Microsoft Technology Licensing, LLC

Divya Swarnkar

Jan Kotas

Kumar Gaurav Khanna

Zhanliang Chen

David M Kean

Matthew Cohn

Alok Shriram

Eric N St John

Gaye Oncul Kok

Michael J Rayhelson

Michael Rousos

Weitao Su

Mohammad Rahim Bhojani

An enhanced binder provides flexibility and certainty when selecting a version of a software library to load, and an enhanced loader prevents a library version vulnerable to a security flaw from being loaded. The binder can perform unification, implicit override, and/or redirection. Implicit override searches assembly-specific locations for an implicit_version, and override the previously chosen unification or other version with the implicit_version when the implicit_version is greater. The implicit_version gets updated with the individual assembly, whereas the unification_version gets updated with the framework. Redirection may override the implicit_version. Unlike redirection, an implicit_version does not recite an explicit range and is found outside application configuration files. The implicit_version is specified implicitly by the assembly without an XML declaration. Vulnerable libraries are not loaded, based on out-of-band metadata placed in response to a list of known out-of-band assemblies, an out-of-band-servicing attribute, or a custom servicing library.

Out-of-band framework libraries within applications

Growing community of inventors

Redmond, WA, United States of America

Divya Swarnkar