Microsoft Technology Licensing, LLC

Duncan G Bryce

David Benson Cross

Jianrong Gu

Scott Field

Kenneth D Ray

Krassimir Emilov Karamfilov

Kelvin Shek Yiu

Pankaj Mohan Kamat

Monica Ioana Ene-Pietrosanu

Paul J Leach

Charles W Kaufman

William R Tipton

Andrew J Ritz

Scott C Cottrille

Andrew M Herron

Shishir P Pardikar

Jonathan D Schwartz

Ravindra Pandya

James A Schwartz, Jr

Rajeev Y Nagar

Vijay G Bharadwaj

Gregory Kostal

Vladimir Yarmolenko

Pradeep Madhavarapu

Benjamin A Leis

Matthew Charles Setzer

Yuhui Zhong

Kelvin Sjek Yiu

John Richard McDowell

Mike Hamburg

Jainrong Gu

Scott A Field

Systems and methods for managing multiple keys for file encryption and decryption may provide an encrypted list of previously used keys. The list itself may be encrypted using a current key. To decrypt files that are encrypted in one or more of the previous keys, the list can be decrypted, and the appropriate previous key can be retrieved. To re-key files, an automated process can decrypt any files using previous keys and encrypt them using the current key. If a new current key is introduced, the prior current key can be used to decrypt the list of keys, the prior current key can be added to the list, and the list can be re-encrypted using the new current key.

Systems and methods for managing multiple keys for file encryption and decryption

The present invention extends to methods, systems, and computer program products for licensing protected content to application sets. Embodiments of the invention permit a local machine to increase its participation in authorizing access to protected content. For example, an operating system within an appropriate computing environment is permitted to determine if an application is authorized to access protected content. Thus, the application is relieved from having to store a publishing license. Further, authorization decisions are partially distributed, easing the resource burden on a protection server. Accordingly, embodiments of the invention can facilitate more robust and efficient authorization decisions when access to protected content is requested.

Licensing protected content to application sets

The secure application of content protection policies to content. The secure application of content protection polices is accomplished by having an enforcement mechanism monitor policy application points to detect the transfer of content. The enforcement mechanism accesses the content and a determination is made to protect the content. A usage policy is then identified by the enforcement mechanism to apply to the content and the usage policy is then applied to the content, resulting in a usage policy for the content.

Automatic application of information protection policies

In a storage system, multiple information units are individually associated with an access control policy (ACP) of multiple ACPs. Each respective information unit corresponds to a respective information unit encryption key (IUEK). The multiple information units are grouped into encryption zones based on their associated ACPs. In a described implementation, each ACP is associated with a zone root key (ZRK). In another described implementation, each IUEK corresponding to a given information unit is encrypted by an IUEK corresponding to an information unit at a most-proximate linked node of the storage system.

Access control and encryption in multi-user systems

A system and method for facilitating BIOS integrated encryption is provided. An interface is defined between the operating system and the BIOS. The operating system employs this interface to provide BIOS code information to facilitate decryption of data that is encrypted on the system. In the pre-operating system boot phase, the BIOS employs the decryption information provided from this interface in order to decrypt the data. The decrypted information can be employed to facilitate secure rebooting of a computer system from hibernate mode and/or secure access to device(s).

BIOS integrated encryption

An operating system copies data from memory pages into a paging file on disk, in order to free up space in the memory. A mechanism is disclosed that causes the data to be encrypted as it is copied into the paging file, thereby protecting the paged data from unauthorized (or otherwise undesired) observation. The data that is stored in the paging file is encrypted with a session key, that is generated shortly after the machine on which the paging file exists is started. The session key, which is used both for encryption and decryption of the paging file data, is stored in volatile memory, so that the key is not persisted across boots of the machine. Since the key is not persisted across boots, old paging file data that was stored prior to the most recent boot cannot be recovered in clear text, thereby protecting the data from observation.

Encryption of system paging file

An encrypted file system (EFS) and an underlying file transfer protocol to permit a client to encrypt, decrypt, and transfer file(s) resident on a server are disclosed. A user at a client computer can open, read, and write to encrypted files, including header information associated with encrypted files, and can add users to or remove users from an encrypted file.

System, method, and computer program product for file encryption, decryption and transfer

Growing community of inventors

Redmond, WA, United States of America

Duncan G Bryce