Microsoft Technology Licensing, LLC

Sun Microsystems, Inc.

Oracle America, Inc.

Gabriel E Montenegro

Daniel Ron Simon

Pascal Francis Menezes

Brian D Swander

Christoph L Schuba

Austin N Donnelly

Randall B Smith

Bernard D Aboba

Tim M Moore

Roy D Kuntz

Dwight F Hare

Steven J Drach

Noor-E-Gagan Singh

Samita Chakrabarti

Ho Y Wong

A hierarchical key generation and distribution mechanism for a computer system in which devices are organized into secure enclaves. The mechanism enables network access to be tailored to approximate minimum needed privileges for each device. At the lowest level of the hierarchy, keys are used to form security associations between devices. Keys at each level of the hierarchy are generated from keys at a higher level of the hierarchy and key derivation information. Key derivation information is readily ascertainable, either from identifiers for devices or from within messages, supporting hardware offload of cryptographic functions. Because keys may be generated based on the enclaves in which the hosts participating in a security association are located, the system includes a mechanism by which devices can discover the enclave in which they are located.

Key management in secure network enclaves

Discovery of secure network enclaves

A method for secure configuration of a sensor system involves identifying a new sensor not activated within the sensor system, the new sensor including a new sensor identifier, establishing a first transmission link between the new sensor and a sensor controller, transmitting the new sensor identifier between the sensor and the sensor controller, generating a key pair for the sensor controller, the key pair including a controller public key and a controller private key, generating a key pair for the new sensor, the key pair including a sensor public key and a sensor private key, transmitting the controller public key to the new sensor and the sensor public key to the sensor controller, and generating a pairwise key within the sensor controller and the new sensor.

Secure configuration of a wireless sensor network

Location of a communication network subscriber is determined employing confidence metrics such as remote vs. local computer usage, primary user in a multi-user computing environment, likelihood of forgery, and comparable ones. A fine-grained location determination is then made based on the metric results and directory information for the particular subscriber such that services like emergency services can be provided with accurate location information.

Fine-grained location determination of networked computers

A sensor system includes a controller and sensors, the system configured to ensure unique identity for each device. Methods are provided to generate new identities for those devices having duplicate addresses, and to transmit the new identity information to those devices.

Identity and authentication in a wireless network

Reliably identifying an AP through which a user device is accessing one or more networks, and reliably determining the current network location of the user device. An AP and network location may be reliably identified using a set of transmitter fingerprints unique to the AP or network location, respectively. In response to a user device receiving at least one signal from at least one unknown entity, a transmitter fingerprint set of the at least one entity may be determined from the at least one signal. It then may be determined whether the at least one entity is an AP having an ID known to the user device, and/or whether the current network location is known by the user device. The user device may determine information that may be divulged with the at least one entity based on this determination.

Determining the network location of a user device based on transmitter fingerprints

A patch or set of patches may be deployed, often to a subset of potentially vulnerable systems, to address a particular vulnerability while providing a facility to monitor and, in some cases, characterize post-patch exploit attempts. Often, such a patch will check for an exploit signature and, if an exploit attempt is detected or suspected, take an appropriate action. For example, the patch may include code to log indicative data or trigger such logging. In some exploitations, the patch may generate or contribute to a warning or advisory regarding an additional target (or targets) of the exploit and, if appropriate, initiate a patch or protective measure for the additional target(s). In some exploitations, the patch may simulate responses or behaviors suggestive (to an attacker) of unpatched code. In some exploitations, the patch may direct an exploit attempt to a service (or simulated service) hosted or executing in an isolated protection domain.

Computer security technique employing patch with detection and/or characterization mechanism for exploit of patched vulnerability

A wireless system includes at least one network computing system, a proxy server, a controller, and wireless devices. When a wireless device is already a member of a first group but moves into range of a second group, that device may initiate a request to join the second group, thereby ensuring that the wireless device can send and receive information through the second group. The proxy server maintains a list of authorized wireless devices and their primary controller, thereby routing information from one or more network computing systems to the proper controller, so that the wireless device may receive information from one of those network computing systems as necessary. When the wireless device becomes joined to a new controller, the proxy updates its list, thus ensuring continuity between the wireless device and the one or more network computing systems.

Session mobility for wireless devices

A fingerprint table or other type of data structure including a plurality of entries may be provided, each entry including a transmitter fingerprint set of a respective network location. Determining whether a current network location is a network location known to a user device may include comparing a determined transmitter fingerprint set of the entity with the transmitter fingerprint set of one or more fingerprint table entries. A user interface may be provided that enables a user to control when a transmitter fingerprint set is determined, compared with fingerprint table entries and/or recorded.

User interface and data structure for transmitter fingerprints of network locations

A method for negotiating access to a private network for a mobile node that has migrated beyond the private network. A plurality of tunnel segments are composed with these tunnel segments composing a chain of a registration request from the mobile node to the private network.

Chained registrations for mobile IP

The invention provides a generic naming scheme for remote access and firewall traversal in the form of a uniform resource locator (RAFT URL). The RAFT URL may be provided to any client, regardless of compatibility with the remote access/firewall traversal method, which then launches an operating environment code module. The operating environment code module performs the remote access/firewall traversal method and interacts with the operating environment to obtain data transport mechanisms. These mechanisms permit the client application to transact with private resources beyond the firewall. The remote access/firewall traversal procedure is made transparent to the client application, and thus, a wider array of client applications may be chosen for the data session with the resources beyond the firewall.

Remote access firewall traversal URL

A method and an apparatus allowing a system interfaced with a network to continue functioning in a diminished capacity, even when the system is temporarily disconnected from the network. Unmodified applications running on the system which initiate a network-related operation during system isolation are coerced into a fast-fail behavior by fast-fail mechanisms residing in the system's network layer kernel modules.

Growing community of inventors

Redmond, WA, United States of America

Gabriel E Montenegro