Microsoft Technology Licensing, LLC

Amazon Technologies, Inc.

Himanshu Soni

Nelly L Porter

Peter Dawoud Shenouda Dawoud

Dustin Michael Ingalls

Stefan Thom

Anoosh Saboori

Marc R Barbour

Robert Karl Spiger

Kyle James Krum

Prabu Raju

Kirk Shoop

Nick Voicu

Xintong Zhou

Octavian Tony Ureche

Peter David Waxman

Vijay G Bharadwaj

Preston Derek Adam

Sai Vinayak

Arthur Baker

Nicolae Voicu

Cristian Stefan Salvan

Christopher Edward Fenner

Kam Kouladjie

Magnus NystrÖm

Gabriel Fortunato Stocco

Jonathan D Schwartz

Magnus Nyström

Giridhar Viswanathan

Gopinathan Kannan

Violet Anna Barhudarian

Christopher Leonard Walstad

Magnus Nystrom

Vijay Bharadwaj

Anooshiravan Saboori

Dayi Zhou

Fengfen Liu

Karanbir Singh

Jeremy Dominic Viegas

Matt Adams

Levi P Broderick

Jeffrey Edwin Shipman

Ryan Segeberg

Peter Dawoud

John D T Wood

Anjana Singh

Gridhar Viswanathan

Prateek Thukral

Kapil Gulati

Reed Molbak

Klaudia Leja

Arthur H Baker

Jonathan David Schwartz

Jeremy D Viegas

This disclosure describes, in part, techniques for providing add-ons associated with network applications. For instance, a user may be controlling an application that is executing on a remote system using a control device and a display device. While the application is executing, the remote system may send user interface data to the display device, where the user interface data represents a user interface that includes add-ons that may be acquired for the application. If the user selects an add-on, the display device may communicate with a payment system in order to acquire the add-on. The remote system may then determine that the user acquired the add-on using data received from the display device and/or data received from a management system associated with the application. As such, the remote system may enable the add-on for the user within the application.

Providing add-ons for network applications

Techniques described herein leverage a trusted entity within a domain to enable devices to establish trust with one another so they can securely discover each other and connect to one another. In various examples discussed herein, a device is configured to provide trust information to, and/or receive trust information from, the trusted entity. The trust information may include, for example, a public key of an encryption key pair, a certificate signed by the trusted entity proving authenticity, and/or a hash function and a hash seed used to compute a series of results that form a hash chain. The device may use the trust information to discover another device and to connect to the other device securely and automatically (e.g., with no user involvement or limited user involvement). Moreover, the device may use the trust information to dynamically change a MAC address being used to communicate with the other device.

Establishing trust between two devices

The present invention provides for streamlined issuance of certificates and other tokens that are contingent on key attestation of keys from a trusted platform module within a computing platform. Various methods are described for wrapping the requested token in a secret, such as an AES key, that is encrypted to a TPM based key in a key challenge. If the requesting platform fails the key challenge, the encrypted certificate or token cannot be decrypted. If requesting platform passes the challenge, the encrypted certificate or token can be decrypted using the AES key recovered from the key challenge.

Key-attestation-contingent certificate issuance

A facility for enrolling a software implementer in a code signing. In one example facility, the facility receives information identifying the implementer, and credentials authenticating the implementer. The facility generates secret state for the implementer. Based on at least one or both of (1) at least a portion of the received credentials and (2) at least a portion of the generated secret state, the facility generates for the implementer a key pair comprising a private key and a public key, and persistently stores the secret state.

Code signing service

Presence based content access control techniques are described in which presence of users is used as a basis for enforcing content restrictions. In an implementation, applications are registered to receive feedback regarding users' presence in relation to a presentation of content via a computing device. The presence of users is recognized independently of authentication of the users to access user accounts. For example, an imaging sensor such as camera may be employed for recognition of multiple users engaged with the computing device. In addition or alternatively, presence devices associated with users such as badges, key fobs, or access cards may be detected to ascertain the presence of users. Feedback indicative of the one or more users that are recognized may then be supplied to the registered applications. The feedback enables the applications to control the presentation of content by enforcing content restrictions and/or taking other presence based actions.

Presence-based content control

In one embodiment, a user login device may create a user identifier templatefor identifying a user by implicitly capturing one or more biometric identifier readings. A user login device may capture an enrollment biometric identifier reading of a user during an operational user action. The user login device may apply the enrollment biometric identifier reading in creating a user identifier template

Informed implicit enrollment and identification

A system for bootstrap provisioning of a device is provided. A vouching device is provisioned to access a bootstrap account of a bootstrap account provider and a secondary account of a secondary account provider. The bootstrap account provider stores an indication of the secondary account, and the secondary account provider stores verification data to verify a certification of the vouching device. A target device is provisioned to access the bootstrap account of the bootstrap account provider. The target device receives from the bootstrap account provider an indication that the target device is provisioned with the secondary account provider. The target device directs generation of a certification by the vouching device of target authentication data of the target device. The target device then sends the certification to the secondary account provider to effect the provisioning of the target device to access the secondary account.

Automatic provisioning of a device to access an account

Described herein are techniques for regulating access to a remote resource using two-factor authentication based on information regarding a host machine of a portable storage drive that stores an operating system that is booted by the host machine. The information regarding the host machine of a portable storage drive may be used as a second factor in a two-factor authentication. Such information regarding the host machine may include, in some embodiments, information retrieved from a secure storage of the host machine, such as from a cryptoprocessor of the host machine. The information may include an identifier for the host machine or may be a user credential pre-provisioned to the host machine to be used in two-factor authentication.

Regulating access using information regarding a host machine of a portable storage drive

The techniques and systems disclosed herein pertain to preventing unauthorized access to computing resources by unauthorized persons by deploying biometric security. To implement biometric security, the computing device, possibly by the OS, may obtain samples of one or more biometric factors unique to the owner. The computing device may construct pattern-matching templates corresponding to the biometric samples, which may be stored for later use when a protected resource is requested. Computing resources may be selected for protection by a biometric security mechanism by an authorized user or by other techniques or default settings. Before allowing certain restricted actions, the OS may request that the user provide one of the previously registered biometric samples. If the biometric sample matches the user's stored pattern-matching template, the OS may grant access to the computing resource, otherwise, the OS may deny access to the computing resource.

Resource management based on biometric data

Growing community of inventors

Bothell, WA, United States of America

Himanshu Soni