Microsoft Technology Licensing, LLC

Digital Equipment Corporation

Compaq Computer Corporation, Inc.

Butler W Lampson

Paul England

John D DeTreville

Charles W Kaufman

Paul J Leach

Morrie Gasser

Christopher G Kaler

Richard F Rashid

John Peter Shewchuk

Stephen James Millet

Giovanni Moises Della-Libera

Bradford H Lovering

Martin Abadi

Melissa Wood Dunn

Carl Melvin Ellison

William R Hawe

Ravindra Pandya

Scott A Konersmann

Steven E Lucco

Charles Patrick Thacker

Amar Gupta

Joseph J Tardo

James E Mathews

Leroy B Keely

William Hong Vong

Sumit Gulwani

Charlton E Lui

David Switzer

Andrew C Goldstein

Adam Tauman Kalai

Roy Levin

Omer Tamuz

Kannan Alagappan

Aditya Krishna Menon

Michael Burrows

James Jay Horning

Edward Pearce Wobber

Andrew David Birrell

David William Thiel

Barry A Spinney

David B Lomet

Luis M Huapaya

Clark Allan Heydon

Mark F Kempf

Siman-Tov Ben-Michael

B J Herbison

Philip P Lozowick

Steven B Lipner

Jean-Jacques Levy

Fred B Schneider

Steven P Miller

Paul J Lach

Steven E Luocco

Edward Balkovich

Yuan Yu

There is provided a method and system for generating a program. The method includes detecting a number of steps for performing a task on a computing device and detecting an example relating to each of the steps, wherein the example includes input data and corresponding output data relating to the step. The method also includes, for each example, determining a rule that transforms the input data to the corresponding output data based on cues including textual features within the input data and the corresponding output data. The method further includes generating a program for performing the task based on the rules.

Generating programs using context-free compositions and probability of determined transformation rules

The subject disclosure pertains to systems and methods that facilitate managing access control utilizing certificates. The systems and methods described herein are directed to mapping an access policy as expressed in an access control list to a set of certificates. The set of certificates can be used to grant access to resources in the manner described by the ACL. The certificates can be distributed to entities for use in obtaining access to resources. Entities can present certificates to resources as evidence of their right to access the resources. The access logic of the sequential ACL can be transformed or mapped to a set of order independent certificates. In particular, each entry, position of the entry in the list and any preceding entries can be analyzed. The analysis can be used to generate order independent certificates that provide access in accordance with the access policy communicated in the ACL.

Transformation of sequential access control lists utilizing certificates

A distributed security system is provided. The distributed security system uses a security policy that is written in a policy language that is transport and security protocol independent as well as independent of cryptographic technologies. This security policy can be expressed using the language to create different security components allowing for greater scalability and flexibility. By abstracting underlying protocols and technologies, multiple environments and platforms can be supported.

Virtual distributed security system

The subject disclosure pertains to a domain identification system, comprising a principal that has a key and a mnemonically meaningless identifier, the mnemonically meaningless identifier is used to identify the component in a networked environment. The mnemonically meaningless identifier can be bound to the public key by a binding. The component may be part of a neighborhood of components, and each member component knows the members' binding.

Domain ID service

The subject disclosure pertains to systems and methods that facilitate managing groups entities for access control. A negative group is defined using a base group, where the negative group associated with a base group includes any entities not included in the base group. Negative groups can be implemented using certificates rather than explicit lists of negative group members. A certificate can provide evidence of membership in the negative group and can be presented for evaluation to obtain access to resources. Subtraction groups can also be used to manage access to resources. A subtraction group can be defined as the members of a first group, excluding any members of a second group.

Access control negation using negative groups

In one aspect, a data structure to be encrypted is received, the data structure including content along with a statement of conditions under which the content may be decrypted. The content is encrypted using a public key of a pair of public and private keys of a device that is to decrypt the data structure. In another aspect, a data structure is decrypted using a private key of a pair of public and private keys. A statement of conditions under which content in the data structure can be decrypted is obtained, and testing is performed as to whether the conditions are satisfied. The decrypted content is returned only if the conditions are satisfied.

System and method for secure storage of data using public and private keys

In accordance with one aspect of boot blocks for software, in a computer system that has a central processing unit and a software identity register, an atomic operation is executed to set an identity of a piece of software into the software identity register. If the atomic operation completes correctly, then the software identity register contains the identity of the piece of software; otherwise, the software identity register contains a value other than the identity of the piece of software.

Boot blocks for software

An architecture for protecting premium content in a nonsecure computer environment executes only a small number of code modules in a secure memory. The modules are arranged in a hierarchy of trust, where a module names other modules that it is willing to trust, and those modules in turn name other modules that they are willing to trust. A secure loader loads a security manager that oversees a number of content-providing modules for manipulating the content. A memory manager assigns permissions to various pages of the secure memory. The memory has rings of different security. The security model can be extended to program modules and other devices on the computer's bus, such as DMA controllers and peripherals.

Hierarchical trusted code for content protection in computers

In accordance with certain aspects, a computer system has a central processing unit (CPU) and an operating system (OS), the CPU having a pair of private and public keys and a software identity register that holds an identity of the operating system. An OS certificate is created including the identity from the software identity register, information describing the operating system, and the CPU public key. The created OS certificate is signed using the CPU private key.

System and method for authenticating an operating system to a central processing unit, providing the CPU/OS with secure storage, and authenticating the CPU/OS to a third party

In one aspect, a data structure to be encrypted is received in a device, the data structure including content along with a statement of conditions under which the content may be decrypted. The data structure is encrypted using a symmetric key of a processor of the device. In another aspect, a data structure is decrypted using a processor symmetric key. A statement of conditions under which content in the data structure can be decrypted is obtained, and testing is performed as to whether the conditions are satisfied. The decrypted content is returned only if the conditions are satisfied.

System and method for secure storage data using a key

Growing community of inventors

Cambridge, MA, United States of America

Butler W Lampson