Microsoft Technology Licensing, LLC

Balaji Balasubramanyan

Hari R Pulapaka

Benjamin M Schultz

Giridhar Viswanathan

Tushar Suresh Sugandhi

Ahmed Saruhan Karademir

Matthew David Kurjanowicz

Frederick Justus Smith

Miko Arnab Sakhya Singha Bose

Margarit Simeonov Chenchev

Ankit Srivastava

Amber Tianqi Guo

Chase Thomas

Abhijat Singh

Gupta Shubham

Carlos Ernesto Peza Ramirez

Ronald Aigner

William James Griffin

Dmitri Davydok

Narasimhan Ramasubramanian

Daniel Vincent Fiordalis

Michael Trevor Pashniak

Ryan Robert Stocker

Sudeep Kumar Ghosh

Raphael Gianotti Serrano Dos Santo

Nived Kalappuraikal Sivadas

Michael John Novak

Chris J Guzak

Ravinder S Thind

Simon Clarke

Jonathan D Schwartz

Scott David Hoogerwerf

Allison Anne O'Mahony

Oded Yehuda Shekel

Marc Wautier

Roger Lueder

Yanan Zhang

Vellore T Vetrivelkumaran

Bryan R Born

Miko Arnab S Bose

Francisco Jose Garcia-Ascanio

Mona Akmal

David Guy Weston

Prakhar Srivastava

Joshua Adam Alpern Boehm

Paula Cooper

Pat Miller

Adam Linkon

Denise Elisabeth Signer

Alyssa Irwin

Joseph Wiggs

David Diffenbaugh

Peteris Ledins

Joshua Adam Boehm

Roger Allen Lueder

Miko Arnab Bose

Allison O'mahony

William J Griffin

Ryan R Stocker

Environment type validation can provide a tamper-resistant validation of the computing environment within which the environment type validation is being performed. Such information can then be utilized to perform policy management, which can include omitting verifications in order to facilitate the sharing of policy, such as application licenses, from a host computing environment into a container virtual computing environment. The environment type validation can perform multiple checks, including verification of the encryption infrastructure of the computing environment, verification of code integrity mechanisms of that computing environment, checks for the presence of functionality evidencing a hypervisor, checks for the presence or absence of predetermined system drivers, or other like operating system components or functionality, checks for the activation or deactivation of resource management stacks, and checks for the presence or absence of predetermined values in firmware.

Virtual environment type validation for policy enforcement

Methods for protecting software licensing information via a trusted platform module (TPM) are performed by systems and devices. When a licensing server is unreachable, a license is generated for a software application by a licensing manager. The license is generated via a secure register of the TPM using an asymmetric key, specific to the software application and policy-tied to the secure register, to generate a signature of a hashed license file for the software application. The asymmetric key is stored, mapped to the license file, and used for subsequent license validation. A licensing manager validation command is provided to validate the license using the key, as applied to the hash, to verify the signature and checking validity of the time stamp. Time stamp expiration or alteration of the license are determined to provoke invalidation indications for the validating application.

System and method for protecting software licensing information via a trusted platform module

Techniques for secure sharing of data in computing systems are disclosed herein. In one embodiment, a method includes when exchanging data between the host operating system and the guest operating system, encrypting, at a trusted platform module (TPM) of the host, data to be exchanged with a first key to generate encrypted data. The method also includes transmitting the encrypted data from the host operating system to the guest operating system and decrypting, at the guest operating system, the transmitted encrypted data using a second key previously exchanged between the TPM of the host and a virtual TPM of the guest operating system.

Secure sharing of license data in computing systems

Technologies are described for selective persistence of data utilized by software containers. A configuration policy is defined that includes data that specifies one or more data stores for which data is not to be persisted following accesses to a software container and one or more data stores for which data is to be persisted following accesses to the software container. When the software container is first accessed, the data stores identified in the configuration policy are attached to the software container. Upon a subsequent access to the container, such as at the conclusion of a user session or upon destruction of the container, the data in the attached data stores is persisted or deleted based upon the configuration policy. When the software container is once again accessed, the data store containing the persisted data can be re-attached to the software container.

Selective persistence of data utilized by software containers

Securely performing file operations. A method includes determining a licensing characteristic assigned to a file. When the licensing characteristic assigned to the file meets or exceeds a predetermined licensing condition, then the method includes performing a file operation on the file in a host operating system while preventing the file operation from being performed in the guest operating system. When the licensing characteristic assigned to the file does not meet or exceed the predetermined licensing condition, then the method includes performing the file operation on the file in the guest operating system while preventing the file operation from being performed directly in the host operating system.

Method and system for persisting files

Securely performing file operations. A method includes determining a trust characteristic assigned to a file. When the trust characteristic assigned to the file meets or exceeds a predetermined trust condition, then the method includes performing a file operation on the file in a host operating system while preventing the file operation from being performed in the container operating system. When the trust characteristic assigned to the file does not meet or exceed the predetermined trust condition, then the method includes performing the file operation on the file in the container operating system while preventing the file operation from being performed directly in the host operating system.

Method and system for persisting untrusted files

Techniques for memory assignment for guest operating systems are disclosed herein. In one embodiment, a method includes generating a license blob containing data representing a product key copied from a record of license information in the host storage upon receiving a user request to launch an application in the guest operating system. The method also includes storing the generated license blob in a random memory location accessible by the guest operating system. The guest operating system can then query the license blob for permission to launch the application and launching the application in the guest operating system without having a separate product key for the guest operating system.

Memory assignment for guest operating systems

One or more techniques and/or systems are disclosed for providing a client application with access to a file based upon a local offline version of the file and/or web online version of the file. That is, a file may be shared/synchronized from a remote source, such as a web storage service. A web online version of the file may be maintained by the web storage service, while local offline versions of the file may be stored at client devices. A sync module comprising knowledge of the local and/or web versions of the file may provide a client application with access to the file based upon the local and/or web version of the file. The sync module may also delegate synchronization authorization to the client application given that the client application may comprise sophisticated file handling functionality.

Client application file access

Embodiments described herein may involve enabling applications to cooperate with a system-level sync framework. The sync framework may provide system synchronization of files between user devices and a cloud storage service. Arbitrary applications on a user computing device can communicate with the sync framework to temporarily suspend synchronization of a specified file by the sync framework. The application can register functions with the sync framework that the sync framework can invoke in relation to suspending synchronization, continuing to provide system-level access to the file for arbitrary applications, and resuming synchronization.

Sync framework extensibility

A conflict resolution system allows an end user to export customizations to an application program so that the customizations can be imported by another end user. The conflict resolution system may export a customization by outputting metadata describing the customization. When the customization is a custom property, the metadata may include the name of the entity with which the property is associated, the name of the property, the type of the property, a globally unique identifier for the property, the location on the user interface for the input field for the custom property, and so on. End users may want to share not only their customizations but also the underlying data associated with a customization. When a conflict occurs during import of a customization alone without the data, then the conflict resolution system resolves the conflict in favor of the imported property. When a conflict occurs during import of a customization with data, the conflict resolution system resolves the conflict in favor of the existing property.

Resolving conflicts when importing an application customization

A computing device provides an application that uses multiple protocol stacks to communicate with a server. The server requires messages from each of the protocol stacks to include a credential for a user of the computing device. The credential is a set of information that includes identification and proof of identities that is used to gain access to a resource. However, the user is not prompted for the credential more than once. In some embodiments, this is accomplished by storing the credential at the computing device for retrieval by the protocol stacks when the application uses the protocol stacks to communicate with the server.

User authentication across multiple network stacks

An application attempts to use a first protocol stack to send a first message to a server. After attempting to send the first message to the server, the application attempts to use a second protocol stack to send a second message to the server. After attempting to send the second message to the server, the application performs a timeout activity before a timeout period for the second message expires when the first message timed out. Alternatively, when the timeout period for the second message expires and the first message did not time out, the application performs the timeout activity. When the client device received a response to the second message from the server before the timeout period for the second message expires, the application performs a different activity.

Server reachability detection

Growing community of inventors

Redmond, WA, United States of America

Balaji Balasubramanyan