Secured distributed impersonation

• US 7,703,131 B1
• Filed: 03/01/2000
• Issued: 04/20/2010
• Est. Priority Date: 03/01/2000
• Status: Expired due to Term

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Frank, Alexander, Amit, Neta
• Primary Examiner(s): Moise; Emmanuel L
• Assistant Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US09/516,402
• Time in Patent Office: 3,702 Days
• Field of Search: 709225-229, 709/201, 713/201, 726/6, 726/8
• US Class Current: 726/8
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

The invention relates to secured distributed impersonation, for use within systems such as batch system and batch message transaction systems. In one embodiment, a method includes sending a request for credentials of a network account from an originating account associated with an unpublished object to a dispatch associated with a published object. In one embodiment, both the unpublished and the published objects can each be a message queue. The dispatch authenticates the originating account. Upon successful authentication, the network account access emblem is sent to the originating account—that is, the originating account receives the requested credentials, which facilitate the ability to impersonate into the network account.

Claims

1. A computer-implemented method comprising:

assigning a job by a dispatch to an originating account, the originating account not having adequate resources to accomplish the job;

sending a request for network account credentials from the originating account to the dispatch that is associated with a published object, the network account credentials include the resources to complete the job, the request directed to the published object includes an identification of an unpublished object associated with the originating account, the published object is accessible by an account without prior identification of the published object and the unpublished object is accessible by the account when the account is previously informed about the identification of the unpublished object;

authenticating the originating account at the dispatch;

determining the network account credentials to send to the originating account, the network account credentials facilitate the originating account to impersonate a network account of the dispatch to complete the job in a secured manner; and

upon authenticating the originating account, sending an emblem that includes the published object and the network account credentials from the dispatch to the originating account.

2. The method of claim 1, wherein the request is unencrypted, and the emblem is encrypted.

3. The method of claim 1, wherein each of the published object and the unpublished object comprises a message queue.

4. The method of claim 1, wherein each of the published object and the unpublished object comprises a file.

5. The method of claim 1, wherein the emblem comprises a token that includes the network account credentials.

6. The method of claim 1, wherein the network account for which the emblem is sent from the dispatch to the originating account comprises a batch account of the dispatch.

7. The method of claim 1, wherein sending the emblem for the network account to the originating account comprises remoting a batch account to the originating account, such that the emblem comprises the emblem for the batch account.

8. The method of claim 1, wherein the network account for which the emblem is sent from the dispatch to the originating account comprises an agent account of an agent.

9. The method of claim 1, wherein sending the emblem for the network account to the originating account further comprises:

determining an agent that contains the network account credentials to be sent to the originating account;

proxy logging on to the agent; and

,

remoting an agent account to the originating account to complete the assigned job upon proxy log on to the agent, such that the emblem comprises the emblem for the agent account.

10. The method of claim 1, wherein the emblem is expirable, such that the method further comprises determining whether the emblem is about to expire, and upon so determining, renewing the emblem with a renewing authority.

11. The method of claim 1, wherein the dispatch is a device within a network that sends the network account credentials to the originating account.

12. A computer-readable storage media having computer-readable instructions thereon which, when executed by a computer, implement a method comprising:

assigning a job by a dispatch to an originating account, the originating account not having adequate resources to accomplish the job;

sending a request for network account credentials from the originating account to the dispatch that is associated with a published object, the network account credentials include the resources to complete the job, the request directed to the published object includes an identification of an unpublished object associated with the originating account;

authenticating the originating account at the dispatch;

determining the network account credentials to send to the originating account; and

upon authenticating the originating account, sending an emblem that includes the published object and the network account credentials from the dispatch to the originating account.

13. The computer-readable storage media of claim 12, wherein the assigning the job includes determining by the dispatch of what pending tasks or jobs should be performed first.

14. The computer-readable storage media of claim 12, wherein the published object that is associated with the dispatch is accessible without prior identification.

15. The computer-readable storage media of claim 12, wherein the published object comprises one of:

a file, and a message queue.

16. The computer-readable storage media of claim 12 further includes proxy logging to an agent account to complete the job.

17. A computing device comprising:

a memory;

a processor, coupled to the memory, configured to implement a method comprising;

assigning a job by a dispatch to an originating account, the originating account not having adequate resources to accomplish the job;

sending a request for network account credentials from the originating account to the dispatch that is associated with a published object, the network account credentials include the resources to complete the job, the request directed to the published object includes an identification of an unpublished object associated with the originating account;

authenticating the originating account at the dispatch;

determining the network account credentials to send to the originating account; and

upon authenticating the originating account, sending an emblem that includes the published object and the network account credentials from the dispatch to the originating account.

18. The computer computing device of claim 17, wherein the unpublished object associated with the originating account is accessible by an account when the account is previously informed of the identification of the unpublished object.

19. The computer computing device of claim 17, wherein the network account credentials include the network account credentials of an agent account, which is used to complete the job.

20. The computer computing device of claim 17, wherein the agent account is determined by the dispatch.