Credential roaming in electronic computing systems

• US 7,984,488 B2
• Filed: 04/09/2004
• Issued: 07/19/2011
• Est. Priority Date: 04/09/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Hallin, Philip J., Su, Xiaohong, Zhuang, Hao, Cross, David B.
• Primary Examiner(s): Henning; Matthew T
• Application Number:
  US10/821,603
• Publication Number:
  US 20050257072A1
• Time in Patent Office: 2,657 Days
• Field of Search: 726/6, 707/613
• US Class Current: 726/6
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

An exemplary system enabling credential roaming among a plurality of different computing devices may include an event handler to receive event notifications such as, e.g., a client logon. The event handler may invoke a management service in response to receiving an event notification. The management service may include a synchronizing module to synchronize a user'"'"'s credentials with a remote directory service, such as, e.g., Active Directory, so that the user'"'"'s credentials are available from any of a number of different computing devices.

Claims

1. A method comprising:

storing, in a memory, instructions for performing the method;

executing the instructions on a processor;

according to the instructions being executed;

enumerating local credentials and remote credentials in response to receiving a first event notification, wherein the first event notification comprises a lock event

enumerating the local credentials and the remote credentials in response to receiving a second event notification, wherein the second event notification is different from the first event notification and comprises a startup event;

enumerating the local credentials and the remote credentials in response to receiving a third event notification, wherein the third event notification is different from the first and second event notifications and comprises a shutdown event;

enumerating the local credentials and the remote credentials in response to receiving a fourth event notification, wherein the fourth event notification is different from the first, second, and third event notifications and comprises a logon event;

enumerating the local credentials and the remote credentials in response to receiving a fifth event notification, wherein the fifth event notification is different from the first, second, third, and fourth event notifications and comprises a logoff event;

enumerating the local credentials and the remote credentials in response to receiving a sixth event notification, wherein the sixth event notification is different from the first, second third, fourth, and fifth even notifications and comprises a unlock event;

enumerating the local credentials and the remote credentials in response to receiving a seventh event notification, wherein the seventh event notification is different from the first, second, third, fourth, fifth, and sixth event notifications and comprises a session event;

enumerating the local credentials and the remote credentials in response to receiving an eighth event notification, wherein the eighth event notification is different from the first, second, third, fourth, fifth, sixth, and seventh event notifications and comprises a timer event;

enumerating the local credentials and the remote credentials in response to receiving a ninth event notification, wherein the ninth event notification is different from the first, second, third, fourth, fifth, sixth, seventh, and eighth event notifications and comprises a manual request; and

enumerating the local credentials and the remote credentials in response to receiving a tenth event notification, wherein the tenth event notification is different from the first, second, third, fourth, fifth, sixth, seventh, eighth, and ninth event notifications and comprises a credential update event;

based on the enumerating, evaluating the local credentials and the remote credentials; and

based on the evaluating, synchronizing the local credentials and remote credentials.

2. The method of claim 1, wherein synchronizing the local credentials and the remote credentials is based on at least one time-stamp associated with the local credentials and at least one time-stamp associated with the remote credentials.

3. The method of claim 1, wherein synchronizing the local credentials and the remote credentials is based on a comparison of hash values.

4. The method of claim 1, wherein synchronizing includes error handling.

5. The method of claim 1, wherein synchronizing includes writing at least one of the local credentials to a remote credential cache.

6. The method of claim 1, wherein synchronizing includes writing at least one of the remote credentials to a local credential cache.

7. The method of claim 1, wherein synchronizing includes deleting at least one of the local credentials from a local credential cache.

8. The method of claim 1, wherein synchronizing includes deleting at least one of the remote credentials from a remote credential cache.

9. The method of claim 1, wherein synchronizing includes modifying at least one of the local credentials at a local credential cache based on at least one of the remote credentials.

10. The method of claim 1, wherein synchronizing includes modifying at least one of the remote credentials at a remote credential cache based on at least one of the local credentials.

11. The method of claim 1, further comprising updating a list of local credentials.

12. The method of claim 1, further comprising updating a list of remote credentials.

13. The method of claim 1, further comprising determining a state of the remote credentials dynamically.

14. The method of claim 1, further comprising maintaining a state file for the remote credentials.

15. The method of claim 1, further comprising maintaining a state file for the local credentials.

16. The method of claim 1, further comprising resolving a conflict of state between the local credentials and the remote credentials.

17. The method of claim 1, wherein the session event comprises at least one of:

a policy update;

running a process; and

connecting to a network.

18. A computer readable storage memory encoded with a computer program for executing on a computer system a computer process, the computer process comprising:

enumerating local credentials and remote credentials in response to receiving each of a lock event, a startup event, a shutdown event, a logon event, a logoff event, an unlock event, a session event, a timer event, a manual request, and a credential update event, wherein one of the local credentials and the remote credentials comprises at least one of the following;

a token; and

an XrML license;

evaluating the local credentials and the remote credentials based on the enumerating;

synchronizing the local credentials and remote credentials based on the evaluating via a synchronizing module, wherein the synchronizing module;

sorts the local credentials and the remote credentials into a local credential array and a remote credential array respectively and compares the local credential array and the remote credential array; and

stores a state file for conflict resolution, the state file comprising;

a file version;

a flag, wherein the flag indicates whether the credential is user-protected; and

a credential state, wherein the credential state comprises;

last time synchronization module called;

last time local store changed; and

last time remote cache changed;

based on the synchronizing module comparing the local credential array and the remote credential array, removing at least one of the local credentials from a first local credential cache associated with a first device, wherein the credential removed from the first local credential cache is identified and tagged by the synchronization module in a remote credential cache;

based on the synchronizing module comparing the local credential array and the remote credential array, removing the tagged credential from a second local credential cache associated with a second device, wherein the first device is different than the second device, without rewriting the tagged credential to the remote credential cache; and

handling errors, wherein error handling comprises returning a write state indication of a status of a credential write operation, wherein the write state indication consists of one of the following;

a none indication, wherein the none indication comprises an indication that the credential was not altered;

a partial indication, wherein the partial indication comprises an indication that the credential was partially altered;

or

a done indication, wherein the done indication comprises an indication that the credential was successfully changed.

19. The computer readable storage memory of claim 18 wherein the computer process further comprises synchronizing the local credentials and the remote credentials is based on at least one time-stamp associated with the local credentials and at least one time-stamp associated with the remote credentials.

20. The computer readable storage memory of claim 18 wherein the computer process further comprises synchronizing the local credentials and the remote credentials is based on a comparison of hash values.

21. The computer readable storage memory of claim 18 wherein the computer process further comprises writing at least one of the local credentials to a remote credential cache.

22. The computer readable storage memory of claim 18 wherein the computer process further comprises writing at least one of the remote credentials to a local credential cache.

23. The computer readable storage memory of claim 18 wherein the computer process further comprises removing at least one of the local credentials from a local credential cache.

24. The computer readable storage memory of claim 18 wherein the computer process further comprises removing at least one of the remote credentials from a remote credential cache.

25. The computer readable storage memory of claim 18 wherein the computer process further comprises modifying at least one of the local credentials at a local credential cache.

26. The computer readable storage memory of claim 18 wherein the computer process further comprises modifying at least one of the remote credentials at a remote credential cache.

27. The computer readable storage memory of claim 18 wherein the computer process further comprises updating the array of local credentials.

28. The computer readable storage memory of claim 18 wherein the computer process further comprises updating the array of remote credentials.

29. The computer readable storage memory of claim 18 wherein the computer process further comprises determining a state of the remote credentials dynamically.

30. The computer readable storage memory of claim 18 wherein the computer process further comprises resolving a conflict of state between the local credentials and the remote credentials.

31. A system comprising:

an event handler to receive event notifications;

a local store manager and a remote store manager to enumerate local credentials and remote credentials in response to receiving an event notification for each of a lock event, a startup event, a shutdown event, a logon event, a logoff event, an unlock event, a session event, a timer event, a manual request, and a credential update event;

a management service to evaluate the local credentials and the remote credentials based on the enumerating, and

a synchronizing module operatively associated with the event handle, the synchronizing module implemented in computer-readable program code and executable by a processor to synchronize the local credentials and the remote credentials based on the evaluating when the event handler receives any one of the event notifications and if the local and remote credentials are different from one another.

32. The system of claim 31, wherein the local credentials and the remote credentials include at least one of the following:

an encryption credential, a token, an asymmetric key pair, a symmetric key, a digital certificate, an XrML license, an authentication credential, an authorization credential.

33. The system of claim 31, wherein the local credentials are stored in a local cache.

34. The system of claim 31, wherein the local credentials are stored in a local cache provided at any number (n) of clients.

35. The system of claim 31, wherein the local credentials are encrypted using a master key.

36. The system of claim 31, wherein the remote credentials are stored in a remote cache.

37. The system of claim 31, wherein the local credentials are stored in a remote cache provided at any number (n) of hosts.

38. The system of claim 31, wherein the remote credentials are maintained by a remote directory service.

39. The system of claim 31, wherein the remote credentials are encrypted.