Microsoft Technology Licensing, LLC

David Michael Robinson

Hariharan Sivaramakrishnan

Anthony Nino Bice

Alastair Wolman

Stefan Thom

Stefan Saroiu

Himanshu Raj

David John Linsley

Magnus Nystrom

Jeremiah J Cox

Rob Spiger

Lev Novik

Hari Sivaramakrishnan

Roy Dsouza

Nino Bice

Brian LaMacchia

Tolga Acar

Tarik Soulami

Kalpesh S Patel

Karthik Lakshminarayanan

Lan Duy Nguyen

Henry Jerez Morales

Talha Bin Tariq

In accordance with one aspect of the present disclosure, a request to provide recommendations of data enrichments for a database is received at a recommendation engine. The recommendation engine may perform static and dynamic analysis of data associated with the database and may further refine recommendations based on policies. The recommendation engine may then provide the recommendations, if any, of data enrichments to allow a software developer, for example, to indicate whether the data enrichments are to be used.

Recommending data enrichments

A data custodian and curation system may store data from a data supplier in encrypted form and may allow users to consume the data when the consumers obtain access to the data through an agreement. The curation system may manage access to the data, even allowing a consumer to use the data as if it were their own, but may track each usage of the data to implement a payment scheme or various usage restrictions. The curation system may encrypt downstream uses of the data and operate as a digital rights management system for the data. The custodian and curation system may operate as a cloud service that may contain encrypted data from many data providers but where the data providers may individually control access to their data in a managed system at any granular level.

Data custodian and curation system

A 'Firmware-Based TPM' or 'fTPM' ensures that secure code execution is isolated to prevent a wide variety of potential security breaches. Unlike a conventional hardware based Trusted Platform Module (TPM), isolation is achieved without the use of dedicated security processor hardware or silicon. In general, the fTPM is first instantiated in a pre-OS boot environment by reading the fTPM from system firmware or firmware accessible memory or storage and placed into read-only protected memory of the device. Once instantiated, the fTPM enables execution isolation for ensuring secure code execution. More specifically, the fTPM is placed into protected read-only memory to enable the device to use hardware such as the ARM&#xae; architecture's TrustZone&#x2122; extensions and security primitives (or similar processor architectures), and thus the devices based on such architectures, to provide secure execution isolation within a &#x201c;firmware-based TPM&#x201d; without requiring hardware modifications to existing devices.

Trustzone-based integrity measurements and verification using a software-based trusted platform module

The present invention extends to methods, systems, and computer program products for recommending data sources. A request to provide recommendations of data enrichments for a database is received at a recommendation engine. The recommendation engine may perform static and dynamic analysis of data associated with the database and may further refine recommendations based on policies. The recommendation engine may then provide the recommendations, if any, of data enrichments to allow a software developer, for example, to indicate whether the data enrichments are to be used.

Software-based trusted platform module

The subject disclosure is directed towards enriching database query responses using data from external data sources. When processing a database query seeking enriched data from an external data source, a request is communicated to the external data source based on the database query. An enriched database query response is generated based on data provided by the external data source. The enriched database query response may be combined with data returned via an internal database query operation, and/or inserted into a local database table.

Enriching database query responses using data from external data sources

Described herein are techniques for distributed key management (DKM) in cooperation with Trusted Platform Modules (TPMs). The use of TPMs strengthens the storage and processing security surrounding management of distributed keys. DKM-managed secret keys are not persistently stored in clear form. In effect, the TPMs of participating DKM nodes provide security for DKM keys, and a DKM key, once decrypted with a TPM, is available to be used from memory for ordinary cryptographic operations to encrypt and decrypt user data. TPM public keys can be used to determine the set of trusted nodes to which TPM-encrypted secret keys can be distributed.

Key management using trusted platform modules

Firmware-based trusted platform module for arm processor architectures and trustzone security extensions

A method and a processing device are provided for detecting a hardware-based virtual machine environment. An execution time of a privileged instruction may be measured and an execution time of a nonprivileged instruction may be measured. The execution time of the privileged instruction may be compared with the execution time of the nonprivileged instruction. When the execution time of the privileged instruction exceeds the execution time of the nonprivileged instruction by at least a threshold or a threshold factor, then a hardware-based virtual machine environment is detected. In some embodiments, a well-known technique for detecting a software-based virtual machine environment may be used in conjunction with a technique for detecting a hardware-based virtual machine environment. A licensing policy of a software product may be accessed and the software product may be prevented from executing when a detected machine environment is in violation of the licensing policy.

Detection of hardware-based virtual machine environment

Growing community of inventors

Snohomish, WA, United States of America

David Michael Robinson