Microsoft Technology Licensing, LLC

Helen Jiahe Wang

Alexander Nikolavich Moshchuk

Paramvir Bahl

Philip Andrew Chou

Daniel Ron Simon

Venkata N Padmanabhan

Xiaofeng Fan

Yi-Min Wang

John David Dunagan

Jonathan Ryan Howell

Jacob Rubin Lorch

Chad E Verbowski

Tadayoshi Kohno

Bryan Jeffrey Parno

Franziska Roesner

Zhenbin Xu

Mansoor A Malik

Collin Edward Jackson

Rajesh S Batheja

Adrienne Porter Felt

Samuel King

Systems and methodologies for accessing resources associated with a Web-based application in accordance with one or more embodiments disclosed herein may include a browser that obtains at least first resources from a first domain and second resources from a second domain and a resource management component that facilitates controlled communication between the first resources and the second resources and prevents the first resources and the second resources from accessing other resources that the first resources and the second resources are not permitted to access. The resource management component may be further operable to contain restricted services in a sandbox containment structure and/or to isolate access-controlled resources in a service instance. In addition, the resource management component may be operable to facilitate the flexible display of resources from disparate domains and/or controlled communication therebetween.

Protection and communication abstractions for web browsers

A user interface may be utilized to allow a user to control display properties of online ad content on a hosting webpage (e.g., hosting ads from one domain on a webpage from a different domain). This may be accomplished by creating a cross-domain frame in the hosting webpage, which can contain the ad content. An instantiation of a user interface may be created on the hosting webpage that has an ability to control display properties of the cross-domain frame, thereby controlling display properties of the ad content in the cross-domain frame. Further, a task manager may be utilized as part of the user interface to facilitate a host of the hosting webpage to manage ad content.

User interface for online ads

An access system is described herein which allows an application module to access a user-owned resource based on an indication of a user's intent to interact with the user-owned resource. For example, the application module can provide an application user interface which embeds a gadget associated with a particular user-owned resource. The access system can interpret the user's interaction with the gadget as conferring implicit permission to the application module to access the user-owned resource associated with the gadget. In addition, or alternatively, the user may make a telltale gesture in the course of interacting with the application module. The access system can interpret this gesture as conferring implicit permission to the application module to access a user-owned resource that is associated with the gesture.

User-driven access control

Methods and systems for preventing permission re-delegation among applications are disclosed herein. The method includes accepting a message requesting access to a user-controlled resource from a requester application at a deputy application and reducing a first permissions list of the deputy application to a second permissions list. The second permissions list includes an overlap of permissions between the deputy application and the requester application. Moreover, the method also includes sending the message from the deputy application to a computing system via an application programming interface (API), wherein the computing system is configured to reject the message if the second permissions list of the deputy application does not permit access to the user-controlled resource.

Permission re-delegation prevention

Techniques for providing resource sharing in a multi-principal browser are described. Resource sharing includes managing a resource for web entity by determining how to divide the resource to share among two or more web entities based at least in part on a Document Object Model (DOM)-recursive resource allocation policy or an application-specified resource allocation policy. A web entity includes a principal instance contending for the resource. The process identifies resource allocation mechanisms from each resource type based at least in part on the DOM-recursive sharing policy or the application-specified resource allocation policy along with the resource type.

Resource sharing in multi-principal browser

In an embodiment of isolation environment-based information access, programs&#x2014;including operating systems and applications&#x2014;running on a computing-based device can be isolated in an environment such as a virtual machine. Information including commands and/or data transmitted between the computing-based device and the program(s) being run, as well as information associated with the program(s) and the computing-based device, is accessed without being detected by the program(s). In one implementation, the information includes state information as well as commands and/or data&#x2014;including sensitive information, such as usernames and passwords. In another implementation, the information can be used to secretly access the program(s).

Isolation environment-based information access

In an exemplary method implementation, a method includes: designating a neighborhood administrator; receiving notification of a delinquent router from the designated neighborhood administrator; and excluding the delinquent router responsive to the notification. In an exemplary mesh router implementation, a mesh router is capable of establishing a wireless mesh network with other mesh routers, the mesh router is further capable of designating a neighborhood administrator mesh router; and the mesh router is adapted to exclude another mesh router that is associated with a particular certificate when the particular certificate has been identified as delinquent by the designated neighborhood administrator. mesh router.

Mesh networks with exclusion capability

An exemplary router performs actions including: receiving at least one certificate from an end device, the at least one certificate issued by another router; ascertaining if the other router is a member of a predetermined neighborhood; determining if the at least one certificate is valid; and if the other router is ascertained to be a member of the predetermined neighborhood and the at least one certificate is determined to be valid, recognizing the end device as privileged. An exemplary mesh router is capable of establishing a wireless mesh network with other mesh routers, the mesh router is further capable of designating a neighborhood administrator mesh router; and the mesh router is adapted to grant privileged status to a particular end device associated with a particular certificate issued by a particular mesh router when the particular mesh router is a member of a neighborhood of the designated neighborhood administrator mesh router.

Mesh networks with end device recognition

A data sequence may be encoded in a plurality of layers of multiple description coding. The layers of multiple description coding may include a first and a second layer of multiple description coding. The first layer of multiple description coding may include an initial part of a data sequence as well as forward error correction code for the initial part. The second layer of multiple description coding may include a next part of the data sequence as well as forward error correction code for the next part. A first set of data sequence breakpoints may be determined for the first layer of multiple description coding. A second set of data sequence breakpoints may be determined for the second layer. The data sequence may be encoded in the plurality of layers of multiple description coding as a function of the first and second sets of data sequence breakpoints.

Growing community of inventors

Issaquah, WA, United States of America

Helen Jiahe Wang