Microsoft Technology Licensing, LLC

Bharat Shah

Mario C Goertzel

Mark H Lucovsky

Debi P Mishra

Markus Horstmann

Shannon J Chan

Gregory A Jensenworth

David E Kays, Jr

Daniel F Plastina

Michael M Swift

Mazhar Naveed Mohammed

Michael J Cherry

Richard Bruce Ward

Praerit Garg

Richard Douglas Hill

Lawrence William Osterman

David E Kays

Alexander A Mitchell

Susi E Strom

A method and system for managing and deploying applications across a computer network by assigning and publishing applications to user and computer policy recipients. Assigned applications are automatically applied via a script to the policy recipients, thereby ensuring that the recipient has an administrator-specified workstation configuration. Assigned applications are advertised so as to appear available to the user, by adding an application shortcut to the start menu, and by populating the machine registry with appropriate application information. Other applications may be published to users, whereby those applications are optionally available for use by users. Published application information is maintained in a centralized store of information on the network. Assigned and published applications may be installed on demand, such as when the application is activated.

Method and system for assigning and publishing applications

A method and system for installing software implementations such as applications and COM classes as they are needed from an external source, such as a centralized network store. When a software implementation is needed, the system and method first look to the local system (e.g., registry) for that software implementation, and if found, returns the information such as a local path needed to use the software implementation. If the implementation is not found locally, the present invention dynamically looks to a centralized class store of a network, to locate the needed implementation. When located, the implementation is downloaded and locally installed in a manner that is essentially transparent to the user. Software implementations such as application products may be divided into features and components to improve on-demand installation thereof.

Method and system for on-demand installation of software implementations

Restricted execution contexts are provided for untrusted content, such as computer code or other data downloaded from websites, electronic mail messages and any attachments thereto, and scripts or client processes run on a server. A restricted process is set up for the untrusted content, and any actions attempted by the content are subject to the restrictions of the process, which may be based on various criteria. Whenever a process attempt to access a resource, a token associated with that process is compared against security information of that resource to determine if the type of access is allowed. The security information of each resource thus determines the extent to which the restricted process, and thus the untrusted content, has access. In general, the criteria used for setting up restrictions for each untrusted content's process is information indicative of how trusted or untrusted the content is likely to be.

Method and system for secure running of untrusted content

The disclosed system uses a challenge-response authentication protocol for datagram-based remote procedure calls. Using a challenge-response authentication protocol has many advantages over using a conventional authentication protocol. There are two primary components responsible for communication using the challenge-response protocol: a challenge-response protocol component on the client computer (client C-R component) and a challenge-response protocol component on the server computer (server C-R component). In order to start a session using the challenge-response protocol, the client C-R component first generates a session key. The session key is used by both the client C-R component and the server C-R component for encrypting and decrypting messages. After creating the session key, the client C-R component encrypts a message containing a request for a remote procedure call and sends it to the server C-R component. In response, the server C-R component sends a challenge to the client C-R component. The challenge contains a unique identifier generated by the server C-R component. The client C-R component responds to the challenge by sending a challenge response and the session key. The challenge response is the unique identifier contained within the challenge encrypted with the password of the user of the client computer. The session key is also encrypted using this password. Upon receiving the challenge response, the server C-R component uses its copy of the client's password to create its own version of the challenge response and compares it to the version received from the client C-R component. If the two versions of the challenge response are identical, the identity of the user of the client computer has been verified. If the two versions are not identical, an attempted unauthorized access has been detected. After verification, the server C-R component extracts the session key, decrypts the message, and invokes the requested procedure of the server program. Subsequently, the server C-R component will send and receive encrypted messages from the client C-R component, thereby facilitating a remote procedure call.

Challenge-response authentication and key exchange for a connectionless security protocol

An improved computer network security system and method wherein access to network resources is based on information that includes the location of the connecting user. In general, the less trusted the location of the user, the more the access rights assigned to the user are restricted. A discrimination mechanism and process determines the location of a user with respect to categories of a security policy, such as to distinguish local users, intranet users and dial-up users from one another. Based on information including the location and the user's credentials, an access token is set up that may restrict the user's normal access in accordance with the security policy, such as to not restrict a user's processes beyond the user-based security information in the user's normal access token, while further restricting the same user's access to resources when connecting via a dial-up connection. Restricted tokens are preferably used to implement the location-based discrimination by restricting the security context of users connecting from less trusted locations.

Method and system of security location discrimination

A method and mechanism for interprocess communication between a thread of a client application and a thread of a server application. The mechanism includes a server listening thread and a client listening thread. The client thread sends a request to a server listening thread, and the server listening thread places the request in a message queue associated with the server thread. The request is received at the server thread and dispatched to a remote procedure for processing. Reply data received back from the remote procedure is sent to the client listening thread. The client listening thread notifies the client thread when the reply is received and gives the reply to the client thread.

Method and mechanism for interprocess communication using client and server listening threads

A method and system for delayed registration of a remote protocol for communicating between a client computer system and a server computer system. The server computer system has a communications process that registers a plurality of protocols. When the client process needs to communicate with the server process, it sends a request to the communications process along with an indication of the protocols that it supports. The communications process selects a protocol that is supported by both the client computer system and the server computer system and directs the server process to register that protocol. The communication process provides the server endpoint for that protocol to the client process which can then communicate directly with the server process.

Method and system for delayed registration of protocols

A method and mechanism for efficiently handling connections in a computer system between client sockets and data sockets of a server. The server includes a receive-any thread having a socket mask associated therewith to listen for new connection requests and for activity on data sockets handled thereby. The server further includes receive-direct threads associated with at least some of the data sockets for handling data communication. When a receive-direct connection has no activity for a period of time, the connection is migrated to a receive-any connection. When a receive-any connection becomes active, the connection is migrated to a receive-direct connection if a receive-direct thread is available.

Method and system for migrating connections between receive-any and receive-direct threads

A computer-implemented method selects a desired copy of a particular interface in a computer system that includes a client computer and a server computer. The method includes, at the server computer, annotating the desired copy of the interface with an identifier, and, at the client computer, selecting the desired copy of the interface based on the associated identifier. The annotating and selecting steps may be implemented using the RPC protocol.

Growing community of inventors

Bellevue, WA, United States of America

Bharat Shah