Microsoft Technology Licensing, LLC

Intel Corporation

Erik Lee Holt

Stefan Thom

Carl Melvin Ellison

Shivaram H Mysore

Valerie Kathleen Bays

Russell Humphries

Shon Eizenhoefer

Matthew E Kowalczyk

Kevin M Litwack

Yash Gandhi

Scott Daniel Anderson

Kenneth D Ray

Octavian Tony Ureche

Ning Zhang

Hakki Tunc Bostanci

Krishna Kumar Ganesan

Mikael P Horal

Sudhakar Otturu

Peter Nicholas Biddle

Vandana Gunupudi

Yash Ashok Kumar Gandhi

Image based login procedures for computer systems include: (a) displaying a first image on a computer screen; (b) receiving user input indicating a portion of the first image; (c) determining if the user input corresponds to a first acceptable user input for user authentication; and (d) proceeding with the authentication procedure when this user input corresponds to the first acceptable user input for user authentication. Additionally or optionally, when proceeding with this authentication procedure, the systems and methods further may include: displaying a second image on the screen; receiving new user input indicating a portion of the second image; and determining if this new input corresponds to a second acceptable user input for user authentication.

Image or pictographic based computer login systems and methods

Technologies to enable, disable and control hardware subscription features. Computing devices communicate over a network to a subscription server to provide hardware platform information for each of the computing devices. As the subscription server receives hardware platform information, the subscription server determines the hardware features that are enabled, and further determines what hardware subscription options are available for each of the computing devices. When a hardware subscription option is selected/purchased by a computing device, subscription server provides a pre-boot update mechanism, such as a Unified Extensible Firmware Interface (UEFI) capsule, to act as a boot level program that enables hardware features on the computing device. Hardware subscription features are also securely protected using cryptographic engine modules.

Technologies for providing hardware subscription models using pre-boot update mechanism

Techniques are provided to allow remote initialization of a Trusted Platform Module. The results may be trusted and confidential even if the target device has malicious operating system or other software running.

Trusted and confidential remote TPM initialization

Systems, methods, and technologies for configuring a conventional smart card and client machine, and for performing a smart card authorization using the configured smart card and client. Further, the combination of methods provides for mutual authentication&#x2014;authentication of the client to the user, and authentication of the user to the client. The authentication methods include presenting a specified token to the user sufficient to authenticate the client to the user and thus protect the user-provided PIN. Security is strengthened by using an integrity key based on approved client system configurations. Security is further strengthened by calculating a PIN' value based on a user-specified PIN and a modifier and using the PIN&#x2032; value for unlocking the smart card.

Integrity protected smart card transaction

Certification of a key, which a Trusted Platform Module (TPM) has attested as being non-migratable, can be performed in a single round trip between the certificate authority (CA) and the client that requests the certificate. The client creates a certificate request, and then has the TPM create an attestation identity key (AIK) that is bound to the certificate request. The client then asks the TPM to sign the new key as an attestation of non-migratability. The client then sends the certificate request, along with the attestation of non-migratability to the CA. The CA examines the certificate request and attestation of non-migratability. However, since the CA does not know whether the attestation has been made by a trusted TPM, it certifies the key but includes, in the certificate, an encrypted signature that can only be decrypted using the endorsement key of the trusted TPM.

Key certification in one round trip

Systems, methods, and technologies for configuring a conventional smart card and a client machine, and for performing a smart card authorization using the configured smart card and client. Further, the combination of methods provides for mutual authentication&#x2014;authentication of the client to the user, and authentication of the user to the client. The authentication methods include presenting a specified token to the user sufficient to authenticate the client to the user and thus protect the user-provided PIN. Security is strengthened by using an integrity key based on approved client system configurations. Security is further strengthened by calculating a PIN' value based on a user-specified PIN and a modifier and using the PIN&#x2032; value for unlocking the smart card.

A Trusted Activation License (TAL) can be comprised of a key unique to a Trusted Platform Module (TPM) and identifying information of the software applications bundled with the computing device having that TPM. To activate the software applications, the identifying information in the TAL can be compared against that of the software applications being activated, and the unique TPM key in the TAL can be compared against that of the TPM on the computing device on which the activation is taking place. Subsequent validations can be based on a protected association between the TAL and an Attestation Identity Key (AIK) that can be generated by the TPM as part of the activation step. Optionally, Platform Configuration Registers (PCRs) of the TPM can be periodically changed during validation to protect against useage of one TPM for validations on multiple computing devices.

TPM-based license activation and validation

Growing community of inventors

Redmond, WA, United States of America

Erik Lee Holt