Microsoft Technology Licensing, LLC

Craig T Sinclair

Christopher Wellington Brumme

James H Hogg

Erik B Christensen

Anders Hejlsberg

Gopala Krishna R Kakivaya

Michael M Magruder

Raja Krishnaswamy

David Bau

Brian LaMacchia

Lance Olson

Henry L Sanders

David S Ebbo

Julie D Bennett

James S Miller

Sean Edwin Trowbridge

Travis Muhlestein

Jonathan C Hawkins

Krzysztof J Cwalina

Seth Mitchell Demsey

Brian M Grunkemeyer

Christopher L Anderson

Shawn Patrick Burke

Stefan Harrington Pharies

Yung-Shin Lin

Loren Kohnfelder

Anthony J Moore

Erik B Olson

Yann Christensen

Fabio A Yeon

Jeffrey M Cooperstein

Adam Wade Smith

Corina Eva Feuerstein

Caleb L Doise

Alan Geoffrey Boshier

Shajan Dasan

David S Mortenson

Manish S Prabhu

Radu Rares Palanca

Suzanne Maurine Cook

Joseph L Roxe

John I McConnell

Tarun Anand

Joe Dennis Long

Ramasamy Krishnaswamy

Hany E Ramadan

Jesus Ruiz-Scougall

Jayanth V Rajan

Daniel Takacs

Michael Joseph Toutonghi

Gregory Darrell Fee

David Owen Driver

Jeffrey A Bisset

Michael S Jerger

Srivatsan Parthasarathy

Steven J Pratschner

Yan Valerie Leshinsky

Stephen James Millet

Giovanni Moises Della-Libera

Nikhil Kothari

Scott David Guthrie

Erik Meijer

Luca Bolognese

Keith W Ballinger

Brian Keith Pepin

Mark T Anders

Jun Fang

Susan M Warren

Robert Michael Howard

Nicholas M Kramer

Manu Vasandani

Peter H Golde

Chad W Royal

Mark W Fussell

Omri Gazitt

Mark A Boulter

Sreeram Nivarthi

Nithyalakshmi Sampathkumar

Daniel Dedu-Constantin

Neetu Rajpal

Blaine J Dockter

William A Adams

Mark P Ashton

Subhag P Oak

Serge Lidin

George D Fee

An application program interface (API) provides a set of functions for application developers who build Web applications on Microsoft Corporation's .NET&#x2122; platform.

Computing system and method for allowing plurality of applications written in different programming languages to communicate and request resources or services via a common language runtime layer

An application program interface (API) provides a set of functions, including a set of base classes and types that are used in substantially all applications accessing the API, for application developers who build Web applications on Microsoft Corporation's .NET&#x2122; platform.

Application program interface for network software platform

Performing validation of a derived virtual method includes receiving program code where the derived virtual method is derived from a virtual method of the program language used to generate the program code, compiling the program code to an intermediate language expression, generating metadata descriptive of the compiled program code, validating the use of the derived virtual method by accessing the metadata, and permitting the use of the derived virtual method if the metadata grants override permissions concerning the virtual method of the programming language. The metadata indicating access and override permissions may be generated while compiling the program code in the common language infrastructure. Alternately, the flag may use pre-existing values indicative of the access and override permissions concerning the virtual method of the programming language.

Virtual method protection

Methods and systems are provided for expressing one or more associations between source language declarations and implementations in a language neutral fashion. A determination is made as to whether a source language association rule related to a declaration is different from a default association rule for a target runtime. If so, an override association is expressed between the declaration and the implementation, and if not, a default association is expressed. Methods and systems are also provided for interpreting an association between a declaration and an implementation in a runtime system, wherein a determination is made as to whether the association comprises an override association. If so, the association is interpreted according to an override association rule for the runtime system, and if not, the association is interpreted according to a default association rule.

Methods and systems for compiling and interpreting one or more associations between declarations and implementations in a language neutral fashion

A system and method is provided for providing security to components or assemblies employed by application programs during runtime. Assemblies carry version information that can be used to enforce the versioning rules described by the application program. At runtime, version numbers requested by the application programs are compared with those version numbers of the assemblies that are actually found. In addition to comparing version numbers, the present invention offers a stricter form of version checking based on cryptographic hashes. An assembly is provided with module information that contains a list of the files that make up the assembly. Part of the information recorded about each module is a hash of the module's contents at the time the manifest was built. An assembly referencing another assembly computes the hash of the manifest of the referenced assembly. An assembly manifest may include dependency information, which is information about other assemblies that the assembly depends on or references. Part of the information stored as part of an assembly reference or manifest is a hash of the dependent assembly's manifest.

Binding by hash

A system and method is provided for providing security to components or assemblies employed by application programs during runtime. The present invention employs digital signature keys to ensure that an assembly name that is published is unique because the assembly is published with a publisher's public key. This prevents others from publishing an updated version of an assembly that claims to be published from the same publisher. The present invention guarantees name uniqueness and prevents name spoofing because the original publisher is the only one with the private key matching the public key related to a published assembly. Due to the fact that the public keys are stored in each reference, the caller can be assured that the assembly that the caller is binding to at runtime comes from the same publisher that owns the private key.

Shared names

Computer-based systems and methods are disclosed for a comprehensive security model for managing active content downloaded from a computer network. The security model includes the configuration of a system security policy that is stored on a host computer. The system security policy is configured by security zone in progressively &ldquo;finer grain&rdquo; levels with each level associated with and defining the previous level. These levels may include: protected operations; user permission sets, permissions, parameters and primitives. In the disclosed method and systems, a publisher of active content specifies a requested permission set that includes a list the permissions (defined by parameters, which are defined by primitives) that the active content requires in order to run on the host system. The requested permission set is external to the active content so that it is not necessary to run the active content in order to discover the permissions that the active content requires in order to run. The requested permission set may be included in a signed code package wherein the identity of the active content publisher is guaranteed. A digital signature of the signed code package also guarantees that the contents of the signed code package, including active content, support files, and the requested permission set have not been altered or otherwise corrupted since the signed code package was published. The requested permission set may also be included in a catalog file that can be downloaded separately from the active content.

Declarative permission requests in a computer system

Computer-based systems and methods are disclosed for a comprehensive security model for managing active content downloaded from a computer network. The security model includes the configuration of a system security policy that is stored on a host computer. The system security policy is configured by security zone in progressively &ldquo;finer grain&rdquo; levels with each level associated with and defining the previous level. These levels may include: protected operations; user permission sets, permissions, parameters and primitives associated with parameters. A requested permission set is provided by the publisher of active content that lists the permissions that the active content requires in order to run on the host system. The requested permission set is automatically compared to one or more user permission sets to determine the permissions, if any that will be granted on the host system. The automated set comparisons includes determining a directional permissions sets comparison result, which is &ldquo;directional&rdquo; in that it maintains the distinction between the &ldquo;superior&rdquo; user-defined set and the &ldquo;inferior&rdquo; requested set. Determining the directional permissions sets comparison result may include determining directional primitive comparison results and merging them into a directional parameter comparison result; and determining directional parameter comparison results and merging them into a directional permission comparison result; and, determining directional permission comparison results and merging them into a directional permissions sets comparison result. The disclosed method may be practiced in the comparison of any two sets where a directional result is desirable.

Directional set operations for permission based security in a computer system

Computer-based systems and methods are disclosed for a comprehensive security model for managing foreign content downloaded from a computer network. The methods and systems include the configuration of a system security policy that is stored on a host computer. The system security policy includes one or more independently configurable security zones. Each security zone corresponds to a group of network locations and may have one or more associated configurable protected operations that control the access to the host system by foreign content downloaded from the computer network. A protected operations may have one or more associated configurable permissions that define the capabilities of the protected operation. Each permission may be defined by one or more parameters and each parameter may be defined by one or more primitives. The permissions may be defined to enable the permission, disable the permission, or prompt the user when the permission is required. The permission may also be configured to the &ldquo;fine grained&rdquo; level of the primitives. Default permission levels that provide predefined parameter and primitive entries that are grouped as high security, medium security, and low security may be selected by the user at most levels of the configuration.

Administering permissions associated with a security zone in a computer system security model

Growing community of inventors

Sammamish, WA, United States of America

Craig T Sinclair