Patent ID: 7200869

Claim:
A computer-readable storage medium having computer-executable instructions for protecting network domain data against unauthorized modification in a distributed computer network having a plurality of network domains, comprising: receiving, at a first computing machine, a request to modify an object associated with a shared data structure of a data store, wherein the data structure is replicated on the plurality of network domains, wherein the first computing machine resides in at least one of the network domains, wherein the object includes a security descriptor identifying an owner network domain of the object and an identification of at least one user, wherein the request includes at least one member of a group comprising: a fundamental modification and the security descriptor indicating a special security evaluation; when the request includes a fundamental modification, determining whether the first computing machine resides in the owner network domain by retrieving from the security descriptor the identity of the owner network domain and comparing the owner network domain identity to the network domain within which the first computing machine resides; rejecting the request to modify the object when the first computing machine does not reside in the owner network domain; and when the request includes the security descriptor indicating the special security evaluation, sending a notification to the first computing machine that a security evaluation is to be evaluated within the owner network domain.