DISTRIBUTED ACCESS CONTROL

• US 20190319794A1
• Filed: 04/11/2018
• Published: 10/17/2019
• Est. Priority Date: 04/11/2018
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Haldar, Abhijeet
• Granted Patent: US 11,121,876 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A distributed access control system is disclosed. A payload is received at a voted principal from the client. The voted principal is selected from the plurality of minors. The payload is passed to the minors, and the user is verified by a consensus of the minors. A response packet, which includes an authentication unit, is prepared via a consensus of minors. The response packet can be provided to the client via the voted principal. The ledger is updated to include the authentication unit.

Claims

1. A method of distributing access control in a distributed ledger, the method comprising:

receiving a payload at a voted principal of a plurality of networked minors;

verifying a user from the payload via a consensus of the minors;

preparing a response packet having an authentication unit via the minors; and

updating the distributed ledger to include the authentication unit.

2. The method of claim 1 wherein the payload includes an encrypted packet digitally signed using a private key and further includes a hash of the username and timestamp.

3. The method of claim 2 wherein the payload does not include user information included in distributed ledger.

4. The method of claim 1 wherein the payload is received from a client.

5. The method of claim 4 wherein the principal interfaces with the client.

6. The method of claim 1 wherein the consensus of the minors includes at least a threshold percentage of the minors.

7. The method of claim 1 wherein the authentication unit includes a security token having an associated time to live.

8. The method of claim 7 wherein the security token provides access to a domain during the time to live.

9. The method of claim 1 wherein the distributed ledger is included on the minors.

10. The method of claim 1 wherein the response packet is verified by a consensus of the minors.

11. A computer readable storage device to store computer executable instructions to control a processor to:

receive a payload at a voted principal;

verify a user from the payload via a consensus of networked minors;

prepare a response packet having an authentication unit via the networked minors; and

update a distributed ledger to include the authentication unit.

12. The computer readable storage device of claim 11 wherein the payload includes user objects and is received from a client.

13. The computer readable storage device of claim 11 wherein access is denied if the user is not verified via the consensus of minors.

14. The computer readable storage device of claim 11 wherein the response packet is prepared by a consensus of minors.

15. The computer readable storage device of claim 11 wherein the response packet includes an encrypted security token.

16. A system, comprising:

a memory device to store a set of instructions; and

a processor to execute the set of instructions to;

receive a payload at a voted principal;

verify a user from the payload via a consensus of networked minors;

prepare a response packet having an authentication unit via the networked minors; and

update a distributed ledger to include the authentication unit.

17. The system of claim 16 wherein the networked minors include the distributed ledger.

18. The system of claim 17 wherein the distributed ledger is a blockchain on the networked minors.

19. The system of claim 18 wherein the blockchain is implemented on a blockchain as a service cloud service.

20. The system of claim 16 wherein the networked minors include the voted principal.