Microsoft Technology Licensing, LLC

Google Inc.

David Benson Cross

Paul J Leach

Thomas C Jones

Scott Field

Philip Joseph Hallin

Jianrong Gu

Duncan G Bryce

Matthew W Thomlinson

Nelly L Porter

Brandon S Baker

Thekkthalackal Varugis Kurien

Kelvin Shek Yiu

Sergey Simakov

Uday R Savagaonkar

Josh D Benaloh

Brendan Power

Andrew T Mason

Monica Ioana Ene-Pietrosanu

Glenn D Pittaway

Ian W Robinson

Kenneth D Ray

Paul England

Mark Fishel Novak

Bryan M Willman

Tanmoy Dutta

Andrew J Ritz

Shishir P Pardikar

Liqiang Zhu

Vishal Agarwal

James A Schwartz, Jr

Rajeev Y Nagar

Rushmi U Malaviarachchi

Pradeep Madhavarapu

Jamie Hunter

Xiaohong Su

Gennady Medvinsky

Benjamin A Leis

Hao Zhuang

Kelvin Sjek Yiu

Karthik Jaganathan

Sunil P Gottumukkala

Varugis Kurien

Kira Radinsky

Christopher J Crall

Pierre Jacomet

Lee Holmes

Ryan M Hurst

Hitesh Raigandhi

George Li

Steven Edward Jackson

Andreas K Luther

Mark E Paley

Derek Norman LaSalle

Nathan Stanley Burkhart

Scott A Field

Satyajit Nath

Manoj Kumar Ampalam

Mayur Kamat

Lonnie Dean McMichael

Joshua Ball

Jainrong Gu

Oded Ye Shekel

Uday Ramesh Savagsonkar

Christopher J c/o Microsoft Corporation Crall

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for instantiating and managing systems that utilize hierarchal enclaves in a cloud environment.

System of enclaves

One aspect relates to a process and associated device for managing digital ID lifecycles for application programs, and abstracting application programs for multiple types of credentials through a common Digital Identity Management System (DIMS) and Application Programming Interface (API) layer.

Digital identity management

Aspects of the subject matter described herein relate to image distribution. In aspects, portions of an installation image of an operating system may be distributed to one or more repositories. In conjunction with determining a distribution of the installation image, one or more factors may be received. Based on the factor(s), a distribution manager may determine one or more repositories over which the data of the installation image is to be distributed. An indication of this distribution may be persisted for use in obtaining the data from the one or more repositories for installing, configuring, and/or re-configuring the operating system.

Software image distribution

An active filter monitors a web browser session to identify executable code transmitted in the session. The executable code may be analyzed to determine if the code is digitally signed. When the code is digitally signed by the web server or by another trusted source, the code may be executed. When the code is neither digitally signed or when the source is not trusted, the code may be rejected and not executed. The filter may be implemented as a web browser component or plugin, as well as a gateway device, proxy, or other service. The filter may also be implemented on the server side to reject incoming data that may include unauthenticated code.

Executable code validation in a web browser

Systems and methods for managing multiple keys for file encryption and decryption may provide an encrypted list of previously used keys. The list itself may be encrypted using a current key. To decrypt files that are encrypted in one or more of the previous keys, the list can be decrypted, and the appropriate previous key can be retrieved. To re-key files, an automated process can decrypt any files using previous keys and encrypt them using the current key. If a new current key is introduced, the prior current key can be used to decrypt the list of keys, the prior current key can be added to the list, and the list can be re-encrypted using the new current key.

Systems and methods for managing multiple keys for file encryption and decryption

An input port for a computer system may retain potentially authenticable requests for processing while removing other connection requests from an incoming queue or request pool. The input port may continue to receive new requests even during a denial of service attack, allowing potentially legitimate requests to be processed. In a typical embodiment, a first in, first out buffer may be used to receive and process connection requests. When the buffer is full, any request that comes from a device having a previous connection with the computer system may be retained for authentication, while removing requests that come from unknown devices. Some embodiments may retain a list of known devices associated with administrators or other known users, and the list may be updated as those users are authenticated.

Denial of service attack resistant input port

A file system is configured for use with files protected by digital rights management (DRM) content controls and to interact both with applications that are, and are not, DRM aware. The file system may be configured for use by two applications, in a manner that may provide the second application with protected files if the first application was previously allowed access. In one example, a user context cache of DRM-protected files is created. The files in the cache may have been decrypted in response to a request(s) from the first application. Subsequent requests from the second application may be received for files within the user context cache of DRM-protected files. At least one of the files within the user context cache of DRM-protected files may be provided to the second application if the second application has a joint user context with the first application.

File system operation and digital rights management (DRM)

Embodiments for providing differentiated access based on authentication input attributes are disclosed. In accordance with one embodiment, a method includes receiving an authentication input at an authentication authority using an authentication protocol. The authentication input being associated with a client. The method also includes providing one or more representations for the authentication input, wherein each of the representations represents an attribute of the authentication input.

Selective authorization based on authentication input attributes

Software is authorized in accordance with a reputation of the software. A trust in the author and/or publisher of the software is determined via digital signatures and/or CoAs, and a reputation of the software is utilized to determine the intent of the software. The reputation of the software can be determined via a local service, such as an enterprise IT department and/or via a reputation determination service. When software is downloaded or to be executed, the trust in the author/publisher is determined using digital signatures and/or CoAs associated with the software. If the author/publisher is determined to be trusted, a service is called to determine the reputation of the software. The software can be installed and/or executed dependent upon the reputation of the software and trustworthiness of the author/publisher.

Software authorization utilizing software reputation

Aspects of the subject matter described herein relate to operating system experience states. Input may be received that requests a change from a current experience state to a target experience state. In response, state data may be obtained that indicates allowed experience states as well as component data that indicates components and relationships between components in the target experience state. This state data may then be used to change from the current experience state to a target experience state. The target experience state may be used, for example, to configure a server or other operating system.

Operating system experience states

One or more labels are associated with a data object. One or more policies are associated with each of the labels. Based on the labels associated with the data objects, the associated policies are dispatched to policy decision engines to take one or more actions to enforce the policy. The labels, and the policies associated with the labels, are chosen by a business administrator within an enterprise, and are implemented by an Information Technology (IT) administrator. The association between labels and polices allows the policy to be applied to an object to be decoupled from the characterization of the nature of the object, or its purpose and/or role within an enterprise, business purpose and/or context of the object. Examples of policies are: access, backup, retention, isolation, audit, etc.

Labeling of data objects to apply and enforce policies

Growing community of inventors

Redmond, WA, United States of America

David Benson Cross