Advanced security negotiation protocol
AssigneeMicrosoft Corporation
InventorsDave M. McPherson, Tanmoy Dutta, Cristian Ilac, Liqiang Zhu
Life of this patent
Estimating the term…
Abstract
This disclosure describes methods, systems and application programming interfaces for creating an advanced security negotiation package. This disclosure describes creating an advanced security negotiation protocol under a Simple and Protected Negotiation Mechanism (SPNEGO) protocol to negotiate an authentication scheme. The protocol describes defining a Windows Security Type (WST) Library message to protect negotiation data during the advanced security negotiation protocol. The protocol sends an initial message that carries multiple authentication messages to reduce redundant roundtrips and implements key exchanges by a mini Security Support Provider (SSP).
Claims19
A method for creating an advanced security negotiation package, implemented at least in part by a computing device, the method comprising:
- creating an advanced security negotiation protocol under a Simple and Protected Negotiation Mechanism (SPNEGO) protocol, the advanced security negotiation protocol negotiates an authentication scheme;
- defining a message to protect negotiation data during the advanced security negotiation protocol, the message includes a fixed length header and a variable length payload;
- generating an initial message including multiple authentication messages to reduce redundant roundtrips alongside a list of supported authentication schemes;
- generating a per-message token to allow for a flexible plug-in architecture for each of the multiple authentication messages and if a token fails to generate for one or more of the multiple authentication messages, removing the one or more authentication messages from the list of supported authentication schemes;
- sending the initial message with trust roots and certificate verification associated with the computing device, a selection of a first one of the multiple authentication messages based on the trust roots and certificate verification;
- receiving a selection of a second one of the multiple authentication messages based on the trust roots and certification, the second one of the multiple authentication messages to replace the first one of the multiple authentication messages;
- and
- implementing key exchanges by a mini Security Support Provider (SSP).
A system for synchronization, the system comprising:
- a processor;
- a memory coupled to the processor, wherein the processor is configured for:
- receiving requests to begin a conversation between a client and a server;
- defining an advanced security negotiation protocol under a Simple and Protected Negotiation Mechanism (SPNEGO) protocol, the advanced security negotiation protocol negotiates a first authentication scheme;
- selecting the first authentication scheme to utilize as a negotiation package from a plurality of authentication schemes supported by both the client and the server;
- using a message type to protect negotiation data during the advanced security negotiation protocol, each message of the message type including a fixed length header and a variable length payload;
- sending an initial message that carries multiple authentication messages to reduce redundant roundtrips, each of the multiple authentication messages being of the message type;
- and
- allowing the client or the server to select a second authentication scheme from among the plurality of authentication schemes supported by both the client and the server during negotiation and wherein when the second authentication scheme is selected, preventing the first authentication scheme from being used again in the conversation.
A computer-readable storage device comprising computer-readable instructions executed on a computing device, the computer-readable instructions comprising instructions for:
- creating an advanced security negotiation package under a Simple and Protected Negotiation Mechanism (SPNEGO) protocol, the advanced security negotiation package negotiates an authentication scheme by using a security protocol;
- defining a message to protect negotiation data during the advanced security negotiation protocol;
- minimizing redundant roundtrips by having an initial message carry multiple authentication schemes;
- sending the initial message with a selection of a first one of the multiple authentication schemes;
- receiving a selection of a second one of the multiple authentication schemes, the second one of the multiple authentication schemes to replace the first one of the multiple authentication schemes, and wherein when the second authentication scheme is selected, preventing the first authentication scheme from being used again;
- and
- concatenating a set of meta-data messages as a follow up message to the initial message.
Dependencies are inferred from the claim text.