Microsoft Technology Licensing, LLC

Other

Curt Andrew Steeb

Zhangwei Xu

Zeyong Xu

Paul C Sutton

Alexander Frank

Martin Holladay

Munisamy Prabu

William Jefferson Westerinen

Andrew John Fuller

Thomas G Phillips

Matthew P Rhoten

Juan J Perez

Raymond D Pedrizetti

Todd R Manion

Donald F Box

Shiraz Jitendra Cupala

Jeremy Lee Dewey

Min Liu

Christopher Allen Schoppa

Martin James Gudgin

Anthony Vincent Discolo

Kean Ee Lim

Edmund Hon-Sum Lui

Ryan B Elgram

Grant Gardner

Niels Van Dongen

James Duffus

Todd L Carpenter

Jeffrey Alan Herold

Martin D Hall

Michael Gallop

Isaac P Ahdout

Gokul P Thirumalai

Gang Wang

Adrian Mark Chandley

David Jay Foster

Mukesh Karki

James Robert Benton

Seiya Ohta

Ashok Chandrasekaran

Kartik Nadipuram Raghavan

Rajagopal Venkatachalam

David Jaroslav Sebesta

Ricardo Lopez-Barquilla

Shon Schmidt

Stephen Richard Drake

William L Poole

Mark Curtis Light

Nicholas Temple

W Jeff Westerinen

Thomas C Phillips

Richard B Thompson

Raja Venkatachalam

Minghui Gao

Alan R Morin

Device linking is described. In one or more implementations, data is maintained at a network service that describes characteristics of a plurality of devices that are associated with a user account of the network service. A communication is formed to be received by one of the plurality of devices that includes a portion of the data that pertains to another one of the plurality of devices and that is suitable by the receiving device to discover the other one of the plurality of devices to initiate a local network connection between the devices.

Device linking

A virtual machine monitor provides a trusted operating environment for a software usage metering application when a qualified virtual machine monitor is loaded as part of trusted boot and when all other programs and operating systems run in containers managed by the virtual machine monitor. The virtual machine monitor may also host a locking application for limiting the functionality of the computer if contractual terms of use are not met. Both the metering and locking applications run at a higher privilege level than ring 0, at the same level as the virtual machine monitor.

Virtual machine support for metered computer usage

Task sequences are used to manage devices. According to one aspect, a user-defined or user-selected task sequence is received. The task sequence is converted into an ordered series of steps, and the series of steps are performed, in accordance with their order, in managing a device over a network. In certain implementations, the ordered series of steps are steps for automatically deploying an operating system on the device.

Using task sequences to manage devices

A hardware-based security module is used to protect an electronic device, especially a portable electronic device. The security module may determine either via timeout of a watchdog timer or via an explicit message to encrypt selected data on the electronic device. In addition, the electronic device may enter a limited function mode that only allows display of simplistic messages and supports network traffic with a recovery service. The recovery service may be able to use the network traffic to locate the electronic device. The security module may include a secure memory, a cryptographic function, a timer, and support for direct display of data on a monitor.

Hardware-based computer theft deterrence

A client data distribution service may receive messages from a client device requesting data sets from the data distribution service. The data sets may include a client certificate used to protect in verified subsequent communications between the client device in the data distribution service as well as provisioning packets used by the client device to enable operation by the user. Specific messages between the client device in the data distribution service include hardware identifiers, initialization keys, last used sequence numbers, and Underwriter product identifiers. Corresponding acknowledgment messages may be used by the data distribution service to remove completed transactions.

Prepaid and subscription distribution services web methods

An electronic device, such as, a computer, may be adapted for self-monitoring for compliance to an operating policy. The operating policy may specify a pay-per-use or subscription business model and measurements associated with compliant usage. A secure execution environment may measure usage in accordance with the business model as well as monitor and enforce compliance to the operating policy. To increase the difficulty of attacking or otherwise disabling the secure execution environment, elements of the secure execution environment may be distributed. The distribution points may include other functional elements of the computer, such as interface circuits, or may even be remotely located over a network. An implementation method for disaggregating the secure execution environment is also disclosed.

Disaggregated secure execution environment

Described is a mechanism by which application programs (or plug-ins) and an auxiliary service adjust the output and/or data available for output on an auxiliary device based on changes detected in the current context of the auxiliary display. Context sensors detect and report changes in context, whereby some action is taken with respect to what information is displayed or can be displayed on the auxiliary display device. Examples of context data that can change include the physical location of the display, detected movement or motion data, presence of a particular user or others, power state, network connectivity status, privacy status and so forth. The auxiliary device can have context as to its position relative to the main display. Information sensitivity levels may be used to specify whether an application program's data can be displayed, based on the perceived sensitivity of the information and the user's current context.

Context aware auxiliary display platform and applications

A system and method for monitoring a computer, particularly a pay-per-use computer, uses an isolated computing environment or supervisor. The isolated computing environment boots prior to any boot device associated with an operating system, runs concurrently with the operating system and monitors and measures the computer in operation. Once the isolated computing environment determines the computer is not in compliance with the required policies, the isolated computing environment may either impose an impediment to use such as slowing clock speed or completely disable the operating system. The user may have to return the computer to a service provider to restore it from the offending condition and reset the computer to an operational state.

Special PC mode entered upon detection of undesired state

A computer or other electronic device requiring physical integrity of its components, for example, a pay-per-use computer may use a master security device in communication with a plurality of slave security devices, known as security beans. Each security bean may be given a cryptographic key or keys for use in authenticating communication with the master security device. Each security bean may be coupled to an associated component and may have the ability to disable that associated component. In one embodiment, security bean has an analog switch that may be configured to block or attenuate a critical signal used by the associated component. The security bean may start up in the disable mode and respond to a verified signal from the master security device to enable its corresponding component.

Master-slave security devices

Described is an independent computation environment that is built into one or more hardware components of a computer system, wherein the independent computation environment hosts a logic that measures the health of other software code that executes in memory. Examples of ways to measure health include performing a mathematical computation such as a computing a hash/digital signature on the software code in the memory, and/or evaluating statistical information related to the execution of the code and/or the code's being loaded into memory. By executing the logic in an independent computation environment, the health of software code may be measured against policy/metadata in a tamper-proof or tamper-resistant environment. When the software code measurement does not comply with the policy, some action may be taken action to penalize the computer system.

Hardware-aided software code measurement

According to one aspect of task sequence interfaces, a method includes exposing an interface that allows task sequences to be performed on a plurality of remote devices, and receiving requests regarding the task sequences and the plurality of remote devices via the interface. The interface comprises an object model including device objects that represent physical devices in a network, and jobs objects that represent task sequences performed on one or more of the plurality of remote devices.

Task sequence interface

Techniques to provide a secure execution environment are described. In an implementation, a method includes initiating a hardware interrupt by an embedded controller of a computing device. In response to the interrupt, a module is executed that is stored in a basic input/output system (BIOS). The module, when executed, determines whether constrain functionality of the computing device based on a balance.

BIOS based secure execution environment

Growing community of inventors

Redmond, WA, United States of America

Curt Andrew Steeb