Endpoint identification and security

• US 7,636,939 B2
• Filed: 12/10/2004
• Issued: 12/22/2009
• Est. Priority Date: 12/10/2004
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Kaler, Christopher G., Dunn, Melissa W., Della-Libera, Giovanni M., Janczuk, Tomasz, Hasha, Richard L., Walter, Douglas A.
• Primary Examiner(s): Korzuch; William R
• Assistant Examiner(s): Moorthy; Aravind K
• Application Number:
  US11/009,926
• Publication Number:
  US 20060130127A1
• Time in Patent Office: 1,838 Days
• Field of Search: 726/7
• US Class Current: 726/7
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/16 Implementing security features at a particular protocol layer

Abstract

A data structure with endpoint address and security information. The data structure includes an address field that includes one or more endpoint addresses for an entity. The data structure further includes a security field that includes one or more keys for facilitating secure communications with the entity. The data structure may also be such that the contents of the address field and the security field are serialized in the data structure. The data structure may be extensible such that new address fields and security fields may be added.

Claims

1. A data structure that is stored on a computer readable medium, the data structure comprising:

a SOAP header that contains the following fields;

an Uber identity field that includes an Uber name that globally identifies an entity and that associates the entity with a plurality of different endpoint addresses where one or more messages are deliverable to the entity and wherein the Uber name does not specify which of the plurality of endpoint addresses is used for sending a message to the entity;

an address field, the address field comprising;

the plurality of endpoint addresses, which are each associated with the entity;

one or more policies describing when a particular endpoint address is used to send messages to the entity, the one or more policies comprising criteria including at least one of date and/or time ranges, sensitivity of data, urgency or priority of data classification of data, topic of data, user selection as a result of prompting, a machine registered default, an application registered default, a user registered default, application specific logic, custom registered extensions, recipient attributes, or presence of an entity; and

wherein the address field specifies which of the plurality of endpoint addresses is used in delivering the one or more messages by implementing the one or more policies;

a security field that comprises one or more keys for facilitating secure communications with the entity through at least one of the plurality of endpoint addresses; and

wherein the contents of the Uber identity field, the address field and the security field are serialized in the data structure and wherein the data structure is extensible such that new address fields and new security fields may be added in such a way as to be generally associated with the entity though the Uber identity.

2. The data structure of claim 1, wherein the address field contains one or more references including addresses and security information.

3. The data structure of claim 1, wherein the endpoint addresses comprise at least one of a MAC address, a URL, a URI, an email address, a phone number, an IM address and a physical mail address.

4. The data structure of claim 1, wherein the address field contains an address for a delegate entity identified for the entity.

5. The data structure of claim 1, wherein the security field comprises at least one of a SPN, a UPN, an X.509 thumbprint, a security token, an issuer and serial number, a public key, an embedded certificate, and a verifiable DNS claim.

6. The data structure of claim 1, wherein the security field comprises biometric authentication data including at least one of data representing a fingerprint, an iris scan, voice recognition, and DNA recognition.

7. The data structure of claim 1, wherein the data structure is serialized in an XML block.

8. The data structure of claim 1, wherein the security field comprises security rules.

9. The data structure of claim 8, wherein the security rules comprise Boolean combinations of security information.

10. The data structure of claim 8, wherein the security rules use addressable fields such as “

To,”

“

From,” and

“

Reply To”

fields from web services communications.

11. The data structure of claim 1, wherein presence of an entity is determined by at least one of published IM data, an endpoint reference, a WSDL contract, an Endpoint contract, presence of a machine on a network, time-of-day, an attempt to contact, peer to peer presence data, specific applications running, and an application mode.

12. The data structure of claim 1, wherein the data structure is enveloped by an embedded signature.

13. The data structure of claim 12, wherein the embedded signature is an XML enveloped signature.

14. The data structure of claim 1, further comprising an embedded security header.

15. The data structure of claim 1, wherein one or more endpoint addresses in the address field are designated as shareable or non-sharable.

16. The data structure of claim 1, further comprising a global identity version comprising a value that is incremented when contents of the address field are changed.

17. A data structure as recited in claim 1, wherein the address field includes at least one endpoint address that is a delegate address that is an address of a second entity and to which certain types of tasks have been delegated, such that one or more messages sent to the entity though identification of the entity by use of the Uber name will actually be routed to the second entity instead of the entity to which the one or more messages were originally addressed.

18. A method performed by a computer for creating a reference data structure comprising a SOAP header, the method comprising acts of:

creating an Uber identity field that includes an Uber name that globally identifies an entity and that associates the entity with a plurality of different endpoint addresses where one or more messages are deliverable to the entity and wherein the Uber name does not specify which of the plurality of endpoint addresses is used for sending a message to the entity;

creating an address field, the address field comprising;

the plurality of endpoint addresses, which are each associated with the entity;

one or more policies describing when a particular endpoint address is used, to send messages to the entity, the one or more policies comprising criteria including at least one of date and/or time ranges, sensitivity of data, urgency or priority of data, classification of data, topic of data, user selection as a result of prompting, a machine registered default, an application registered default, a user registered default, application specific logic, custom registered extensions, recipient attributes, and presence of an entity; and

wherein the address field specifies which of the plurality of endpoint addresses is used in delivering the one or more messages by implementing the one or more policies;

creating a security field that comprises one or more keys for facilitating secure communications with the entity though at least one of the plurality of endpoint addresses; and

serializing data in the address field and the security field to create a serialized data structure which is also extensible in so far as new address fields and new security fields may be added to the data structure in such a way as to be generally associated with the entity though the Uber identity, wherein the serialized data structure is stored in a computer readable medium of the computer.

19. The method of claim 18, further comprising merging the serialized data structure with another serialized data structure such that at least one additional endpoint address is added to the address field and/or one additional key is added to the security field.

20. The method of claim 19, further comprising resolving conflicts between endpoint address in the address field and in the another serialized data structure.

21. The method of claim 20, wherein resolving conflicts comprises at least one of securely prompting a user to resolve the conflict, using machine registered defaults, using application registered defaults, using user registered defaults, invoking application specific logic, using custom registered extensions, considering various aspects of the data being sent to an entity or actions desired and selecting the most recently entered endpoint address.

22. A computer readable storage medium having computer executable instructions for performing the acts recited in claim 18.

23. A method of communicating between endpoints on a network, the method comprising;

accessing a serialized extensible data structure comprising a SOAP header that is received over the network to obtain an endpoint address for an entity on the network, wherein the extensible data structure includes;

an Uber identity field that includes an Uber name that globally identifies an entity and that associates the entity with a plurality of different endpoint addresses where one or more messages are deliverable to the entity and wherein the Uber name does not specify which of the plurality of endpoint addresses is used for sending a message to the entity;

an address field, the address field comprising;

the plurality of endpoint addresses, which are each associated with the entity;

one or more policies describing when a particular endpoint address is used to send messages to the entity, the one or more policies comprising criteria including at least one of date and/or time ranges, sensitivity of data, urgency or priority of data, classification of data, topic of data, user selection as a result of prompting, a machine registered default, an application registered default, a user registered default, application specific logic, custom registered extensions, recipient attributes, and presence of an entity; and

wherein the address field specifies which of the plurality of endpoint addresses is used in delivering the one or more messages by implementing the one or more policies;

a security field that comprises one or more keys for facilitating secure communications with the entity though at least one of the plurality of endpoint addresses; and

wherein the contents of the Uber identity field, the address field and the security field are serialized in the data structure and wherein the data structure is extensible such that new address fields and new security fields may be added in such a way as to be generally associated with the entity though the Uber identity;

accessing the one or more policies that are included within the data structure to determine which endpoint address to select from the plurality of different endpoint addresses for the entity;

accessing the serialized extensible data structure to obtain a security key of the one or more keys;

encrypting data using the security key; and

sending the data to the selected endpoint address for the entity on the network.

24. The method of claim 23, further comprising accessing security rules in the serialized extensible data structure to determine an appropriate security key to obtain.

25. The method of claim 23, further comprising receiving the serialized extensible data structure from a third party.

26. The method of claim 23, wherein determining which endpoint address to select comprises implementing rules based on at least one of a set of transport protocols available, date and/or time ranges, sensitivity of the data being sent, urgency or priority of the data, classification of the data, and the topic of the data.

27. A method as recited in claim 23, wherein the extensible data structure includes at least one address that is designated as non-sharable and wherein the recited method further includes forwarding the extensible data structure to one or more additional entities after first removing any addresses that are identified within the extensible data structure as being non-sharable.