Microsoft Technology Licensing, LLC

Alex Mark Semenko

Innokentiy Basmov

Octavian Tony Ureche

Magnus Bo Gustaf Nyström

Sai Vinayak

Carl Melvin Ellison

Narendra Shripati Acharya

Douglas M MacIver

Donghui Li

Scott Field

Preston Derek Adam

Yogesh A Mehta

Dayi Zhou

John Michael Walton

Avraham Michael Ben-Menahem

Aravind N Thoram

Dustin Lyle Green

Scott Chao-Chueh Lee

Niels Thomas Ferguson

Emily Nicole Wilson

Scott Daniel Anderson

David John Linsley

Alain Franck Gefflaut

Ping Xie

Richard Allen Pletcher

Kirsten Valery Stark

Peter Novotney

Malcolm James Smith

Kinshuman Kinshumann

Kevin A Chin

Michael J Grass

Hui Huang

Alex Bendetov

James Aaron Holmes

Andrey Shedel

Salil Bhagurkar

Aaron M Farmer

Troy E Shaw

Samarth Sudhanshu Zankharia

Scott A Field

Douglas M Maciver

Narendra S Acharya

Peter J Novotney

Salil Arun Bhagurkar

Magnus Bo Gustaf NYSTRÖM

Methods and devices for accessing encrypted data on a computer device may include determining that a current device state of the computer device is locked. The methods and devices may include using a level two encryption key to encrypt data associated with at least one application while the computer device is locked. The methods and devices may include using a temporary decryption key in memory of the computer device to access level two encrypted data while the computer device is locked.

Device state driven encryption key management

A computing device uses a data encryption and decryption system that includes a trusted runtime and an inline cryptographic processor. The trusted runtime provides a trusted execution environment, and the inline cryptographic processor provides decryption and encryption of data in-line with storage device read and write operations. When a portion (e.g., partition) of a storage device is defined, the trusted runtime generates an encryption key and provides the encryption key to the inline cryptographic processor, which uses the encryption key to encrypt data written to the portion and decrypt data read from the portion. Access to the portion can be subsequently protected by associating the key with authentication credentials of a user or other entity. The trusted runtime protects the encryption key based on an authentication key associated with the authentication credentials, allowing subsequent access to the encryption key only in response to the proper authentication credentials being provided.

Rapid data protection for storage devices

Systems and methods are provided for adding security to client data by maintaining keys providing access to the client data remotely from the client data. In some circumstances, the systems encrypt a cluster of data using an encryption key, associate the cluster of encrypted data with a unique identifier and send the unique identifier and the decryption key to a server for storage. The decryption key is then received from the server and is used to decrypt the cluster of encrypted data. A server can also perform policy checks or trigger additional authentication such as SMS, phone, or email notification before allowing access to a key. Furthermore, in some instances, the server can also prevent access to the stored keys in response to anomalies, such as decommissioning and other asset management events.

Theft and tamper resistant data protection

Systems and methods are provided for adding security to client data by maintaining decryption keys at a server that provide access to encrypted keys that are maintained at a client system with encrypted client data. A specialized protocol is utilized for accessing the decryption keys from the server. Once obtained, the decryption key is used to decrypt the encrypted key at the client and then the newly decrypted decryption key is used to decrypt the encrypted data. A server can also perform policy checks or trigger additional authentication such as SMS, phone, or email notification before allowing access to the server decryption key. Furthermore, in some instances, the server can also prevent access to the server decryption keys in response to anomalies, such as decommissioning and other asset management events.

A data protection policy is implemented on a computing device, the data protection policy indicating how organization data on the computing device is to be protected. Protection of the organization data includes encrypting the organization data, and allowing the organization data to be decrypted only by particular programs and/or under particular circumstances (as indicated by the data protection policy). When implementing a data protection policy, files already stored on the computing device are encrypted using a passive encryption technique. The passive encryption technique can include one or more of an encrypt on close technique, an encrypt on open technique, an encrypt without exclusive access technique, and an encrypt location technique.

Passive encryption of organization data

Data files are encrypted based on a key associated with an entity that sets a data protection policy controlling access to the data files. The data protection policy identifies various restrictions on how the plaintext data of the encrypted data in the data files can be used. The data files have corresponding metadata identifying the entity that sets the data protection policy, and processes that are running instances of applications that are allowed to access the plaintext data are also associated with the identifier of the entity. These identifiers of the entity, as well as the data protection policy, are used by an operating system of a computing device to protect the data in accordance with the data protection policy, including having the protection be transferred to other devices with the protected data, or preventing the protected data from being transferred to other devices.

Preserving data protection with policy

To comply with a policy for a computing device indicating that data written by the computing device to the storage volume after activation of the policy be encrypted, a sector map is accessed. The sector map identifies one or more sectors of a storage volume and also identifies, for each of the one or more sectors of the storage volume, a signature of the content of the sector. In response to a request to read the content of a sector, the content of the sector is returned without decrypting the content if the sector is one of the one or more sectors and the signature of the content of the sector matches the signature of the sector identified in the sector map. Otherwise, the content of the sector is decrypted and the decrypted content is returned.

Map-based rapid data encryption policy compliance

Embodiments of the disclosure provide access to data in a compressed container through dynamic redirection, without storing decompressed data in persistent memory. The compressed container is stored in a first portion of memory. User data and reference files, with redirect pointers, for accessing corresponding files in the compressed container are stored in a second portion of memory. A command to access data is detected by a computing device. The redirect pointer in the reference file associated with the command redirects access to the corresponding compressed version of data stored in the compressed container. The corresponding accessed compressed version of data is decompressed on the fly and provided in response to the command without storing the decompressed data in persistent memory. Some embodiments provide integrity protection to validate the data coming from the compressed container.

Accessing data in a compressed container through dynamic redirection

Sector map-based rapid data encryption policy compliance

One or more techniques and/or systems are provided for securely obtaining memory content after a device malfunction. For example, applications, components, and/or an operating system of a device may maintain information within volatile memory in a secure manner (e.g., using encryption). When the device malfunctions, such information may be useful for diagnosing what caused the malfunction. Accordingly, memory content within volatile memory may be securely retrieved, encrypted, and/or stored before such memory content is flushed/removed from volatile memory. For example, a warm reset is performed to initially reboot the device without removing memory content from volatile memory. The memory content may be retrieved and encrypted to create encrypted memory content that may be stored within nonvolatile memory for later access. After a second reboot, device malfunction information may be obtained by decrypting the encrypted memory content using a private key matching a public key used to encrypt the memory content.

Securely obtaining memory content after device malfunction

A set of security claims for a communication channel are obtained, the set of security claims including one or more security claims each identifying a security characteristic of the communication channel. The security claims are stored, as is a digital signature generated over the set of security claims by an entity. The security claims and digital signature are subsequently accessed when a computing device is to transfer data to and/or from the communication channel. The set of security claims is compared to a security policy of the computing device, and the entity that digitally signed the set of security claims is identified. One or more security precautions that the computing device is to use in transferring data to and/or from the communication channel are determined based at least in part on the comparing and the entity that has digitally signed the set of security claims.

Communication channel claim dependent security precautions

A communication channel has an associated channel authenticator that includes a channel identifier, a use policy identifying how an owner of the communication channel indicates the communication channel is used, and a digital signature over the channel identifier and use policy. The identifier of the communication channel and the use policy can be verified by a computing device, and a check made as to whether a current security policy of the computing device is satisfied by the use policy. An access that the computing device is allowed to have to the communication channel is determined based at least in part on both whether the current security policy is satisfied by the use policy and whether the identifier of the communication channel and the use policy are verified.

Communication channel access based on channel identifier and use policy

To comply with a policy for a computing device indicating that data written by the computing device to the storage volume after activation of the policy be encrypted, an encrypted chunks map is accessed. The encrypted chunks map identifies whether, for each chunk of sectors of a storage volume, the sectors in the chunk are unencrypted. In response to a request to write content to a sector, the encrypted chunks map is checked to determine whether a chunk that includes the sector is unencrypted. If the chunk that includes the sector is unencrypted, then the sectors in the chunk are encrypted, and the content is encrypted and written to the sector. If the chunk that includes the sector is encrypted or not in use, then the content is encrypted and written to the sector.

Encrypted chunk-based rapid data encryption policy compliance

In accordance with one or more aspects, a storage volume is transformed into an encrypted storage volume or an unencrypted storage volume using a multi-phase process. One or more parts of the storage volume that have not yet been transformed are identified, and one or more parts of the storage volume that are allocated for use are identified. In a first phase of the multi-phase process, one or more parts of the storage volume that have not yet been transformed and that are allocated for use are transformed. In a second phase of the multi-phase process, after the first phase is finished, one or more parts of the storage volume that have not yet been transformed and are not allocated for use are transformed.

Multi-phase storage volume transformation

Growing community of inventors

Issaquah, WA, United States of America

Alex Mark Semenko