The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.
The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.
Patent No.:
Date of Patent:
Mar. 22, 2011
Filed:
May. 26, 2006
Gennady Medvinsky, Redmond, WA (US);
Cristian Ilac, Sammamish, WA (US);
Costin Hagiu, Sammamish, WA (US);
John E. Parsons, Sammamish, WA (US);
Mohamed Emad El Din Fathalla, Sammamish, WA (US);
Paul J. Leach, Seattle, WA (US);
Tarek Bahaa El-din Mahmoud Kamel, Issaquah, WA (US);
Gennady Medvinsky, Redmond, WA (US);
Cristian Ilac, Sammamish, WA (US);
Costin Hagiu, Sammamish, WA (US);
John E. Parsons, Sammamish, WA (US);
Mohamed Emad El Din Fathalla, Sammamish, WA (US);
Paul J. Leach, Seattle, WA (US);
Tarek Bahaa El-Din Mahmoud Kamel, Issaquah, WA (US);
Microsoft Corporation, Redmond, WA (US);
Abstract
A credential security support provider (Cred SSP) is provided that enables any application to securely delegate a user's credentials from the client, via client side Security Support Provider (SSP) software, to a target server, via server side SSP software in a networked computing environment. The Cred SSP of the invention provides a secure solution that is based in part upon a set of policies, including a default policy that is secure against a broad range of attacks, which are used to control and restrict the delegation of user credentials from a client to a server. The policies can be for any type of user credentials and the different policies are designed to mitigate a broad range of attacks so that appropriate delegation can occur for given delegation circumstances, network conditions, trust levels, etc. Additionally, only a trusted subsystem, e.g., a trusted subsystem of the Local Security Authority (LSA), has access to the clear text credentials such that neither the calling application of the Cred SSP APIs on the server side nor the calling application of the Cred SSP APIs on the client side have access to clear text credentials.