Security link management in dynamic networks

• US 7,257,836 B1
• Filed: 10/23/2000
• Issued: 08/14/2007
• Est. Priority Date: 04/24/2000
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Moore, Timothy M., Ayyagari, Arun, Bahl, Pradeep, Sheth, Sachin C.
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Brown; Christopher J.
• Application Number:
  US09/694,514
• Time in Patent Office: 2,486 Days
• Field of Search: 713/155, 713/156, 713/157, 713/175, 713/182, 713/166, 713/185, 726/5, 726/19
• US Class Current: 726/5
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A method for setting up and managing secure data/audio/video links with secure key exchanges, authentication and authorization is described. An embodiment of the invention enables establishment of a secure link with limited privileges using the machine identifier of a trusted machine. This is particularly useful if the user of the machine does not have a user identifying information suitable for authentication. Furthermore, the presentation of a default user identifying information by a user advantageously initiates intervention by a system administrator instead of a blanket denial. This decentralized procedure allows new users access to the network without having to physically access a centralized facility to present their credentials. Another embodiment of the invention enables a remote user to connect to a secure network with limited privileges.

Claims

1. A method of providing a mobile computing unit with privileged access to a computing resource, the method comprising the steps of:

detecting a failure of a user of the mobile computing unit to complete a logon to access the computing resource because the user has not submitted sufficient identifying information;

obtaining credentials with a unique machine identifier to facilitate authenticating an identity of the mobile computing unit;

providing the credentials to an authenticator to prove the machine identity, the authenticator controlling access to the computing resource; and

establishing limited access to the computing resource using authorization information obtained from the authenticator that reflects a relative security level for a user of the mobile computing unit, the authorization information corresponding to the authenticated identity of the mobile computing unit.

2. The method of claim 1 wherein the mobile computing unit communicates with the computing resource using at least one wireless link.

3. The method of claim 1 wherein the authorization information includes a key for encrypting communications from the mobile computing unit to an input port.

4. The method of claim 3 wherein the key is a symmetric session key.

5. The method of claim 1 further comprising the step of storing the unique machine identifier on the mobile computing unit for subsequent use.

6. The method of claim 1 further comprising the step of storing the certificate on the mobile computing unit.

7. The method of claim 1 further comprising the step of receiving the unique machine identifier.

8. A computer-readable medium having computer executable instructions for performing the steps of a method of providing a mobile computing unit with privileged access to a computing resource, the method comprising the steps of:

denying the mobile computing unit access to the computing resource for failure of a user of the mobile computing unit to complete a log-in to gain unlimited access to the computing resource because the user has not submitted sufficient identifying information;

obtaining credentials with a unique machine identifier to facilitate authenticating an identity of the mobile computing unit;

providing the credentials to an authenticator to prove the machine identity, the authenticator controlling access to the computing resource; and

establishing limited access to the computing resource using authorization information obtained from the authenticator to reflect a relative security level for a user of the mobile computing unit, the authorization information corresponding to the authenticated identity of the mobile computing unit.

9. A computer-readable medium as in claim 8 having computer executable instructions wherein the mobile computing unit communicates with the computing resource using at least one wireless link.

10. A computer-readable medium as in claim 8 having computer executable instructions wherein the authorization information includes a key for encrypting communications from the mobile computing unit to an input port.

11. A computer-readable medium as in claim 8, having computer executable instructions for performing the additional step of storing the unique machine identifier on the mobile computing unit for subsequent use.

12. A computer-readable medium as in claim 8, having computer executable instructions for performing the additional step of storing the certificate on the mobile computing unit.