Microsoft Technology Licensing, LLC

Arjmand Samuel

Eustace Ngwa Asanghanwa

Affan Arshad Dar

Nicole Elaine Berdy

Konstantin Dotchkoff

Chipalo Street

Damon Luke Barry

Brian C Beckman

Emmanouil Koukoumidis

Elio Damaggio

Juan J Perez

Michael Richard Yagley

Sameer Halai

Nicholas Donald Atkins Lane

Angelo Roncalli De Novaes Pires Ribeiro

Clemens Vasters

Muhammad Shahzad

James W Osborne

The disclosed technology is generally directed to device security in an IoT environment. For example, such technology is usable in IoT security. In one example of the technology, a set of security rules that is associated with an expected condition of at least one IoT device is stored. IoT data associated with the at least one IoT device is received. The IoT data may be aggregated data that includes at least two different types of data. A determination is made, based on the IoT data, as to whether the set of security rules has been violated. An alert is selectively sent based on the determination.

IoT security service

The disclosed technology is generally directed to IoT technology. In one example of the technology, the following actions are performed for each module of a plurality of modules on a first edge device. An identification message that includes information associated with identification of the module is received. The validity of the module is then verified. After the module is verified, based at least in part on the identification message, an IoT support service is selected from a plurality of IoT support services. The module is then caused to be registered with the selected IoT support service. The plurality of modules are compositable together into an application for the first edge device. The modules of the plurality of modules are capable of being used interoperably with other modules without altering the other modules.

Recombining modules for applications using a common provisioning service

Example of secure monitoring of modular applications and associated edge devices are described herein. In an example, an accreditation request is initiated to accredit at least one of a modular application and an edge device hosting the modular application. The edge device may a device coupling an IoT device to a cloud server. Based on initiating, accreditation information corresponding to at least one of the modular application and the edge device may be received. The accreditation information are generated by a hardware encryption device associated with the edge device. Further, an accreditation status of the modular application may be monitored during execution of the modular application to ascertain whether the modular application and the edge device have been tampered. In case tampering is detected, a remedial action to address the tampering may be performed.

Secure application monitoring

Creating a certificate for a software module. A method includes obtaining a public key for a software module. The method includes obtaining a public key for a software module implemented on a hardware device. The method further includes creating a certificate using the public key by signing the public key using a hardware protected key and hardware protected compute elements. The hardware protected key is protected by a protected portion of the hardware device, and not accessible outside of the protected portion of the hardware device.

Hardware based identities for software modules

Metadata associated with IoT devices is stored. The metadata may include categories associated with the IoT devices. At least a first category may be hierarchical such that the first category includes at least two hierarchical levels, with each hierarchical level including at least two categories, and such that each category in a hierarchical level that is below another hierarchical level is a subset of one of the categories in the hierarchical levels above that hierarchical level. User information associated with users is stored. A request associated with one of the users and further associated with access to at least one of the IoT devices is received. Responsive to the request, the access is selectively granted to the at least one of the IoT devices based upon the stored user information and the stored metadata.

Context-aware device permissioning for hierarchical device collections

The disclosed technology is generally directed to device authentication in an IoT environment. For example, such technology is usable in authenticating IoT devices to an IoT Hub. In one example of the technology, data field targets are received for an IoT device. The data field targets may include at least one device identity data field target and at least one telemetry data field target. Data field entries are received from the IoT device at a first time. The data field entries may include at least one device identity data field entry and at least one telemetry data field entry. A determination is made as to whether the data field entries match the corresponding data field targets for the IoT device. The IoT device is selectively allowed to connect to the IoT hub based on the determination.

IoT device authentication

Modular applications using a common provisioning service

The disclosed technology is generally directed to device provisioning in an IoT environment. For example, such technology is usable in provisioning IoT devices to an IoT Hub. In one example of the technology, an identification message that includes information associated with identification of a first IoT device is received. The validity of the first IoT device is then verified. After the first IoT device is verified, based at least in part on the identification message, an IoT hub is selected from a plurality of IoT hubs. The first IoT device is then caused to be registered with the selected IoT hub.

IoT provisioning service

The disclosed technology is generally directed to IoT communications. For example, such technology is usable in provisioning IoT devices in an automatic manner with no manual steps. In one example of the technology, upon initial boot, identification information is automatically sent to a provisioning service endpoint stored in the IoT device. The identification information includes an identification (ID) of the first IoT device. Cryptographic information is received from the provisioning service. The cryptographic information is associated with an IoT hub selected from a plurality of IoT hubs based, in part, on the ID of the first IoT device. A message is automatically sent to the IoT hub in response to receiving the cryptographic information. A new configuration file and a firmware update are received from the IoT hub without requiring a user association. The new configuration file and the firmware update are automatically installed.

Automatic provisioning of IoT devices

Among other things, one or more techniques and/or systems are provided for annotating content based upon user reaction data and/or for maintaining a searchable content repository. That is, a user may request and/or opt-in for user reaction data to be detected while a user is experiencing content (e.g., watching a movie, walking through a park, interacting with a website, participating on a phone conversation, etc.). Metadata associated with the content may be used to determine when and/or what sensors to use to detect the user reaction data (e.g., metadata specifying an emotional part of a movie). The content may be annotated with a reaction annotation corresponding to the user reaction data, which may be used to organize, search, and/or interact with the content. A search interface may allow users to search for content based upon annotation data and/or aggregated annotation data of one or more users who experienced the content.

Content reaction annotations

A method, system, and one or more computer-readable storage media for behavior based authentication for touch screen devices are provided herein. The method includes acquiring a number of training samples corresponding to a first action performed on a touch screen of a touch screen device, wherein the first action includes an input of a signature or a gesture by a legitimate user. The method also includes generating a user behavior model based on the training samples and acquiring a test sample corresponding to a second action performed on the touch screen, wherein the second action includes an input of the signature or the gesture by a user. The method further includes classifying the test sample based on the user behavior model, wherein classifying the test sample includes determining whether the user is the legitimate user or an imposter.

Growing community of inventors

Redmond, WA, United States of America

Arjmand Samuel