US 8,286,223 B2Granted

Extensible access control architecture

AssigneeMicrosoft Corporation

InventorsAnthony M. Leibovitz, Mark C. Schurman, Mudit Goel, Paul G. Mayfield, Sudhakar Pasupuleti, Taroon Mandhana, Vivek P. Kamath, Wei Zheng, Xuemei Bao

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

Software for managing access control functions in a network. The software includes a host that receives access control commands or information and calls one or more methods. The methods perform access control functions and communicate access control results or messages to be transmitted. The host may be installed in a network peer seeking access to the network or in a server controlling access to the network. When installed in a peer, the host receives commands and exchanges information with a supplicant. When installed in an access control server, the host receives commands and exchanges information with an authenticator. The host has a flexible architecture that enables multiple features, such as allowing the same methods to be used for authentication by multiple supplicants, providing ready integration of third party access control software, simplifying network maintenance by facilitating upgrades of authenticator software and enabling access control functions other than peer authentication.

Claims20

Dependent claims

A method of operating access control software, comprising:

with a computing device having at least one processor that implements a plurality of processes on the computing device, including a first process and a second process within which computer-executable components are executed, performing acts in the computing device, the acts comprising:
with host software executing within the first process, receiving a message forming a portion of an access control interaction and selecting a method component to execute a function of the access control interaction based on the message;
selectively accessing the selected method component with a proxy based on the nature of the selected method component, the selectively accessing comprising:
when the selected method component is executable within the first process, placing a call to the selected method component through an intra-process interface within the first process;
when the selected method component is not executable within the first process:
placing a call to the proxy component executing within the first process through the intra-process interface;
with the proxy component, communicating with the selected method component across an inter-process interface between the first process and the second process;
and
executing a function of the access control interaction with the selected method component in the second process.

6 more elements

At least one computer storage device storing computer-executable instructions that, when executed by a computing device, cause the computing device to implement a plurality of processes, including a first process and a second process, and to perform acts comprising:

with host software executing within the first process, receiving a message forming a portion of an access control interaction and selecting a method component to execute a function of the access control interaction based on the message;
selectively accessing the selected method component with a proxy based on the nature of the selected method component, the selectively accessing comprising:
when the selected method component is executable within the first process, placing a call to the selected method component through an intra-process interface within the first process;
when the selected method component is not executable within the first process:
placing a call to the proxy component executing within the first process through the intra-process interface;
with the proxy component, communicating with the selected method component across an inter-process interface between the first process and the second process;
and
executing a function of the access control interaction with the selected method component in the second process.

5 more elements

A system comprising:

a computing device having at least one processor configured to implement a plurality of processes on the computing device, including a first process and a second process within which computer-executable components are executed that configure the computing device to perform acts comprising:
with host software executing within the first process, receiving a message forming a portion of an access control interaction and selecting a method component to execute a function of the access control interaction based on the message;
selectively accessing the selected method component with a proxy based on the nature of the selected method component, the selectively accessing comprising:
when the selected method component is executable within the first process, placing a call to the selected method component through an intra-process interface within the first process;
when the selected method component is not executable within the first process:
placing a call to the proxy component executing within the first process through the intra-process interface;
with the proxy component, communicating with the selected method component across an inter-process interface between the first process and the second process;
and
executing a function of the access control interaction with the selected method component in the second process.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 11/177,757Filed 8 Jul 2005
Published: US 2007/0016939 A118 Jan 2007
Granted: 9 Oct 2012
Term ends: Not estimatedThe source records don’t support an estimate.

Classification5 codes

H04L 63/08
Network architectures or network communication protocols for network security: for authentication of entities
H04L 63/0281
For separating internal from external traffic, e.g. firewalls: proxies
H04L 63/105
For controlling access to devices or network resources: multiple levels of security
H04L 63/162
Implementing security features at a particular protocol layer: at the data link layer