# US 9,521,119 B2 · Extensible access control architecture > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,521,119 B2 - Document ID: US9521119B2 - Status: Granted - Kind: B2 - Application number: 14/883,332 - Filed: 2015-10-14 - Published: 2016-02-04 - Granted: 2016-12-13 - Earliest claimed: 2005-07-08 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Anthony M. Leibovitz; Mark C. Schurman; Mudit Goel; Paul G. Mayfield; Sudhakar Pasupuleti; Taroon Mandhana; Vivek P. Kamath; Wei Zheng; Xuemei Bao - Web page: https://patentgrep.com/patent/US9521119B2 ## CPC - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/0281: {Proxies} - H04L 63/105: {Multiple levels of security} - H04L 63/162: {at the data link layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Software for managing access control functions in a network. The software includes a host that receives access control commands or information and calls one or more methods. The methods perform access control functions and communicate access control results or messages to be transmitted. The host may be installed in a network peer seeking access to the network or in a server controlling access to the network. When installed in a peer, the host receives commands and exchanges information with a supplicant. When installed in an access control server, the host receives commands and exchanges information with an authenticator. The host has a flexible architecture that enables multiple features, such as allowing the same methods to be used for authentication by multiple supplicants, providing ready integration of third party access control software, simplifying network maintenance by facilitating upgrades of authenticator software and enabling access control functions other than peer authentication. ## Claims ### Claim 1 A method comprising: receiving, by a second process of a computing device across a process boundary from a first process, a message that is part of an access control exchange; and invoking, by a proxy manager of the second process in response to the receiving and across another process boundary, a access method in a third process where the invoked access method performs at least a portion of the access control exchange. ### Claim 2 (depends on 1) The method of claim 1 where the access method is a third-party access method relative to the proxy manager. ### Claim 3 (depends on 2) The method of claim 2 where a reliability of the third-party access method is not ascertained to be executed as part of the second process. ### Claim 4 (depends on 2) The method of claim 2 where the third-party access method comprises an extensible authenticating protocol (“EAP”) interface that is directly compatible with an EAP application programming interface utilized by the second process. ### Claim 5 (depends on 1) The method of claim 1 where the access method is a legacy third-party access method. ### Claim 6 (depends on 5) The method of claim 5 where the legacy third-party access method comprises a legacy interface that is not directly compatible with an EAP application programming interface (“API”) utilized by the second process. ### Claim 7 (depends on 6) The method of claim 6, the method further comprising translating, in the third process, between the legacy interface and the EAP API. ### Claim 8 A computing device comprising: at least one processor; memory coupled to the at least one processor; a second process configured to receive, across a process boundary from a first process, a message that is part of an access control exchange; and a proxy manager of the second process configured to invoke, in response to the receiving and across another process boundary, a access method in a third process where the invoked access method performs at least a portion of the access control exchange. ### Claim 9 (depends on 8) The computing device of claim 8 where the access method is a third-party access method relative to the proxy manager. ### Claim 10 (depends on 9) The computing device of claim 9 where a reliability of the third-party access method is not ascertained to be executed as part of the second process. ### Claim 11 (depends on 9) The computing device of claim 9 where the third-party access method comprises an extensible authenticating protocol (“EAP”) interface that is directly compatible with an EAP application programming interface utilized by the second process. ### Claim 12 (depends on 8) The computing device of claim 8 where the access method is a legacy third-party access method. ### Claim 13 (depends on 12) The computing device of claim 12 where the legacy third-party access method comprises a legacy interface that is not directly compatible with an EAP application programming interface (“API”) utilized by the second process. ### Claim 14 (depends on 13) The computing device of claim 13, the third process comprising a translator configured to translate, in the third process, between the legacy interface and the EAP API. ### Claim 15 At least one computer storage device comprising: memory that comprises computer-executable instructions that, based on execution by a computing device, configure the computing device to perform actions comprising: receiving, by a second process of a computing device across a process boundary from a first process, a message that is part of an access control exchange; and invoking, by a proxy manager of the second process in response to the receiving and across another process boundary, a access method in a third process where the invoked access method performs at least a portion of the access control exchange. ### Claim 16 (depends on 15) The at least one computer storage device of claim 15 where the access method is a third-party access method relative to the proxy manager. ### Claim 17 (depends on 16) The at least one computer storage device of claim 16 where a reliability of the third-party access method is not ascertained to be executed as part of the second process. ### Claim 18 (depends on 16) The at least one computer storage device of claim 16 where the third-party access method comprises an extensible authenticating protocol (“EAP”) interface that is directly compatible with an EAP application programming interface utilized by the second process. ### Claim 19 (depends on 15) The at least one computer storage device of claim 15 where the access method is a legacy third-party access method. ### Claim 20 (depends on 19) The at least one computer storage device of claim 19 where the legacy third-party access method comprises a legacy interface that is not directly compatible with an EAP application programming interface (“API”) utilized by the second process.