Microsoft Technology Licensing, LLC

Adam Back

Ismail Cem Paya

Yordan Ivanov Rouskov

Wei Jiang

Wei-Quiang Michael Guo

John D Whited

Baskaran Dharmarajan

Peter L Montgomery

Kok Wai Chan

Gerard Gjonej

Jonathan Wilkins

Rahul Shrikant Newaskar

Dafina Ivanova Toncheva

Scalable session management is achieved by generating a cookie that includes an encrypted session key and encrypted cookie data. The cookie data is encrypted using the session key. The session key is then signed and encrypted using one or more public/private key pairs. The encrypted session key can be decrypted and verified using the same private/public key pair(s). Once verified, the decrypted session key can then be used to decrypt and verify the encrypted cookie data. A first server having the private/public key pair(s) may generate the cookie using a randomly generated session key. A second server having the same private/public key pair(s) may decrypt and verify the cookie even if the session key is not initially installed on the second server. A session key cache may be used to provide session key lookup to save public/private key operations on the servers.

Session key cache to maintain session keys

Scalable session management using an encrypted session key

Scalable session management

Systems and methods for providing signatures are described. In an implementation, a system includes a backend configured to generate a plurality of incomplete signatures using an offline portion of an online/offline signature algorithm, storage configured to store the plurality of incomplete signatures and a front end configured to process a plurality of messages using the plurality of incomplete signatures to form a plurality of digital signatures such that each of the messages has a corresponding one of the digital signatures.

Systems and methods for providing signatures

Detecting an attack on an authentication service. A first memory area is configured to store data relating to a plurality of requests communicated to an authentication service from a plurality of user agents. A second memory area is configured to store a predefined pattern of one or more requests. The predefined pattern characterizes an attack. A processor searches the stored data as a function of a query variable to identify at least one of the plurality of the requests communicated from at least one of the plurality of the user agents and compares the stored data associated with each of the identified requests with the predefined pattern to determine whether the identified request indicates the attack characterized by the predefined pattern. Other aspects of the invention are directed to computer-readable media for use with detecting the attack on the authentication service.

Security attack detection and defense

Securely roaming private data from one client computer to another in a network. A home client application generates a first key in response to a password, and encrypts designated private data as a function of the first key. A server receives and stores the encrypted private data. A roaming client application generates the first key in response to the password, and decrypts encrypted private data transferred from the server to obtain the private data. The invention further provides users the ability to retrieve encrypted private from the server even when the user cannot remember the password associated with the first key. Also, the server has no knowledge of the private data or the keys.

Method and system for recovering password protected private data via a communication network without exposing the private data

Growing community of inventors

Borden, Canada

Adam Back