to the tentative group member node;

establishing a connection with the tentative group member node;

receiving a hash of the group password from the tentative group member node;

comparing the hash of the group password received from the tentative group member node to a previously stored hash of the group password; and

in response to determining that the hash received from the tentative group member node matches the previously stored hash, granting authority to the tentative group member node to be a member of the group.

2. The method of claim 1, wherein a group membership credential is utilized to validate the members of the group, and wherein granting group membership authority to the tentative group member node comprises:

receiving an identity certificate from the tentative group member node;

utilizing the identity certificate to generate a group membership credential for the tentative group member node; and

transmitting the group membership credential to the tentative group member node.

3. The method of claim 2, further comprising, receiving one or more group properties from the member node, the group properties including the hash of the password.

4. The method of claim 2, wherein the invitation comprises data that may be utilized by the tentative group member node to locate and establish a connection to a member node of the group who is authorized to grant group membership authority to others.

5. The method of claim 4, further comprising:

transmitting a group membership credential for the member node to the tentative group member node prior to receiving the hash of the group password from the tentative group member node, whereby the tentative group member node can utilize the group membership credential for the member node to confirm that the member node is a member of the group.

6. The method of claim 5, wherein the hash of the group password comprises a hash of a hash of the group password and session data unique to the connection with the tentative group member node.

7. The method of claim 6, wherein the group password and the invitation are transmitted to the tentative group member node out-of-band of the connection with the tentative group member node.

8. A computer-readable medium having computer-executable instructions stored thereon which, when executed by a computer, will cause the computer to perform the method of claim 1.

9. A computer-controlled apparatus operative to perform the method of claim 1.

10. A method for authorizing the granting of authority to a computing node to participate in a group of computing nodes utilizing a shared group password, the method comprising:

receiving an invitation to join the group, the invitation comprising data that may be utilized by a tentative group member node to locate and establish a connection to a member node of the group authorized to grant group membership authority;

utilizing the data contained in the invitation to establish a connection with the member node;

generating a hash of the group password and transmitting the hash to the member node over the connection, whereby the member node can utilize the hash of the password to verify that the tentative group member node is authorized to become a new member of the group; and

receiving authorization from the member node to become a new member in the group.

11. The method of claim 10, further comprising:

receiving a group membership credential from the member node prior to transmitting the hash of the group password to the member node;

determining based on the group membership credential whether the member node is a member of the group; and

transmitting the hash of the group password to the member node in response to determining that the member node is a member of the group.

12. The method of claim 11, wherein receiving authorization from the member node to become a new member of the group comprises receiving a group membership credential from the member node.

13. The method of claim 12, further comprising transmitting an identity certificate to the member node for use in creating the group membership credential for the tentative group member node.

14. The method of claim 13, further comprising, receiving one or more group properties from the member node, the group properties including the hash of the password.

15. The method of claim 14, wherein the hash of the group password comprises a hash of a hash of the group password and session data unique to the connection with the member node.

16. The method of claim 15, wherein the group password and the invitation are received out-of-band of the connection with the member node.

17. A computer-readable medium having computer-executable instructions stored thereon which, when executed by a computer, will cause the computer to perform the method of claim 10.

18. A computer-controlled apparatus operative to perform the method of claim 10.

19. A method for authorizing a computing node to participate in a group of computing nodes utilizing a shared group password, the method comprising:

exposing a create group password invitation application programming interface (API), the create group password invitation API operative to receive one or more group properties and to create an invitation for transmission to a tentative group member node, the invitation containing data for establishing a connection to a group member node.

20. The method of claim 19, further comprising exposing a password group join API, the password group join API operative to:

receive the invitation and a group password;

establish a connection to the member node using the data contained in the invitation;

generate a hash of the group password; and

to

transmit the hash to the group member node.