Composite SID Encoding for Disjoint Active Directory Domains
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional computing systems running in Microsoft Windows environments face challenges in supporting multiple disjoint Active Directory domains and alternative authentication schemes, where the uniqueness of Security Identifiers (SIDs) cannot be assumed, requiring a mechanism to extend SID-based systems without extensive modifications.
Innovation Solution
The solution involves transforming original SIDs into composite SIDs by modifying the SID structure to include an SID format value, a pointer or customer number, and adjusting the sub-authority count, allowing the use of SIDs as unique identifiers in diverse environments while supporting non-SID tokens like SAML tokens, without altering existing SID-based systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If conventional SIDs are used in Windows environments, then SID-based authentication works reliably, but the system cannot support multiple disjoint Active Directory domains and alternative authentication schemes
Solution Approach 1:
The patent segments the SID structure into distinct components: a format indicator field that identifies the SID type, and separate data fields for different authentication schemes. This allows the system to maintain standard SIDs for traditional Windows authentication while embedding alternative authentication data (such as SAML tokens or customer numbers) in extended fields, thereby supporting multiple authentication schemes without compromising SID uniqueness within each domain
Solution Approach 2:
The patent embeds additional authentication data within the SID structure itself, creating a nested information hierarchy. The format indicator field contains metadata about the SID type, while extended fields contain customer numbers, pointers, or other authentication-related data. This nesting allows conventional SID processing to continue unchanged while enabling alternative authentication schemes through the embedded data layers
2Adaptability or versatility
If the SID structure is modified to support additional authentication data, then versatility improves, but compatibility with existing SID-based systems may be compromised
Solution Approach 1:
The patent applies local quality by making the extended SID format optional and context-dependent. The format indicator field allows systems to identify whether a SID contains extended information, enabling selective processing. Existing systems that encounter extended SIDs can ignore the additional fields or route them to specialized handlers, while maintaining full compatibility with standard SIDs. This localized enhancement allows disjoint Active Directory domains to be supported without forcing changes on existing SID-based systems
Solution Approach 2:
The patent introduces a format indicator field as an intermediary that mediates between conventional and extended SID formats. This intermediary element allows the system to seamlessly transition between standard and extended formats, enabling compatibility with existing SID-based systems while supporting new authentication schemes. The format indicator acts as a signaling mechanism that allows existing systems to process extended SIDs without fundamental changes to their SID handling logic
Data Source
AI summary
Systems and methods for operating a computing system. The methods comprise: obtaining, by a first computing device, an original Security Identifier (“SID”); transforming, by the first computing device, the original SID into a composite SID by modifying the original SID to include at least (a) an SID format value indicating a structural format of an SID and (b) a pointer specifying a memory location at which non-SID authentication information is stored or a customer number indicating an entity to which a user is associated; and using the composite SID by the first computing device during SID based operation.