Secure domain join for computing devices

• US 7,669,235 B2
• Filed: 05/25/2004
• Issued: 02/23/2010
• Est. Priority Date: 04/30/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Simon, Jeff, Hunt, Galen C.
• Primary Examiner(s): Barron, Jr.; Gilberto
• Assistant Examiner(s): Lemma; Samson B
• Application Number:
  US10/853,931
• Publication Number:
  US 20050246771A1
• Time in Patent Office: 2,100 Days
• Field of Search: 713/172, 713/175, 726/6, 726/18, 726/19
• US Class Current: 726/18
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869

Abstract

A technique is provided for acquiring security domain access credentials on a computing device. The security domain access credentials are acquired by storing a persistent identity on the computing device, and deriving data that includes the security domain access credentials from the persistent identity. The derived data is transferred to a security domain to allow the computing device to join the security domain.

Claims

1. A method comprising:

acquiring security domain access credentials on a computing device by;

storing a persistent identity on the computing device,

deriving data that includes the security domain access credentials from the persistent identity, and

transferring the derived data to a security domain to allow the computing device to join the security domain;

wherein the persistent identity is stored in a secure identity processing area (SIPA), and wherein the SIPA is located in the computing device;

wherein a trust relationship that allows a secure domain join of the computing device to the security domain is established between a persistent account stored in a security domain and the persistent identity in the SIPA;

wherein the SIPA and a secure data center allow the computing device to obtain a cryptographically authenticated operating system at least partially in response to the security domain access credentials.

2. The method of claim 1, wherein an operating system of the computing device receives the derived data by communicating with a processor that is located within the SIPA.

3. The method of claim 1, wherein an operating system of the computing system establishes an identity of the computing device to the security domain at least partially in response to the security domain access credentials.

4. The method of claim 1, further comprising at least one operating system executing on the computing device, wherein an identity of the operating system is generated based on the persistent identity.

5. The method of claim 1, wherein the data derived from the persistent identity includes a cryptographic function, and wherein the persistent identity challenges security domain data received from the security domain.

6. The method of claim 5, wherein the data derived from the persistent identity includes data encrypted with a public key that is associated with the persistent identity and the cryptographic functions include decrypting a portion of the challenge data with a private key of the persistent identity.

7. The method of claim 1, further comprising at least one operating system executing on the computing device, wherein the operating system contains an identity associated with the operating system, and wherein the identity is established in a computer account that is contained in the security domain.

8. An apparatus comprising:

a computing device configured to acquire security domain access credentials, wherein the computing device stores a persistent identity, further wherein the computing device derives data that includes the security domain access credentials from the persistent identity, further wherein the computing device transfers the derived data to a security domain that allows the computing device to join the security domain;

wherein a secure identity processing area (SIPA) stores the persistent identity, wherein the SIPA is located in the computing device;

wherein the SIPA and the secure data center allow the computing device to obtain a cryptographically authenticated operating system at least partially in response to the security domain access credentials.

9. The apparatus of claim 8, wherein a trust relationship that allows a secure domain join of the computing device to the security domain is established between a persistent account stored in a security domain and the persistent identity in the SIPA.

10. The apparatus of claim 8, wherein an operating system of the computing device receives the derived data by communicating with a processor that is located within the SIPA.

11. The apparatus of claim 8, wherein an operating system of the computing system establishes an identity of the computing device to the security domain at least partially in response to the security domain access credentials.

12. The apparatus of claim 8, further comprising at least one operating system executing on the computing device, wherein an identity of the operating system is generated based on the persistent identity of the SIPA.

13. The apparatus of claim 8, wherein the data derived from the persistent identity includes a cryptographic function, and wherein the persistent identity challenges security domain data received from the security domain.

14. The apparatus of claim 13, wherein the data derived from the persistent identity includes data encrypted with a public key that is associated with the persistent identity and the cryptographic functions include decrypting a portion of the challenge data with a private key of the persistent identity.

15. The apparatus of claim 8, further comprising at least one operating system executing on the computing device, wherein the operating system contains an identity associated with the operating system, and wherein the identity is established in a computer account that is contained in the security domain.