“I’ve had the privilege to work for Nate for the last 3 years. He is truly a distinguished engineer. He is smart, humble, and an outstanding teacher. His ability to explain complex ideas in simple ways are exceptional. He guides development without being overbearing or second-guessing the techniques for arriving at the goal. On one hand, Nate is like a machine, so efficient and so insanely capable of processing huge amounts of information and ideas. But he is also one of the most approachable people that I have had the pleasure of working with and being guided by. Thanks Nate for always being there behind the scenes, I got to learn a lot from you! I would welcome any opportunity to work with Nate again.”
North Bend, Washington, United States
Contact Info
920 followers
500+ connections
North Bend, Washington, United States
Contact Info
920 followers
500+ connections
About
Nate has been in the identity, security and network space for over 20 years, has authored…
Experience & Education
-
Delinea
View Nathaniel’s full experience
See their title, tenure and more.
or
Volunteer Experience
-
Advisor
PLU CSCE Industry Advisory Board
- Present 13 years
Science and Technology
-
U7 Coach
Snoqualmie Valley Youth Soccer Association
- 1 year
Children
-
Publications
-
The Definitive Guide to Linux Network Programming
Apress
The Definitive Guide to Linux Network Programming offers a clear, concise treatment of creating clients and servers under the Linux operating system.
Other authors -
-
PAM-like Authentication for Windows Clients
Sys Admin Magazine
Most derivatives of UNIX come with support for Pluggable Authentication Modules (PAM). UNIX boxes can authenticate users in a multitude of ways with PAM. However, if you put a machine running Microsoft Windows NT/2K/XP into the same authentication framework, you will encounter problems. The solutions currently available range from emulation of a domain controller with Samba, to various scripts and back-ends that replicate account information between heterogeneous hosts. This article discusses…
Most derivatives of UNIX come with support for Pluggable Authentication Modules (PAM). UNIX boxes can authenticate users in a multitude of ways with PAM. However, if you put a machine running Microsoft Windows NT/2K/XP into the same authentication framework, you will encounter problems. The solutions currently available range from emulation of a domain controller with Samba, to various scripts and back-ends that replicate account information between heterogeneous hosts. This article discusses a new approach to solving this problem.
Patents
-
Method and apparatus for securely managing computer process access to network resources through delegated system credentials
Issued US-11706209-B2
See patentA system and method for granting access to network resources through access credentials given to an agent process running on each computer or machine where resource requesters reside. The system extends a traditional token-granting authorization system to the agent processes where each agent has administrative access to machine information. The agent uses that access to acquire detailed information about resource requesters. Requester qualifications defined by the system limit requester access…
A system and method for granting access to network resources through access credentials given to an agent process running on each computer or machine where resource requesters reside. The system extends a traditional token-granting authorization system to the agent processes where each agent has administrative access to machine information. The agent uses that access to acquire detailed information about resource requesters. Requester qualifications defined by the system limit requester access to resources. and are enforced both by the agent and by the central system on the network resource server. Resource requesters ask for a token for resource use from the agent not the central system. The agent uses its credentials to get a token from the central system and then return the token to qualified requesters.
-
Method and apparatus for providing secure internal directory service for hosted services
Issued US-11750561-B2
A system and method for providing secure access to an organization's internal directory service from external hosted services. The system includes a remote directory service configured to accept directory service queries from an application running on hosted services. The remote directory service passes the queries to a directory service proxy server inside a firewall of the organization via a secure rendezvous service. The directory service proxy server passes the queries to the internal…
A system and method for providing secure access to an organization's internal directory service from external hosted services. The system includes a remote directory service configured to accept directory service queries from an application running on hosted services. The remote directory service passes the queries to a directory service proxy server inside a firewall of the organization via a secure rendezvous service. The directory service proxy server passes the queries to the internal directory service inside said firewall. Request responses from the internal directory service pass through the directory service proxy server to the remote directory service through said firewall via the secure rendezvous service. The remote directory servicer returns the response to the requesting application.
Other inventors -
-
Zero Sign-On Using a Web Browser
Issued US-10587603-B2
Method for enabling zero sign-on (ZSO) through a standard web browser. The device running the browser is first enrolled with a web service using an installed enrollment agent on the device which authenticates a user of the device. After authentication, the enrollment agent stores a device profile that includes a user certificate for the user and an authority certificate issued by said web service. The device profile is stored at a device location accessible by each of the web browsers used by…
Method for enabling zero sign-on (ZSO) through a standard web browser. The device running the browser is first enrolled with a web service using an installed enrollment agent on the device which authenticates a user of the device. After authentication, the enrollment agent stores a device profile that includes a user certificate for the user and an authority certificate issued by said web service. The device profile is stored at a device location accessible by each of the web browsers used by said device. The enrollment agent configures each of the web browsers on the device to respond correctly to ZSO certificate challenges from the web service. Once enrolled, the device's web browsers can respond correctly to a ZSO Uniform Resource Locator (URL) certificate challenge received from the web service. After a successful response to the challenge, the browser is granted a secure socket layer (SSL) connection.
Other inventors -
-
Method and apparatus for creating switchable desktops with separate authorizations
Issued US 9977883B2
A system and method for creating switchable desktops each with its own authorization. The system provides a custom authentication and authorization data store that defines permission sets called roles, and lists which roles each user may assume. The system also provides a custom virtual desktop manager that creates new virtual desktops using the permissions defined by roles allowed for each user. When a user requests a new virtual desktop and role from the desktop manager, the manager requests…
A system and method for creating switchable desktops each with its own authorization. The system provides a custom authentication and authorization data store that defines permission sets called roles, and lists which roles each user may assume. The system also provides a custom virtual desktop manager that creates new virtual desktops using the permissions defined by roles allowed for each user. When a user requests a new virtual desktop and role from the desktop manager, the manager requests new virtual desktop components from the operating system. The desktop manager intercepts a request by the operating system to the Local Security Authority module for permissions to grant the new virtual desktop. The manager substitutes the user's requested role permissions (if the user may assume the rule) for the permissions granted by the LSA module. The LSA module and operating system grant those role permissions to the user's activities in a newly created virtual desktop.
Other inventors -
-
Method and apparatus for creating switchable desktops with separate authorizations
Issued US 9378391B2
A system and method for creating switchable desktops each with its own authorization. The system provides a custom authentication and authorization data store that defines permission sets called roles, and lists which roles each user may assume. The system also provides a custom virtual desktop manager that creates new virtual desktops using the permissions defined by the roles. When a user requests a new virtual desktop and role from the desktop manager, the manager requests new virtual…
A system and method for creating switchable desktops each with its own authorization. The system provides a custom authentication and authorization data store that defines permission sets called roles, and lists which roles each user may assume. The system also provides a custom virtual desktop manager that creates new virtual desktops using the permissions defined by the roles. When a user requests a new virtual desktop and role from the desktop manager, the manager requests new virtual desktop components from the operating system. The desktop manager intercepts a request by the operating system to the Local Security Authority module for permissions to grant the new virtual desktop. The manager substitutes the user's requested role permissions for the permissions granted by the LSA module. The LSA module and operating system grant those role permissions in a newly created virtual desktop.
Other inventors -
-
Method and apparatus for creating conditional windows process tokens
Issued US 9197670B2
A system and method for taking control of process token creation in the Windows operating system to create conditional process tokens that define access to system resources for process running on a Windows computer. The system includes an LSA shim layer that intercepts standard Windows requests for authentication and authorization and an authentication agent that determines context for each request. A custom authentication and authorization (A&A) store determines authentication success and the…
A system and method for taking control of process token creation in the Windows operating system to create conditional process tokens that define access to system resources for process running on a Windows computer. The system includes an LSA shim layer that intercepts standard Windows requests for authentication and authorization and an authentication agent that determines context for each request. A custom authentication and authorization (A&A) store determines authentication success and the amount of authorization based on context and supplied credentials. Once the custom A&A store determines a successful log-on and defines authorization for the user, it passes the elements of authorization through the authentication agent to the LSA shim layer, which passes them on to the LSA module, which in turn uses them to request a Windows process token from the Windows kernel. The Windows kernel assigns the token to a user's session on the computer, defining the level of resource access available to processes the user launches.
Other inventors -
-
Method and apparatus for transmitting additional authorization data via GSSAPI
Issued US 9112846B2
A system and method for using a GSSAPI security token to transport additional non-GSSAPI data that includes authorization data used by third-party software. The system includes a hook that intercepts a client process's interactions with the GSSAPI. When a client process requests a security context from the GSSAPI, the hook intercepts the security token the GSSAPI provides for the client process. The hook checks to see if there is additional authorization data to transport, adds the additional…
A system and method for using a GSSAPI security token to transport additional non-GSSAPI data that includes authorization data used by third-party software. The system includes a hook that intercepts a client process's interactions with the GSSAPI. When a client process requests a security context from the GSSAPI, the hook intercepts the security token the GSSAPI provides for the client process. The hook checks to see if there is additional authorization data to transport, adds the additional data to the security token, then gives the token to the client process. The client process sends the security token to the server process, which submits the token to the GSSAPI for evaluation. A hook on this computer intercepts the security token, removes additional data added earlier, gives the added authorization data to a version of the third-party authorization software, then passes the now-unaltered security token to the server process which uses the security token to finish establishing a security context with the client process.
Other inventors -
Projects
-
XaC-Assist
See projectA combination of device and software, the XaC-Assist is an accessory for those who use the X-Box Adaptive Controller.
While the XaC is an amazing device, it can pose a couple of challenges for those using it in combination with an external Joystick, such as the Logitech Extreme 3D Pro. hese issues are:
-> Only old models of the 3D Pro are supported - specifically model # JUF17 - which is only available these days via E-Bay.
-> Games which expect axis movement of the…A combination of device and software, the XaC-Assist is an accessory for those who use the X-Box Adaptive Controller.
While the XaC is an amazing device, it can pose a couple of challenges for those using it in combination with an external Joystick, such as the Logitech Extreme 3D Pro. hese issues are:
-> Only old models of the 3D Pro are supported - specifically model # JUF17 - which is only available these days via E-Bay.
-> Games which expect axis movement of the joystick for things like selection (think card game) can be challenging for users with motor/muscle control challenges.
The XaC-Assist solves both of these with features like:
- Use any input joystick supported by the Linux kernel (including newer models of the 3D Pro)
- Re-map buttons on the external joystick (i.e. make the trigger look like A, or B etc)
- Re-map axes on the external joystick
- Ignore any / all buttons (avoid accidental clicks!)
- Ignore any / all axes (avoid accidental movement)
- Simulate axis movement to compensate for jitter (Reduce/remove accidental scroll, slide, or over-movement!) -
Nfw.Linux.FrameBuffer
See projectAn easy to use dotnet library for interacting with the Linux framebuffer interface (/dev/fbX), published to NuGet: https://www.nuget.org/packages/Nfw.Linux.FrameBuffer/
-
Nfw.Linux.Hid
See projectA convenient dotnet library for output HID keyboard and mouse events via /dev/hidX with USB Gadget on Linux, published to NuGet: https://www.nuget.org/packages/Nfw.Linux.Hid/
-
Nfw.Linux.Joystick
See projectA dotnet Joystick/Gamepad Library with generic support for the Linux input system and the /dev/input/js device(s), published to NuGet: https://www.nuget.org/packages/Nfw.Linux.Joystick
-
pGina
- Present
See projectpGina is a pluggable Open Source GINA and CredentialProvider replacement. This allows for alternate methods of interactive user authentication and access management on machines running the Windows operating system. In short, allow your windows users to login using the backend of your choice. Plugins are written in managed code and allow for user authentication, authorization and session management. End result is that you, the admin, can choose how your users are authenticated, authorized and…
pGina is a pluggable Open Source GINA and CredentialProvider replacement. This allows for alternate methods of interactive user authentication and access management on machines running the Windows operating system. In short, allow your windows users to login using the backend of your choice. Plugins are written in managed code and allow for user authentication, authorization and session management. End result is that you, the admin, can choose how your users are authenticated, authorized and managed. Already have users in LDAP? Want to manage your users with a MySQL database? Using a custom backend and want to craft your own authentication code? pGina is the solution.
Organizations
-
ACCU
Member
- Present -
ACM
Member
- Present
Recommendations received
11 people have recommended Nathaniel
Join now to viewPeople also viewed
Explore more posts
Explore collaborative articles
We’re unlocking community knowledge in a new way. Experts add insights directly into each article, started with the help of AI.
Explore MoreOthers named Nathaniel Yocom
-
Nathaniel Yocom
EX IT Manager at Grange Insurance Association
-
Nathaniel Yocom
IT Manager at Grange Insurance
2 others named Nathaniel Yocom are on LinkedIn
See others named Nathaniel Yocom