Microsoft Technology Licensing, LLC

Daniel Browne Jump

David Charles LeBlanc

Joshua Michael Pollock

Brian Thomas Carver

Vikas Malhotra

Benjamin E Canning

Benjamen E Ross

James Campbell

Li Hua

Isaac E Nichols

Ravishankar Shanmugam

David Ornstein

Amit Date

Ali Deniz Demircioglu

Venkataramann Renganathan

Bradley Albrecht

Samuel Ira Weiss

Jonathan Birch

David Charles Leblanc

Architecture that provides a secure environment in which data (e.g., code, instructions, files, images, etc.) can be opened and run by a client application. Once opened the data can be viewed (in a 'protected view') by the user without incurring risk to other client processing and systems. Accordingly, the architecture mitigates malicious attacks by enabling users to preview untrusted and potentially harmful data (e.g., files) in a low risk manner. Files opened in the protected view are isolated from accessing key resources on the client computer and provides the user a safer way to read files that can contain dangerous content. The protected view also provides a seamless user experience. The user is unaware that the client is operating on data in a different mode and allows for the reduction of security prompts.

Isolation and presentation of untrusted data

A candidate identifier for a process is generated and an attempt is made to have a named object created that has a name that is the candidate identifier. In response to the attempt succeeding and the named object being created, the candidate identifier is used as an identifier for the process. In response to the attempt not succeeding and the named object not being created, the generating and attempting are repeated.

Identifier generation using named objects

Techniques to store secret information for global data centers securely may provide a front end service for a back end data store. The front end service may be responsible for deployment, upgrade, and disaster recovery aspects, and so forth, of data center maintenance. Data centers may access data and data-related services from the back end data store through the front end service. Secrets that are needed to access secure data may be stored on behalf of the data centers without providing the secrets to the data centers.

Techniques to store secret information for global data centers

A secure hash, such as a Hash-based Message Authentication Code ('HMAC'), is generated using a piece of secret information (e.g., a secret key) and a piece of public information specific to each escrow key (e.g., a certificate hash or public key). Using the secret key ensures that escrow key validation data can only be generated by knowing the secret key, which prevents an attacker from generating the appropriate escrow key validation data. Using the certificate hash as the public data ties each escrow key validation data to a particular certificate, thereby preventing the attacker from simply copying the validation data from another escrow key. Any escrow key that is found to be invalid may be removed from the file container and a system audit log may be generated so that a company, individual, or other entity can be aware of the possible attempt at a security breach.

Detection of invalid escrow keys

Systems and methods for changing items of a computer file, such as an archive file, can include an application programmed to create a file including a first item and a second item, the application storing the file on a storage medium. Systems can also include an input/output module associated with the application, the input/output module retiring the first item upon a change to the first item resulting in an increase or a decrease in a size of the first item. Upon retiring the first item, the input/output module can write a third item at an end of the file, the third item including the change to the first item. Methods can include retiring the first item upon a change to the first item, and writing a third item after the second item, the third item including the change to the first item.

Systems and methods for changing items in a computer file

Systems and methods for changing items of a computer file can include a storage medium, and an application programmed to create a file including a first item and a second item, the application storing the file on the storage medium, and the first item including padding. The system can also include an input/output module associated with the application, the input/output module being programmed to use at least a portion of the padding of the first item to accommodate a change in a size of the first item. A method can include providing a file including at least a first item and a second item, the first item including padding, changing the first item, and using at least a portion of the padding of the first item to accommodate a change in a size of the first item.

Growing community of inventors

Redmond, WA, United States of America

Daniel Browne Jump