DOMAIN ID SERVICE

• US 20090007247A1
• Filed: 06/28/2007
• Published: 01/01/2009
• Est. Priority Date: 06/28/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Leach, Paul J., Dunn, Melissa W., Ellison, Carl M., Kaufman, Charles W., Lampson, Butler W., Pandya, Ravindra N.
• Granted Patent: US 8,006,295 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

The subject disclosure pertains to a domain identification system, comprising a principal that has a key and a mnemonically meaningless identifier, the mnemonically meaningless identifier is used to identify the component in a networked environment. The mnemonically meaningless identifier can be bound to the public key by a binding. The component may be part of a neighborhood of components, and each member component knows the members'"'"' binding.

Claims

1. A domain identification system, comprising:

an identifier generation component that generates a mnemonically meaningless persistent identifier and assigns the mnemonically meaningless persistent identifier to a principal; and

a binding component that binds the mnemonically meaningless persistent identifier to a key by a binding, the key is used to authenticate the principal in a networked environment.

2. The system of claim 1, further comprising a uniqueness verification component that verifies the uniqueness of the mnemonically meaningless persistent identifier.

3. The system of claim 1, the principal is a domain controller, and assigns a relative identifier to a device authenticated to a domain controlled by the domain controller.

4. The system of claim 1, further comprising a sharing component that shares information relating to the persistent identifier with other principals.

5. The system of claim 1, at least one of the identifier assignment component or the uniqueness verification component reside on the principal receiving the mnemonically meaningless persistent identifier.

6. The system of claim 1, at least one of the identifier assignment component or the uniqueness verification component reside on at least one principal other than the principal receiving the mnemonically meaningless persistent identifier.

7. The system of claim 1, the key is represented as a public key and a private key.

8. The system of claim 1, the principal is a member of a neighborhood, the neighborhood comprising a plurality of principals each having a key and a mnemonically meaningless persistent identifier, each key is bound to its persistent identifier by a binding.

9. The system of claim 8, the principal belongs to a plurality of neighborhoods.

10. The system of claim 8, the members of the neighborhood store the bindings of the other members in a library.

11. The system of claim 10 the principal receives an authentication request and query the plurality of principals for a binding that can authenticate a source of the authentication request.

12. The system of claim 10, the principal instructs at least one other principal to search its library for a binding that can verify an authentication request.

13. A method for generating an identifier for a principal, comprising:

generating a mnemonically meaningless persistent identifier for the principal;

binding the mnemonically meaningless persistent identifier to a key by a binding;

assigning the mnemonically meaningless persistent identifier and the binding to the principal.

14. The method of claim 13, performed by the principal requesting the mnemonically meaningless identifier.

15. The method of claim 13, performed by a supervising principal in behalf of another principal.

16. The method of claim 13, further comprising generating a second mnemonically meaningless identifier if the mnemonically meaningless identifier has already been assigned.

17. The method of claim 13, the principal is a member of a neighborhood of principals.

18. The method of claim 17, further comprising receiving a request for authentication from another principal.

19. The method of claim 18, the neighbor principals can verify the source of the request for authentication by communicating a binding between the key and identifier of the source of the request for authentication.

20. A system for domain identification, comprising:

means for generating a mnemonically meaningless persistent identifier;

means for assigning the generated mnemonically meaningless persistent identifier to a principal; and

means for binding the generated mnemonically meaningless persistent identifier to a key held by the principal.