Secure identification of intranet network

• US 8,635,680 B2
• Filed: 04/19/2007
• Issued: 01/21/2014
• Est. Priority Date: 04/19/2007
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Begorre, Bill, Brewis, Deon C.
• Primary Examiner(s): SHAW, BRIAN F
• Application Number:
  US11/788,210
• Publication Number:
  US 20080263189A1
• Time in Patent Office: 2,469 Days
• Field of Search: 709/223, 709/222, 709/220, 726/6, 707/102, 713/170
• US Class Current: 726/6
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

A method is provided for network identification based on high entropy data on a network which are not easily guessed or obtained outside the network, which can prevent an attacker from “spoofing” the network. A component in a client computer connected to a network may obtain over the network a network data block including device identification information of a device controlling the network. Upon parsing the network data block, such high entropy data as unique device identifiers may be obtained from the device identification information. Depending on availability of the unique device identifiers and authentication history of the client computer, different combinations of the unique device identifiers and/or other identification information may be used to generate a unique network identifier such as a network signature. The component may provide the network signature to applications within the client computer.

Claims

1. A method performed on a first computing device, the method comprising generating a signature of a network based on an identifier of a second computing device and a name, where the name is selected from a first name and a second name in response to a first condition, where the identifier is selected from a single identifier and a combination of identifiers in response to a second condition, where the first computing device and the second computing device are each coupled to the network, where the generated network signature is not obtainable from outside the network, where the generated network signature is configured to preclude spoofing of the network, where the first condition comprises determining whether or not a root domain identifier is available from the network, and in response to determining that the root domain identifier is available from the network, then selecting the first name as the name, and in response to determining that the root domain identifier is not available from the network, then selecting the second name as the name, and where the second condition comprises determining whether or not the first computing device is authenticated to the second computing device, and in response to determining that the first device is authenticated to the second device, then selecting the single identifier as the identifier, and in response to determining that the first device is not authenticated to the second device, then further determining whether or not the first computing device was previously authenticated to the second computing device, and in response to determining that the first computing device was previously authenticated to the second computing device, then selecting the combination of identifiers as the identifier, and in response to determining that the first computing device was not previously authenticated to the second computing device, then selecting the single identifier as the identifier.

2. The method of claim 1 where the first name is of a forest of the network.

3. The method of claim 1 where the second computing device is a domain controller.

4. The method of claim 1 where the second name is of a domain of the network.

5. The method of claim 1 where the single identifier is a domain identifier or a root domain identifier.

6. The method of claim 1 where the combination of identifiers is a modifier identifier combined with a domain identifier or the modifier identifier combined with a root domain identifier.

7. At least one computer storage device storing computer-executable instructions that, when executed by a first computing device, cause the first computing device to perform actions comprising generating a signature of a network based on an identifier of a second computing device and a name, where the name is selected from a first name and a second name in response to a first condition, where the identifier is selected from a single identifier and a combination of identifiers in response to a second condition, where the first computing device and the second computing device are each coupled to the network, where the generated network signature is not obtainable from outside the network, where the generated network signature is configured to preclude spoofing of the network, where the first condition comprises determining whether or not a root domain identifier is available from the network, and in response to determining that the root domain identifier is available from the network, then selecting the first name as the name, and in response to determining that the root domain identifier is not available from the network, then selecting the second name as the name, and where the second condition comprises determining whether or not the first computing device is authenticated to the second computing device, and in response to determining that the first device is authenticated to the second device, then selecting the single identifier as the identifier, and in response to determining that the first device is not authenticated to the second device, then further determining whether or not the first computing device was previously authenticated to the second computing device, and in response to determining that the first computing device was previously authenticated to the second computing device, then selecting the combination of identifiers as the identifier, and in response to determining that the first computing device was not previously authenticated to the second computing device, then selecting the single identifier as the identifier.

8. The at least one storage device of claim 7 where the first name is of a forest of the network.

9. The at least one storage device of claim 7 where the second computing device is a domain controller.

10. The at least one storage device of claim 7 where the second name is of a domain of the network.

11. The at least one storage device of claim 7 where the single identifier is a domain identifier or a root domain identifier.

12. The at least one storage device of claim 7 where the combination of identifiers is a modifier identifier combined with a domain identifier or the modifier identifier combined with a root domain identifier.

13. A first computing device and at least one program module together configured for generating a signature of a network based on an identifier of a second computing device and a name, where the name is selected from a first name and a second name in response to a first condition, where the identifier is selected from a single identifier and a combination of identifiers in response to a second condition, where the first computing device and the second computing device are each coupled to the network, where the generated network signature is not obtainable from outside the network, where the generated network signature is configured to preclude spoofing of the network, where the first condition comprises determining whether or not a root domain identifier is available from the network, and in response to determining that the root domain identifier is available from the network, then selecting the first name as the name, and in response to determining that the root domain identifier is not available from the network, then selecting the second name as the name, and where the second condition comprises determining whether or not the first computing device is authenticated to the second computing device, and in response to determining that the first device is authenticated to the second device, then selecting the single identifier as the identifier, and in response to determining that the first device is not authenticated to the second device, then further determining whether or not the first computing device was previously authenticated to the second computing device, and in response to determining that the first computing device was previously authenticated to the second computing device, then selecting the combination of identifiers as the identifier, and in response to determining that the first computing device was not previously authenticated to the second computing device, then selecting the single identifier as the identifier.

14. The first computing device and the at least one program module of claim 13 where the second computing device is a domain controller.

15. The first computing device and the at least one program module of claim 13 where the first name is of a forest of the network.

16. The first computing device and the at least one program module of claim 13 where the second name is of a domain of the network.

17. The first computing device and the at least one program module of claim 13 where the single identifier is a domain identifier or a root domain identifier.

18. The first computing device and the at least one program module of claim 13 where the combination of identifiers is a modifier identifier combined with a domain identifier or the modifier identifier combined with a root domain identifier.