Microsoft Technology Licensing, LLC

JianMing M Zhou

David Michael Callaghan

Ravisankar V Pudipeddi

Sachin C Patel

David John Linsley

Geir Olsen

Kinshumann

Dylan D'Silva

Hari R Pulapaka

Benjamin M Schultz

Scott Randall Shell

Frederick Justus Smith

Scott Daniel Anderson

David Bradley Probert, Jr

Giridhar Viswanathan

Charles Glenn Jeffries

Margarit Simeonov Chenchev

Md Nazmus Sakib

Daryn Elliot Robbins

Dale R Rolf

Ian James McCarty

Embodiments are directed to managing software components loaded on a device by identifying a platform manifest having a valid certificate, confirming that the platform manifest is bound to the device, identifying components listed on the platform manifest, confirming that the listed components have a valid certificate, and loading listed components with valid certificates on the device. The components may be binaries and packages for an operating system. The components may be signed in an embedded manner or with detached signatures. The platform manifest may be bound to the device in a manner that allows for identification of unauthorized platform manifests.

Securely defining operating system composition without multiple authoring

Facilities are provided to secure guest runtime environments (GREs). Security policy specifications may be associated with GREs. A GRE's security policy may be specific to the GRE and may also include security policy inherited from higher levels such as a host operating environment. The security policy of a GRE specifies restrictions and/or permissions for activities that may be performed within the scope of execution of the GRE. A GRE's security policy may limit what the GRE's guest software may do within the GRE. Restrictions/permissions may be applied to objects such as files, configuration data, and the like. Security specifications may be applied to execution initiated within a GRE. A GRE's security specification may restrict/permit executable objects from loading and executing within the GRE. The executability or accessibility of objects may be conditioned on factors such as the health/integrity of the GRE, the host system, requested files, and others.

Securing virtual execution environments

Applications are stored on removable storage of a mobile device in an encrypted form to provide isolation and piracy protection. In one implementation, each application is encrypted using its own associated encryption key that is generated based on an identifier of the application and a master key that is associated with a trusted platform module of the mobile device. In another implementation, each application is encrypted using two associated encryption keys. One key is used to encrypt binary data associated with the application such as source code, and the other key is used to encrypt application data such as graphics and configuration files. The encryption keys are each generated using the identifier of the application, the master key, and identifiers of the folders where the corresponding data types are stored on the mobile device. The removable storage includes SD cards formatted using the FAT or exFAT file systems.

Content item encryption on mobile devices

Growing community of inventors

Sammamish, WA, United States of America

JianMing M Zhou