Microsoft Technology Licensing, LLC

Bernard D Aboba

Timothy Mark Moore

Kun Tan

Narendra C Gidwani

Amer A Hassan

Noel Wayne Anderson

Paramvir Bahl

Daniel Ron Simon

Jitendra Dattatraya Padhye

Ramachandran Ramjee

Pradeep Bahl

Taroon Mandhana

Gurdeep Singh Pall

Ashwin Palekar

Wei Jiang

Brian D Swander

Jiansong Zhang

Tim M Moore

Trevor William Freeman

Paul G Mayfield

Alok Manchanda

Miguel Oom Temudo De Castro

Kenneth Lynn Crocker

Gopala Srihari Narlanka

Sharad Mittal

Michel Guittet

Stephen E Bensley

Todd L Paul

Olivier M Contant

Toby Lee Nixon

David L Eitelbach

Jerry E Peterson

Arun Ayyagari

Shai Guday

Anton W Krantz

Alireza Dabagh

Bozidar Radunovic

Austin N Donnelly

Alan M Warwick

Roy D Kuntz

Deon Brewis

Narasimha Rao S S Nagampalli

Gabriel E Montenegro

Krishna Ganugapati

Dalen Matthew Abraham

Noor-E-Gagan Singh

Bozidar Raduvic

Austin Donnelly

Gabriel Montenegro

A computing device configured for wireless communication may effectively control adaptation to channel conditions. The device may be configured to identify and classify conditions impacting performance of a channel so that appropriate adaptations may be made. Interference may be detected by correlating received signal strength and packet errors. High received signal strength correlated to a high packet error rate may signify presence of a source of interference. Once a source of interference is detected, other criteria may be used to determine the nature of the interference so that an adaptation that is minimally disruptive of applications can be selected. Additionally, channel degradation may be predicted by monitoring trends in error rates, including Forward Error Correction rates, and adaptation may be used before packet error rates exceed an unacceptable level.

Channel control based on error correction values

A computer with an extensible framework for facilitating communication between a software component installed on the computer and a device driver that executes functions in response to vendor-specific command objects (e.g., OIDs). The framework defines data structures and a standardized format for defining and implementing private interfaces. After selecting a private interface that is commonly supported by a software component and a driver, a private communication path may be established by an operating system component to facilitate the transfer of command information from the software component to the driver. The private communication path allows commands packaged as OIDs to be routed from software components to intended drivers. By defining private interfaces which route commands from software components to intended drivers, the extensible framework mitigates potential incompatibilities that may arise when drivers created by different vendors include OIDs with the same OID value.

Extensible private driver interface

Location of a communication network subscriber is determined employing confidence metrics such as remote vs. local computer usage, primary user in a multi-user computing environment, likelihood of forgery, and comparable ones. A fine-grained location determination is then made based on the metric results and directory information for the particular subscriber such that services like emergency services can be provided with accurate location information.

Fine-grained location determination of networked computers

A communication device cognitively monitors interference signals across a communication band so that adaptations for physical and medium access control (MAC) of data packet transmissions are appropriate for a particular interference signal. Characteristics of an interference signal of interest (e.g., bandwidth, power and/or duration relative to an average data packet transmitted over a communication channel of the communication device) are sensed for an appropriate adaptation (e.g., forward error correction, modulation technique, back off, request to send/clear to send protocol, etc.). Patterns for known types of interference sources can be compared so that when recognized an associated adaptation can be used.

Physical and MAC adaptation for interference mitigation with cognitive radio

Interference detection

A networked computer with a networking framework that can operate in accordance with a standard protocol or may be configured to perform one or more functions that alter or extend processing according to the standard. The framework includes extensibility points and a mechanism to receive plug-ins that may perform extensibility functions. Network profile information indicates configuration of the extensibility points, including specific extensibility functions to be executed at the extensibility points. This information may be used to configure the extensibility points so that, as the computer operates, the extensibility functions are selectively executed instead of or in addition to standard functions.

Ethernet extensibility

A system is provided for establishing a secure link among multiple users on a single machine with a remote machine. The system includes a subsystem to filter traffic so that traffic from each user is separate. The subsystem generates and associates a Security Association (SA) with at least one filter corresponding to the user and the traffic, and employs the SA to establish the secure link. An Internet Key Exchange module and a policy module may be included to generate and associate the security association, wherein the policy module is configured via Internet Protocol Security (IPSEC).

System and method for improved network security

Generating symmetric keys among distributed appliances, includes generating public and private values on at least one appliance, importing a public value from another appliance via an out-of-band entity, and generating a secret value as a function of the private value corresponding to the local appliance and the public value received from the other appliance.

Security associations for devices

Each node or link of an ad hoc network assists in the distributed allocation of a data channel to increase fairness, even in a multi-hop network, by tracking a measure of link weight for itself and sharing this information over a control channel with neighboring nodes. The metric can be provided over a dedicated control channel, added as a header to data communication on a data channel, or inferred by monitoring data traffic from the neighboring node. The link weight can be adjusted by a link quality factor based on provided or inferred metrics such as transmission rates, ratio of transmission errors, idle time, etc. For multiple flow queues at a subject node, one with a higher transmission rate can be selected for increased fairness. When a packet is received, medium access includes allocating bandwidth, including bonding multiple frequencies that are determined to be available to both nodes.

Spectrum and medium access allocation for fairness

Network devices access a communications network and engage in secure associations with one or more network access points upon authenticating the access points and upon verifying the discovery information that is broadcast by the access point. Once a secure association is created, management frames that are subsequently transmitted between the network devices and the access points and that are used to control the secure association are verified to further enhance the security of the communications network.

Secure association and management frame verification

One embodiment of the invention is directed to managing access of a host computer to a network. A first communication session with the host computer may be conducted to authenticate the host computer's identity. A second communication session with the host computer may be conducted to determine the health status of the host computer.

Managing access to a network

Controlling network access

A policy server program evaluates one or more policy statements based on the group or groups to which a user belongs as well as other conditions. Each policy statement expresses an implementation of the access policy of the network, and is associated with a profile. The profile contains one or more actions that are to be applied to the user. The policy server program determines the identity of the group or groups to which the user belongs by referencing one or more group attributes contained in a user object which is located in a directory on the network. The user object and its group parameters are established when the user is added to the directory, while a policy statement for a group can be created at any time.

Method of enforcing a policy on a computer network

The principles of the present invention relate to systems, methods, and computer program products for more efficiently and securely authenticating computing systems. In some embodiments, a limited use credential is used to provision more permanent credentials. A client receives a limited-use (e.g., a single-use) credential and submits the limited-use credential over a secure link to a server. The server provisions an additional credential (for subsequent authentication) and sends the additional credential to the client over the secure link. In other embodiments, computing systems automatically negotiate authentication methods using an extensible protocol. A mutually deployed authentication method is selected and secure authentication is facilitated with a tunnel key that is used encrypt (and subsequently decrypt) authentication content transferred between a client and a server. The tunnel key is derived from a shared secret (e.g., a session key) and nonces.

Efficient and secure authentication of computing systems

Disclosed are methods for a client, having established one set of security keys, to establish a new set without having to communicate with an authentication server. When the client joins a group, master session security keys are derived and made known to the client and to the group's access server. From the master session security keys, the access server and client each derive transient session security keys, used for authentication and encryption. To change the transient session security keys, the access server creates 'liveness' information and sends it to the client. New master session security keys are derived from the liveness information and the current set of transient session security keys. From these new master session security keys are derived new transient session security keys. This process limits the amount of data sent using one set of transient session security keys and thus limits the effectiveness of any statistical attacker.

Methods for iteratively deriving security keys for communications sessions

Growing community of inventors

Bellevue, WA, United States of America

Bernard D Aboba