Microsoft Technology Licensing, LLC

John D DeTreville

Paul England

Butler W Lampson

Galen Clyde Hunt

James R Larus

Martin Abadi

Trishul A Chilimbi

Michael B Jones

Edward Pearce Wobber

Brian LaMacchia

Manuel Alfred Fahndrich

Bob Atkinson

Xin Wang

Steven P Levi

Bryan M Willman

Benjamin Zorn

Wolfgang Grieskamp

Thomas Michael Roeder

Muthukrishnan Paramasivam

Thomas DeMartini

A declarative approach is used for system configuration. The declarative approach improves a system's integrity which makes the system more dependable. An overall system model is defined that describes the system as a whole. The models are hierarchical and can reference and incorporate any number of sub-models. The models within the system model are used to define the programs within the system. The system model is applied to a collection of system parameters that produces a statically typed, fully configured system instance. Each system instance may then be checked against established system policies that can express a variety of additional ad hoc rules defining which system instances are acceptable.

Declarative system configurations

Described herein is an implementation of a technology for the construction, identity, and/or optimization of operating-system processes. At least one implementation, described herein, constructs an operating-system process having the contents as defined by a process manifest. Once constructed, the operating-system process is unalterable.

Operating-system process construction

A computer-implemented mechanism for granting rights is described. A license may be used to identify one or more principals, resources, rights and conditions. The license also identifies a license format scheme and a license format modification scheme. An access control module or other entity may interpret the license in accordance with the license format scheme and license format modification scheme.

Substitution groups/inheritance for extensibility in authorization policy

Described herein is an implementation of a technology for the construction, identification, and/or optimization of operating-system processes. At least one implementation, described herein, constructs an operating-system process having the contents as defined by a process manifest. Once constructed, the operating-system process is unalterable.

Operating system process identification

A computer-implemented mechanism for granting rights to a resource is described. A license identifies-one or more principals, resources, rights and conditions. At least one condition recited in the license includes a reference to state information. The state information is external to the license. When evaluating the license, a resource or access control module requests the state information from the entity identified in the reference to state information.

State reference

Inter-process interference elimination

A computer-implemented mechanism for granting rights to a resource is described. A license identifies one or more principals, resources, rights and conditions in fields of the license. The license fields include one or more instances of one or more variables. The variables are universally quantified so that each variable may be any one of a set of values. All instances of any given variable are bound to the same value.

Digital licenses that include universally quantified variables

Described herein is an implementation of an inter-process communications technology. One or more implementations, described herein, facilitate creation of a bi-directional message conduit having exactly two endpoints. A first endpoint is owned by a first software process and a second endpoint is owned by a second software process. One or more implementations, described herein, maintain the bi-directional message conduit for passing multiple messages via the bi-directional message conduit from the first process to the second process, according to established rules that can be checked.

Inter-process communications employing bi-directional message conduits

In one aspect, a data structure to be encrypted is received, the data structure including content along with a statement of conditions under which the content may be decrypted. The content is encrypted using a public key of a pair of public and private keys of a device that is to decrypt the data structure. In another aspect, a data structure is decrypted using a private key of a pair of public and private keys. A statement of conditions under which content in the data structure can be decrypted is obtained, and testing is performed as to whether the conditions are satisfied. The decrypted content is returned only if the conditions are satisfied.

System and method for secure storage of data using public and private keys

In accordance with one aspect of boot blocks for software, in a computer system that has a central processing unit and a software identity register, an atomic operation is executed to set an identity of a piece of software into the software identity register. If the atomic operation completes correctly, then the software identity register contains the identity of the piece of software; otherwise, the software identity register contains a value other than the identity of the piece of software.

Boot blocks for software

In accordance with certain aspects, a computer system has a central processing unit (CPU) and an operating system (OS), the CPU having a pair of private and public keys and a software identity register that holds an identity of the operating system. An OS certificate is created including the identity from the software identity register, information describing the operating system, and the CPU public key. The created OS certificate is signed using the CPU private key.

System and method for authenticating an operating system to a central processing unit, providing the CPU/OS with secure storage, and authenticating the CPU/OS to a third party

Described herein is at least one implementation employing multiple self-describing software artifacts persisted on one or more computer-storage media of a software-based computer. In this implementation, each artifact is representative of at least part of the software components (e.g., load modules, processes, applications, and operating system components) of the computing system and each artifact is described by at least one associated 'manifest,' which include metadata declarative descriptions of the associated artifact.

Self-describing artifacts and application abstractions

In one aspect, a data structure to be encrypted is received in a device, the data structure including content along with a statement of conditions under which the content may be decrypted. The data structure is encrypted using a symmetric key of a processor of the device. In another aspect, a data structure is decrypted using a processor symmetric key. A statement of conditions under which content in the data structure can be decrypted is obtained, and testing is performed as to whether the conditions are satisfied. The decrypted content is returned only if the conditions are satisfied.

System and method for secure storage data using a key

A content player can detect pirated content by storing a list of highly compressed content pieces that correspond to different pieces of content (e.g., audio content, video content, audio/video content, etc.). A piece of content to be played back by the content player is compared to the highly compressed content pieces stored at the content player. If the piece of content to be played back matches one of the highly compressed content pieces, then appropriate responsive action is taken. This repsponsive action can vary, and can include, for example, checking for a valid license, giving the user the option to notify the publisher if he or she has unknowingly acquired a pirated copy of the content, etc.

Method and system for detecting pirated content

A system and method for authenticating an operating system includes, in accordance with one aspect, a method in a computer system having a processor, an operating system (OS), and a software identity register that holds an identity of the operating system, the processor having a private key. The method comprises forming an OS certificate containing the identity from the software identity register and signing the OS certificate using the private key. In accordance with another aspect, the signed identity is submitted to a recipient to prove an identity of the operating system to the recipient.

Growing community of inventors

Seattle, WA, United States of America

John D DeTreville