Authentication and authorization across autonomous network systems

• US 7,617,522 B2
• Filed: 04/24/2006
• Issued: 11/10/2009
• Est. Priority Date: 12/21/2001
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Satagopan, Murli D., Garg, Praerit, Leach, Paul J., Van Dyke, Clifford P., Schmidt, Donald E.
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): POLTORAK, PIOTR
• Application Number:
  US11/379,998
• Publication Number:
  US 20060184646A1
• Time in Patent Office: 1,296 Days
• Field of Search: 726 1- 2, 726/8, 713/170
• US Class Current: 726/2
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

An enterprise network architecture has a trust link established between two autonomous network systems that enables transitive resource access between network domains of the two network systems. The trust link is defined by data structures maintained by each of the respective network systems. The first network system maintains namespaces that correspond to the second network system and a domain controller in the first network system, or a first network system administrator, indicates whether to trust individual namespaces. An account managed by a domain in the second network system can request authentication via a domain controller in the first network system. The first network system determines from the trust link to communicate the authentication request to the second network system. The first network system also determines from the trust link where to communicate authorization requests when administrators manage group memberships and access control lists.

Claims

1. An enterprise network architecture, comprising:

a first network system including one or more first network system domains;

a second network system including one or more second network system domains, the second network system being autonomous from the first network system such that the first network system domains are administratively independent from the second network system domains; and

a trust link between a first network system root domain and a second network system root domain, the trust link configured to provide transitive resource access between the one or more first network system domains and the one or more second network system domains;

wherein the first network system is configured to determine from the trust link where to communicate a request for a resource, the request received from an account managed in the first network system and the resource maintained by the second network system.

2. An enterprise network architecture as recited in claim 1, wherein:

the first network system root domain is configured for communication with the one or more first network system domains;

the second network system root domain is configured for communication with the one or more second network system domains; and

the trust link is further configured to provide transitive security associations between the one or more first network system domains and the one or more second network system domains.

3. An enterprise network architecture as recited in claim 1, wherein:

the first network system domain includes a first domain controller;

the second network system domain includes a second domain controller; and

an account managed by the second domain controller can initiate a request for remote network authentication via the first domain controller or can initiate a request for authentication communicated from the first domain controller to the second network system via the trust link.

4. An enterprise network architecture as recited in claim 1, wherein:

the first network system root domain is configured for communication with the one or more first network system domains, an individual first network system domain including a first domain controller;

the second network system root domain is configured for communication with the second network system domains, an individual second network system domain including a second domain controller; and

an account managed by the second domain controller can initiate a request for authentication to access a resource managed by the second domain controller, the request for authentication communicated from the first domain controller to the second domain controller via the first network system root domain, the trust link, and the second network system root domain.

5. An enterprise network architecture as recited in claim 1, wherein the trust link is a one-way trust link initiated by an administrator of the first network system, the one-way trust link configured to provide transitive resource access from the second network system domains to the first network system domains.

6. An enterprise network architecture as recited in claim 1, wherein the trust link is a two-way trust link initiated by a first network system administrator and by a second network system administrator, and wherein the transitive resource access is automatically configured when the trust link is established.

7. An enterprise network architecture as recited in claim 1, wherein the first network system is configured to receive a request to logon to the second network system and determine from the trust link where to communicate the request, and wherein the second network system is configured to authenticate the request.

8. An enterprise network architecture as recited in claim 1, wherein the trust link is a data structure configured to maintain namespaces corresponding to trusted network system domain components.

9. An enterprise network architecture as recited in claim 1, wherein the trust link includes a first network system data structure and a second network system data structure, the first network system data structure configured to maintain trusted namespaces corresponding to the second network system, and the second network system data structure configured to maintain trusted namespaces corresponding to the first network system.

10. An enterprise network architecture as recited in claim 1, wherein the trust link is a data structure configured to maintain namespaces corresponding to the second network system, and wherein the first network system is configured to maintain the data structure and automatically designate which of the namespaces are trusted by the first network system.

11. An enterprise network architecture as recited in claim 1, wherein the trust link is a data structure maintained by the first network system, the data structure configured to maintain namespaces corresponding to trusted second network system domain components, and the trusted second network system domain components being designated as trusted by a first network system administrator.

12. An enterprise network architecture as recited in claim 1, wherein the first network system is configured to:

receive an account request to logon to the second network system;

determine from the trust link where to communicate the account request; and

provide a security identifier to the second network system, the security identifier corresponding to the account.

13. An enterprise network architecture as recited in claim 1, wherein:

the first network system is configured to determine from the trust link where to communicate a service account request to access a resource maintained by the second network system;

the first network system is further configured to provide a security identifier to the second network system, the security identifier corresponding to a user account maintained by the first network system; and

the second network system is configured to determine from the trust link whether to trust the security identifier to authorize the service account request.