US6915437B2
Expired / Lapsed
US
⏱️ 0.0 years remaining
System and method for improved network security
Assignee: Microsoft Technology Licensing LLC
•
Filing: 2000-12-20
•
Granted: 2005-07-05
•
Expires: 2020-12-20
Abstract
Abstract A system is provided for establishing a secure link among multiple users on a single machine with a remote machine. The system includes a subsystem to filter traffic so that traffic from each user is separate. The subsystem generates and associates a Security Association (SA) with at least one filter corresponding to the user and the traffic, and employs the SA to establish the secure link. An Internet Key Exchange module and a policy module may be included to generate and associate the security association, wherein the policy module is configured via Internet Protocol Security (IPSEC).
Inventors
- 👤 Brian D. Swander
- 👤 Bernard D. Aboba
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-30 02:48
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0227; H04L63/0236; H04L63/06; H04L63/061; H04L63/16; H04L63/164; H04L63/08
Claims Analysis
Total Claims: 41
Claim 1
Independent Claim
116 words
A system of establishing a secure link among multiple users on a single machine with a remote machine, comprising: a subsystem to filter traffic so that traffic from each user is separate, the subsystem comprising an Internet Key Exchange (IKE) module and a policy module, the IKE module adapted to provide User Mode negotiations in order to establish a secure link among users wherein the User Mode negotiations utilize keying material derived from Main Mode negotiations in order to provide the secure link among users; wherein the subsystem generates and associates a Security Association (SA) with at least one fitter corresponding to the user and the traffic and employs the SA to establish the secure link.
Claim 2
Independent Claim
116 words
A system of establishing a secure link among multiple users on a single machine with a remote machine, comprising: a subsystem to filter traffic so that traffic from each user is separate, the subsystem comprising an Internet Key Exchange (IKE) module and a policy module, the IKE module adapted to provide User Mode negotiations in order to establish a secure link among users wherein the User Mode negotiations utilize keying material derived from Main Mode negotiations in order to provide the secure link among users; wherein the subsystem generates and associates a Security Association (SA) with at least one fitter corresponding to the user and the traffic and employs the SA to establish the secure link.
Claim 3
Dependent Claim
11 words
The system of claim 1 being located on the single machine.
Claim 4
Dependent Claim
11 words
The system of claim 1 being located on the remote machine.
Claim 5
Dependent Claim
17 words
The system of claim 1 , wherein the policy module is configured via Internet Protocol Security (IPSEC).
Claim 6
Dependent Claim
28 words
The system of claim 4 , wherein filters are provided from the policy module in order to filter traffic associated with the single machine and the remote machine.
Claim 7
Dependent Claim
21 words
The system of claim 5 , wherein the single machine filter is associated with a communications port on the single machine.
Claim 8
Dependent Claim
23 words
The system of claim 6 , wherein the remote machine determines filters dynamically to communicate with the filters associated with the single machine.
Claim 9
Dependent Claim
26 words
The system of claim 1 , wherein the User Mode enables a plurality of Quick Mode negotiations in order to provide the secure link among users.
Claim 10
Dependent Claim
39 words
The system of claim 1 , wherein the User Mode negotiation further comprises an initiator packet including at least one of a user identification initiator, a security association attribute, a nonce initiator, a proxy source, and a proxy destination.
Claim 11
Dependent Claim
16 words
The system of claim 1 , wherein the initiator packet further comprises a user identification responds.
Claim 12
Dependent Claim
33 words
The system of claim 1 , wherein the User Mode negotiation further comprises a responder packet including at least one of a user identification responder, a security association attribute, and a nonce responder.
Claim 13
Dependent Claim
23 words
The system of claim 1 , wherein the User Mode enables a plurality of authentication packets to be sent to authenticate among users.
Claim 14
Dependent Claim
27 words
The system of claim 1 , wherein the IKE module is adapted to provide User Mode negotiations in order to establish a secure link between the services.
Claim 15
Dependent Claim
39 words
The system of claim 13 , wherein the User Mode negotiation further comprises an initiator packet including at least one of a user identification initiator, a security association attribute, a nonce initiator, a proxy source, and a proxy destination.
Claim 16
Dependent Claim
29 words
The system of claim 14 , wherein multiple services are authenticated on the second machine by utilizing a policy look-up associated with service information relating to the initiator packet.
Claim 17
Dependent Claim
21 words
The system of claim 14 , wherein if a multiple service authentication fails, the second machine initiates a User Mode negotiation.
Claim 18
Independent Claim
113 words
A system of establishing a secure link between a first machine and multiple services on a second machine, comprising: a subsystem to filter traffic so that traffic from each service is separate, the subsystem comprising a policy module and an Internet Key Exchange (IKE) module adapted to provide User Mode negotiations in order to establish a secure link among users wherein the User Mode negotiations utilize keying material derived from Main Mode negotiations in order to provide the secure link among users; wherein the subsystem generates and associates a Security Association (SA) with at least one filter corresponding to the user and the service and employs the SA to establish the secure link.
Claim 19
Independent Claim
113 words
A system of establishing a secure link between a first machine and multiple services on a second machine, comprising: a subsystem to filter traffic so that traffic from each service is separate, the subsystem comprising a policy module and an Internet Key Exchange (IKE) module adapted to provide User Mode negotiations in order to establish a secure link among users wherein the User Mode negotiations utilize keying material derived from Main Mode negotiations in order to provide the secure link among users; wherein the subsystem generates and associates a Security Association (SA) with at least one filter corresponding to the user and the service and employs the SA to establish the secure link.
Claim 20
Dependent Claim
27 words
The system of claim 17 , wherein the subsystem further comprises an Internet Key Exchange module and a policy module to generate and associate the security association.
Claim 21
Dependent Claim
17 words
The system of claim 18 , wherein the policy module is configured via Internet Protocol Security (IPSEC).
Claim 22
Dependent Claim
28 words
The system of claim 19 , wherein filters are provided from the policy module is order to filter traffic associated with the first machine and the second machine.
Claim 23
Dependent Claim
21 words
The system of claim 20 , wherein the first machine filter is associated with a communications port on the first machine.
Claim 24
Dependent Claim
23 words
The system of claim 21 , wherein the second machine determines filters dynamically to communicate with the filters associated with the first machine.
Claim 25
Independent Claim
107 words
A method of establishing a secure link among multiple users on a single machine with a remote machine, comprising the steps of: filtering traffic so that traffic from each user is separate; utilizing an Internet Key Exchange (IKE) module and a policy module, the IKE module providing User Mode negotiations to establish a secure link among users wherein the User Mode negotiations utilize keying material derived from Main Mode negotiations in order to provide the secure link among users; negotiating and authenticating a Security Association (SA) with at least one filter corresponding to the user and the traffic; and employing the SA to establish the secure link.
Claim 26
Independent Claim
107 words
A method of establishing a secure link among multiple users on a single machine with a remote machine, comprising the steps of: filtering traffic so that traffic from each user is separate; utilizing an Internet Key Exchange (IKE) module and a policy module, the IKE module providing User Mode negotiations to establish a secure link among users wherein the User Mode negotiations utilize keying material derived from Main Mode negotiations in order to provide the secure link among users; negotiating and authenticating a Security Association (SA) with at least one filter corresponding to the user and the traffic; and employing the SA to establish the secure link.
Claim 27
Independent Claim
105 words
A method of establishing a secure link between a first machine and multiple services on a second machine, comprising the steps of: filtering traffic so that traffic from each service is separate; employing a policy module and an Internet Key Exchange (IKE) module to provide User Mode negotiations to establish a source link among users wherein the User Mode negotiations utilize keying material derived from Main Mode negotiations in order to provide the secure link among users; negotiating and authenticating a Security Association (SA) with at least one filter corresponding to the services and the traffic; and employing the SA to establish the secure link.
Claim 28
Independent Claim
105 words
A method of establishing a secure link between a first machine and multiple services on a second machine, comprising the steps of: filtering traffic so that traffic from each service is separate; employing a policy module and an Internet Key Exchange (IKE) module to provide User Mode negotiations to establish a source link among users wherein the User Mode negotiations utilize keying material derived from Main Mode negotiations in order to provide the secure link among users; negotiating and authenticating a Security Association (SA) with at least one filter corresponding to the services and the traffic; and employing the SA to establish the secure link.
Claim 29
Independent Claim
111 words
A system for establishing a secure link among multiple users on a single machine with a remote machine, comprising: means for filtering traffic so that traffic from each user is separate; means for utilizing a policy module and an Internet Key Exchange (IKE) module adapted to provide User Mode negotiations in establishing a secure link among users wherein the User Mode negotiations utilize keying material derived from Main Mode negotiations in order to provide the secure link among users; means for negotiating and authenticating a Security Association (SA) with at least one filter corresponding to the user and the traffic; and means for employing the SA to establish the secure link.
Claim 30
Independent Claim
111 words
A system for establishing a secure link among multiple users on a single machine with a remote machine, comprising: means for filtering traffic so that traffic from each user is separate; means for utilizing a policy module and an Internet Key Exchange (IKE) module adapted to provide User Mode negotiations in establishing a secure link among users wherein the User Mode negotiations utilize keying material derived from Main Mode negotiations in order to provide the secure link among users; means for negotiating and authenticating a Security Association (SA) with at least one filter corresponding to the user and the traffic; and means for employing the SA to establish the secure link.
Claim 31
Independent Claim
110 words
A system of establishing a secure link between a first machine and multiple services on a second machine, comprising: means for filtering traffic so that traffic from each service is separate; means for employing a policy module and an Internet Key Exchange (IKE) module to provide User Mode negotiations to establish a secure link among users wherein the User Mode negotiations utilize keying material derived from Main Mode negotiations in order to provide the secure link among users; means for negotiating and authenticating a Security Association (SA) with at least one filter corresponding to the services and the traffic and means for employing the SA to establish the secure link.
Claim 32
Independent Claim
110 words
A system of establishing a secure link between a first machine and multiple services on a second machine, comprising: means for filtering traffic so that traffic from each service is separate; means for employing a policy module and an Internet Key Exchange (IKE) module to provide User Mode negotiations to establish a secure link among users wherein the User Mode negotiations utilize keying material derived from Main Mode negotiations in order to provide the secure link among users; means for negotiating and authenticating a Security Association (SA) with at least one filter corresponding to the services and the traffic and means for employing the SA to establish the secure link.
Claim 33
Dependent Claim
135 words
A computer readable medium having stored thereon computer executable components, comprising: a component to filter traffic between a first machine, having multiple users, and a second machine so that traffic for the first machine is separated in accordance with the respective users; and a component to generate and associate a Security Association (SA) with at least one filter, corresponding to at least one of the user end the respective traffic, and employs the SA to establish a secure link between the first and second machines, the component employing a policy module and an Internet Key Exchange (IKE) module adapted to provide User Mode negotiations in order to establish a secure link among users wherein the User Mode negotiations utilize keying material derived from Main Mode negotiations in order to provide the secure link among users.
Claim 34
Dependent Claim
135 words
A computer readable medium having stored thereon computer executable components, comprising: a component to filter traffic between a first machine, having multiple users, and a second machine so that traffic for the first machine is separated in accordance with the respective users; and a component to generate and associate a Security Association (SA) with at least one filter, corresponding to at least one of the user end the respective traffic, and employs the SA to establish a secure link between the first and second machines, the component employing a policy module and an Internet Key Exchange (IKE) module adapted to provide User Mode negotiations in order to establish a secure link among users wherein the User Mode negotiations utilize keying material derived from Main Mode negotiations in order to provide the secure link among users.
Claim 35
Dependent Claim
141 words
A data packet adapted to be transmitted between at least two processes, comprising: a first component to filter traffic between a first process, associated with multiple users, and a second process so that traffic for the first process is separated in accordance with the respective users; and a second component to generate and associate a Security Association (SA) with at least one filter, corresponding to at least one of the users and the respective traffic, and employs the SA to establish a secure link between the first and second processes, the second component utilizing a policy module and an Internet Key Exchange (IKE) module adapted to provide User Mode negotiations in order to establish a secure link among users wherein the User Mode negotiations utilize keying material derived from Main Mode negotiations in order to provide the secure link among users.
Claim 36
Dependent Claim
141 words
A data packet adapted to be transmitted between at least two processes, comprising: a first component to filter traffic between a first process, associated with multiple users, and a second process so that traffic for the first process is separated in accordance with the respective users; and a second component to generate and associate a Security Association (SA) with at least one filter, corresponding to at least one of the users and the respective traffic, and employs the SA to establish a secure link between the first and second processes, the second component utilizing a policy module and an Internet Key Exchange (IKE) module adapted to provide User Mode negotiations in order to establish a secure link among users wherein the User Mode negotiations utilize keying material derived from Main Mode negotiations in order to provide the secure link among users.
Claim 37
Dependent Claim
136 words
A computer readable medium having stored thereon computer executable components, comprising: a component to fiber traffic between a first machine, having multiple services, and a second machine so that traffic for the first machine is separated in accordance with the respective services; and a component to generate and associate a Security Association (SA) with at least one filter, corresponding to at least one of the services and the respective traffic, and employs the SA to establish a secure link between the first and second machines, the component further comprising a policy module and an Internet Key Exchange (IKE) module adapted to provide User Mode negotiations in order to establish a secure link among users wherein the User Mode negotiations utilize keying material derived from Main Mode negotiations in order to provide the secure link among users.
Claim 38
Dependent Claim
136 words
A computer readable medium having stored thereon computer executable components, comprising: a component to fiber traffic between a first machine, having multiple services, and a second machine so that traffic for the first machine is separated in accordance with the respective services; and a component to generate and associate a Security Association (SA) with at least one filter, corresponding to at least one of the services and the respective traffic, and employs the SA to establish a secure link between the first and second machines, the component further comprising a policy module and an Internet Key Exchange (IKE) module adapted to provide User Mode negotiations in order to establish a secure link among users wherein the User Mode negotiations utilize keying material derived from Main Mode negotiations in order to provide the secure link among users.
Claim 39
Dependent Claim
140 words
A data packet adapted to be transmitted between at least two processes, comprising: a first component to filter traffic between a first process, associated with multiple services, and a second process so that traffic for the first process is separated in accordance with the respective services; and a second component to generate and associate a Security Association (SA) with at least one filter, corresponding to at least one of the services and the respective traffic, and employs the SA to establish a secure link between the first and second processes, the second component including a policy module and an Internet Key Exchange (IKE) adapted to provide User Mode negotiations in order to establish a secure link among users wherein the User Mode negotiations utilize keying material derived from Main Mode negotiations in order to provide the secure link among users.
Claim 40
Dependent Claim
140 words
A data packet adapted to be transmitted between at least two processes, comprising: a first component to filter traffic between a first process, associated with multiple services, and a second process so that traffic for the first process is separated in accordance with the respective services; and a second component to generate and associate a Security Association (SA) with at least one filter, corresponding to at least one of the services and the respective traffic, and employs the SA to establish a secure link between the first and second processes, the second component including a policy module and an Internet Key Exchange (IKE) adapted to provide User Mode negotiations in order to establish a secure link among users wherein the User Mode negotiations utilize keying material derived from Main Mode negotiations in order to provide the secure link among users.
Claim 41
Dependent Claim
21 words
The data packet of claim 30 , wherein at least one of the processes is executed by a distributed processing system.
References Cited (Backward Citations)
US5835726A
Cited
US6055236A
Cited
US6253321B1
Cited
US6330562B1
Cited
US6636898B1
Cited
US6738909B1
Cited
US6539483B1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2008-07-04 | 2009-01-03 | 2009-07-05 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2012-07-04 | 2013-01-03 | 2013-07-05 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2016-07-04 | 2017-01-03 | 2017-07-05 | $7700.00 | Window Closed / Lapsed |