# US 11,121,876 B2 · Distributed access control > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,121,876 B2 - Document ID: US11121876B2 - Status: Granted - Kind: B2 - Application number: 15/950,745 - Filed: 2018-04-11 - Published: 2019-10-17 - Granted: 2021-09-14 - Earliest claimed: 2018-04-11 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Abhijeet Haldar - Web page: https://patentgrep.com/patent/US11121876B2 ## CPC - H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key} - H04L 9/3236: {using cryptographic hash functions} - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 9/3247: {involving digital signatures} - H04L 9/3297: {involving time stamps, e.g. generation of time stamps} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A distributed access control system is disclosed. A payload is received at a voted principal from the client. The voted principal is selected from the plurality of minors. The payload is passed to the minors, and the user is verified by a consensus of the minors. A response packet, which includes an authentication unit, is prepared via a consensus of minors. The response packet can be provided to the client via the voted principal. The ledger is updated to include the authentication unit. ## Claims ### Claim 1 A method of distributing access control in a distributed ledger, the method comprising: receiving a payload at a voted principal of a plurality of networked minors, the principal including a selected minor determined by the plurality of minors; verifying a user from the payload via a consensus of the minors, the minors including a ledger of user data, the payload verified against the distributed ledger of user data, the payload does not include user information included in the distributed ledger; preparing a response packet having an authentication unit via the minors, wherein the minors generate a response token for the response packet and a first minor of the plurality of minors to generate the response token notifies other minors of the plurality of minors to stop generating the response token, the response packet provided via the principal; and updating the distributed ledger to include the authentication unit. ### Claim 2 (depends on 1) The method of claim 1 wherein the payload includes an encrypted packet digitally signed using a private key and further includes a hash of the username and timestamp. ### Claim 3 (depends on 1) The method of claim 1 wherein the payload is received from a client. ### Claim 4 (depends on 3) The method of claim 3 wherein the principal interfaces with the client. ### Claim 5 (depends on 1) The method of claim 1 wherein the consensus of the minors includes at least a threshold percentage of the minors. ### Claim 6 (depends on 1) The method of claim 1 wherein the authentication unit includes a security token having an associated time to live. ### Claim 7 (depends on 6) The method of claim 6 wherein the security token provides access to a domain during the time to live. ### Claim 8 (depends on 1) The method of claim 1 wherein the distributed ledger is included on the minors. ### Claim 9 (depends on 1) The method of claim 1 wherein the response packet is verified by a consensus of the minors. ### Claim 10 A computer readable storage device, which is not a propagating signal, to store computer executable instructions to control a processor to: receive a payload at a voted principal of a plurality of networked minors, the principal including a selected minor determined by the plurality of minors; verify a user from the payload via a consensus of the plurality of minors, the minors including a distributed ledger of user data, the payload verified against the ledger of user data, the payload does not include user information included in the distributed ledger; prepare a response packet having an authentication unit via the networked minors, wherein the minors generate a response token for the response packet and a first minor of the plurality of minors to generate the response token notifies other minors of the plurality of minors to stop generating the response token, the response packet provided via the principal; and update a distributed ledger to include the authentication unit. ### Claim 11 (depends on 10) The computer readable storage device of claim 10 wherein the payload includes user objects and is received from a client. ### Claim 12 (depends on 10) The computer readable storage device of claim 10 wherein access is denied if the user is not verified via the consensus of minors. ### Claim 13 (depends on 10) The computer readable storage device of claim 10 wherein the response packet is prepared by a consensus of minors. ### Claim 14 (depends on 10) The computer readable storage device of claim 10 wherein the response packet includes an encrypted security token. ### Claim 15 A system, comprising: a memory device to store a set of instructions; and a processor to execute the set of instructions to: receive a payload at a voted principal of a plurality of networked minors, the principal including a selected minor determined by the plurality of minors; verify a user from the payload via a consensus of the plurality of minors, the minors including a distributed ledger of user data, the payload verified against the ledger of user data, the payload does not include user information included in the distributed ledger; prepare a response packet having an authentication unit via the networked minors, wherein the minors generate a response token for the response packet and a first minor of the plurality of minors to generate the response token notifies other minors of the plurality of minors to stop generating the response token, the response packet provided via the principal; and update the distributed ledger to include the authentication unit. ### Claim 16 (depends on 15) The system of claim 15 wherein the networked minors include the distributed ledger. ### Claim 17 (depends on 16) The system of claim 16 wherein the distributed ledger is a blockchain on the networked minors. ### Claim 18 (depends on 17) The system of claim 17 wherein the blockchain is implemented on a blockchain as a service cloud service. ### Claim 19 (depends on 15) The system of claim 15 wherein the networked minors include the voted principal.