Microsoft Technology Licensing, LLC

David Charles LeBlanc

Brian Thomas Carver

Daniel Browne Jump

Benjamin E Canning

Joshua Michael Pollock

Benjamen E Ross

Vikas Malhotra

James Campbell

Scott Field

Robert Andrew Little

John Michael Sheehan

Steven Miles Greenberg

Christopher M White

Eric B Fox

Tolga Acar

Alexandru Gavrilescu

Art Shelest

Gareth Alan Howell

Pierre-Yves Santerre

Vishal Agarwal

Jonathan Lee Burstein

Thomas Scott Coon

Adam D Barr

Dennis A Morgan

Juan-Lee Pang

Ramesh Chinta

Benjamin J Bunker

Ambrose Thomas Treacy

Matthew Michael Swann

Maithili Dandige

Kiran Akella Venkata

Juraj Gottweis

Samantha Schumacher

Crispin Cowan

Aaron Everett Erlandson

Muhammed Serdar Soran

Venkataramann Renganathan

Ray S Wang

Greg Domzalski

S Franklin Williams

Samuel Ira Weiss

Ramsey Dow

Concepts and technologies are described herein for sharing encrypted data with enhanced security. In some configurations, an encryption key is generated from a password by the use of a password-based key generation technology. In addition, input data is encrypted using the encryption key. The encrypted data and the generated key may be then shared with a remote computer, such as a server. The encrypted data can then be decrypted at the remote computer by the use of the key. By the use of the technologies described herein, the contents of an encrypted file may be accessed at a remote computer without requiring a user to share the actual password.

Sharing encrypted data with enhanced security by removing unencrypted metadata

Architecture that provides a secure environment in which data (e.g., code, instructions, files, images, etc.) can be opened and run by a client application. Once opened the data can be viewed (in a 'protected view') by the user without incurring risk to other client processing and systems. Accordingly, the architecture mitigates malicious attacks by enabling users to preview untrusted and potentially harmful data (e.g., files) in a low risk manner. Files opened in the protected view are isolated from accessing key resources on the client computer and provides the user a safer way to read files that can contain dangerous content. The protected view also provides a seamless user experience. The user is unaware that the client is operating on data in a different mode and allows for the reduction of security prompts.

Isolation and presentation of untrusted data

Aspects of the technology described herein can provide enhanced metadata to authentically report the provenance of a file. An exemplary computing device may have a file broker to receive an indication from a first security principal to write a file to a file system. The file broker can use one file utility to write the file, but use another file utility to write an identification of the first security principal and its opinion about the file into metadata associated with the file. Subsequently, the identification of the first security principal and its opinion may be used to authentically report the provenance of the file and applied in other security applications.

Enhanced metadata to authentically report the provenance of a file

A candidate identifier for a process is generated and an attempt is made to have a named object created that has a name that is the candidate identifier. In response to the attempt succeeding and the named object being created, the candidate identifier is used as an identifier for the process. In response to the attempt not succeeding and the named object not being created, the generating and attempting are repeated.

Identifier generation using named objects

A method for creating a password on an electronic computing device is disclosed. On the electronic computing device, a first password is obtained. The first password comprises a string of one or more characters. A first character is appended to the first password to form a second password. A hash function is applied to the second password to generate a first hashed password. The first hashed password comprises a first bit string. A determination is made as to whether the first hashed password includes a predefined sequence of bits. When it is determined that the first hashed password includes the predefined sequence of bits, the second password is designated as an auditable password.

Method for generating and detecting auditable passwords

Systems and methods for creating a secure process on a web server can include creating an application manager process, and creating an application host process, the application host process being created under control of the application manager process. Example methods can also include restricting attributes of the application host process, and assigning a unique logon identifier to the application host process so that the application host process can only communicate with the application manager process.

System for running potentially malicious code

A secure hash, such as a Hash-based Message Authentication Code ('HMAC'), is generated using a piece of secret information (e.g., a secret key) and a piece of public information specific to each escrow key (e.g., a certificate hash or public key). Using the secret key ensures that escrow key validation data can only be generated by knowing the secret key, which prevents an attacker from generating the appropriate escrow key validation data. Using the certificate hash as the public data ties each escrow key validation data to a particular certificate, thereby preventing the attacker from simply copying the validation data from another escrow key. Any escrow key that is found to be invalid may be removed from the file container and a system audit log may be generated so that a company, individual, or other entity can be aware of the possible attempt at a security breach.

Detection of invalid escrow keys

The role of a system in a network may be categorized as a networking system, a security system, a systems management system, a mail system, a database system, a web system, a file/print system, a communication and collaboration system, and/or any other system in the network. The role of a target system may be determined by sending test probes to one or more systems in a target network. The test probes may be data packets crafted to produce a particular response from a target system. The received responses may be compared to signature responses of a basis system with known operating system, services, and/or roles. By matching the received responses with signature responses, a role resolver may associate a role with the target system.

Network system role determination

Techniques are provided for performing memory diagnostics. A portion of physical memory is locked using functionality included in an operating system. At least one memory diagnostic test is executed on the portion producing a result. It is determined, in accordance with the result, whether a memory problem exists for the portion of physical memory.

Techniques for performing memory diagnostics

Embodiments are described for removing malicious code from a file in a first file format by converting the file into a converted file of a second file format. In embodiments, converting the file eliminates malicious code embedded within the file from being stored in the converted file. The conversion is performed within a restricted computer process that has restricted privileges limiting its access to an operating system and an underlying computer system. As a result, even if malicious code embedded within the file executes while the file is being converted into the converted file, the damage to a computer system is mitigated because of the limited privileges provided to the restricted process.

File conversion in restricted process

A method for a firewall-aware application to communicate its expectations to a firewall without requiring the firewall to change its policy or compromise network security. An application API is provided for applications to inform a firewall or firewalls of the application's needs, and a firewall API is provided that informs the firewall or firewalls of the application's needs. An interception module watches for connect and listen attempts by applications and services to the network stack on the local computer. The interception module traps these attempts and determines what user is making the attempt, what application or service is making the attempt, and conducts a firewall policy look-up to determine whether the user and/or application or service are allowed to connect to the network. If so, the interception module may instruct the host and/or edge firewall to configure itself for the connection being requested.

Method of assisting an application to traverse a firewall

Growing community of inventors

Monroe, WA, United States of America

David Charles LeBlanc