Microsoft Technology Licensing, LLC

Crispin Cowan

Paul J Leach

Scott Field

Chris J Guzak

John Michael Sheehan

Tanmoy Dutta

Anshul Rawat

Thomas C Jones

Vishal Agarwal

John J Lambert

Daniel Oliver

David Charles LeBlanc

Ryan Charles Colvin

Juan-Lee Pang

Elliott Jeb Haber

Karanbir Singh

Ameya S Bhatawdekar

Matthew Z Tamayo-Rios

James Dooley

Andy Davidson

Greg Domzalski

Jay Dave

Xiang Tu

Aspects of the technology described herein can provide enhanced metadata to authentically report the provenance of a file. An exemplary computing device may have a file broker to receive an indication from a first security principal to write a file to a file system. The file broker can use one file utility to write the file, but use another file utility to write an identification of the first security principal and its opinion about the file into metadata associated with the file. Subsequently, the identification of the first security principal and its opinion may be used to authentically report the provenance of the file and applied in other security applications.

Enhanced metadata to authentically report the provenance of a file

Computer-executable instructions that are directed to the performance of consequential actions and automatically elevate to execute at a higher privilege level to do so can perform such consequential actions only after user notification. Doing so can enable monitoring processes to avoid presenting duplicative user notification upon detection of such auto-elevation. In addition, prior to presenting user notification, input from the execution environment can be ignored and access to DLLs for performing consequential actions can be avoided. A static analyzer can identify non-conforming computer-executable instructions. A wrapper can be utilized to provide compliance by otherwise unknown or non-conforming computer-executable instructions.

Unobtrusive assurance of authentic user intent

The reputation of an executable computer program is checked when a user input to a computing device initiates a program launch, thus triggering a check of a local cache of reputation information. If the local cache confirms that the program is safe, it is permitted to launch, typically without notifying the user that a reputation check has been made. If the local cache cannot confirm the safety of the program, a reputation check is made by accessing a reputation service in the cloud. If the reputation service identifies the program as safe, it returns an indication to the computing device and the program is permitted to be launched, again without notifying the user that a reputation check has been made. If the reputation service identifies the program as unsafe or potentially unsafe, or does not recognize it at all, a warning is displayed to the user.

Reputation checking of executable programs

Growing community of inventors

Bellevue, WA, United States of America

Crispin Cowan