Microsoft Technology Licensing, LLC

Other

Woodcock Washburn Llp

Microsoft Corporation

Josh D Benaloh

Daniel Ron Simon

Marcus Peinado

Paul England

Gideon Andreas Yuval

John R Douceur

Atul Adya

Michael Jack Sinclair

Ismail Cem Paya

Yuqun Chen

Ling Tony Chen

Carl Melvin Ellison

Niels Thomas Ferguson

Julien Couvreur

Paul J Leach

Kim Cameron

Brian LaMacchia

David Benson Cross

Thomas C Jones

Caglar Gunyakti

Dinarte R Morais

Iulian Doroftei Calinov

Cem Paya

Jianrong Gu

Tarik Soulami

Melissa Erin Chase

Andrew D Rosen

Luis Von Ahn

Glenn D Pittaway

Kalin Georgiev Toshev

Jon T Lange

Thomas J Layson

John R Michener

Jeffrey Paul Harker

Jesper Mikael Johansson

Richard S Szeliski

John Carlton Platt

Chris Demetrios Karkanias

Joshua T Goodman

Bin Benjamin Zhu

Robert L Rounthwaite

Patrice Y Simard

James Morris Alkove

Gregory Carl Hitchcock

John Peter Shewchuk

Kristin E Lauter

Eric David Brill

Rui Guo

Yuan Kong

Arun Sacheti

Jacob Rubin Lorch

Mihir M Bellare

Arun K Nanda

Nathan C Sherman

Manav Mishra

Sergey M Yekhanin

Tolga Acar

Matthew W Thomlinson

Trevin M Chow

Eduardo P Oliveira

Clifford P Van Dyke

Min Feng

Trevor William Freeman

Jeffrey Earl Steinbok

Joshua Stanley Allen

Troy Batterberry

Nathan Fink

Elissa E Murphy

Bolin Ding

Ryan Charles Colvin

D Chase Franklin

Raja Pazhanivel Perumal

Ting Cai

Michael Howard

Erren Dusan Lester

Nina Kang

Mira Belenkiy

Deuane Martin

Derek M Hazeur

Srinath T V Setty

David M Meltzer

Danpo Zhang

Daniel Rosen

Aimin Pan

Duy Lan Nguyen

Harsha Prasad Nori

Olga Ohrimenko

Janardhan Dattatreya Kulkarni

Gopalakrishnan Seshadrinathan

Andrzej Pastusiak

Jonathan Wilkins

Dean Justus

Wei Dai

Rajesh Kuppuswamy

Bennet Yee

Donald D Chinn

Aidan Thomas Joseph Hughes

K John Biccum

Atul Kumar Shah

Hui Fan

This document relates to hardware protection of differential privacy techniques. One example obtains multiple instances of encrypted telemetry data within a secure enclave and processes the encrypted telemetry data to obtain multiple instances of unencrypted telemetry data. The example also processes, within the secure enclave, the multiple instances of unencrypted telemetry data to obtain a perturbed aggregate. The example also releases the perturbed aggregate from the secure enclave.

Hardware protection for differential privacy

The claimed subject matter provides systems and/or methods that effectuate a simple protocol for tangible security on mobile devices. The system can include devices that generate sets of keys and associated secret identifiers, employs the one or more keys to encrypt a secret and utilizes the identifiers and encryptions of the secret to populate a table associated with a security token device that is used in conjunction with a mobile device to release sensitive information persisted on the mobile device for user selected purposes.

Simple protocol for tangible security

Systems, methods, and apparatus for generating and validating product keys. In some embodiments, a product key includes security information and identification information identifying at least one copy of a software product. The identifying information may be used to access validation information from at least one source other than the product key, and the validation information may be used to process the identification information and the security information to determine whether the product key is valid. In some further embodiments, the security information includes a first portion to be processed by a first validation authority using first validation information and a second portion to be processed by a second validation authority using second validation information, wherein the second validation information is stored separately from the first validation information.

Secure software product identifier for product validation and activation

This document describes tools that constrain a login to a subset of access rights. In one embodiment, the tools generate a constrained password by executing a cryptographic algorithm on a user ID, general password, and one or more desired constraints. The constrained password is used in place of the general password to gain access rights that are a subset of the access rights that would be granted if the general password were used instead.

Constraining a login to a subset of access rights

The claimed subject matter relates to architectures that can construct a hierarchical set of decryption keys for facilitating user-controlled encrypted data storage with diverse accessibility and hosting of that encrypted data. In particular, a root key can be employed to derive a hierarchical set of decryption keys and a corresponding hierarchical set of encryption keys. Each key derived can conform to a hierarchy associated with encrypted data of the user, and the decryption capabilities of the decryption keys can be configured based upon a location or assignment of the decryption key within the hierarchy. The cryptographic methods can be joined with a policy language that specifies sets of keys for capturing preferences about patterns of sharing. These policies about sharing can themselves require keys for access and the policies can provide additional keys for other aspects of policy and or base-level accesses.

User-specified sharing of data via policy and/or inference from a hierarchical cryptographic store

Systems, methods, and apparatus for validating product keys. In some embodiments, a product key includes security information and identification information identifying at least one copy of a software product. The security information may include a first portion to be processed by a first validation authority using first validation information and a second portion to be processed by a second validation authority using second validation information. The second validation information may be stored separately from the first validation information and may not be accessible to the first validation authority. In some embodiments, the first validation authority randomly determines whether a product key is to be audited by the second validation authority. Alternatively, the first validation authority may determine whether to audit based on a type of the software product associated with the product key and/or a perceived level of security risk.

Reliable software product validation and activation with redundant security

An authentication ticket is validated to ensure authenticated communications between a client and an online service provider. In an embodiment an authentication request is received from a user agent associated with the client and the authentication request includes a set of identification information and a set of authentication information. Additionally, it is determined that the set of identification information and the set of authentication information are associated with a user and an authentication ticket is created including a user identification and an authentication, indicating to the online service provider that the user is authenticated to access one or more online services. Further, a validation token is embedded into the authentication ticket that provides enhanced verification that the access provided by the online service provider is authenticated.

Authentication ticket validation

In an example, one or more cryptographic keys may be associated with a group. Any member of the group may use the key to encrypt and decrypt information, thereby allowing members of the group to share encrypted information. Domain controllers (DCs) maintain copies of the group's keys. The DCs may synchronize with each other, so that each DC may have a copy of the group's keys. Keys may have expiration dates, and any client connected to a DC may generate a new key when a key is nearing expiration. The various clients may create new keys at differing amounts of time before expiration on various DCs. DCs that store keys early thus may have time to propagate the newly-created keys through synchronization before other DCs are requested to store keys created by other clients. In this way, the creation of an excessive number of new keys may be avoided.

Managing group keys

Computer-readable media, systems, and methods for validating an authentication ticket to ensure authenticated communications between a client and an online service provider. In embodiments an authentication request is received from a user agent associated with the client and the authentication request includes a set of identification information and a set of authentication information. Additionally, it is determined that the set of identification information and the set of authentication information are associated with a user and an authentication ticket is created including a user identification and an authentication, indicating to the online service provider that the user is authenticated to access one or more online services. Further, a validation token is embedded into the authentication ticket that provides enhanced verification that the access provided by the online service provider is authenticated.

Single-use character combinations are a secure mechanism for user authentication. Such 'one-time passwords' (OTPs) can be generated by a mobile device to which the user otherwise maintains easy access. A key exchange, such as in accordance with the Diffie-Hellman algorithm, can provide both the mobile device and a server with a shared secret from which the OTPs can be generated. The shared secret can be derived from parameters posted on the server and updated periodically, and the mobile device can obtain such parameters from the server before generating an OTP. Such parameters can also specify the type of OTP mechanism to be utilized. A second site can, independently, establish an OTP mechanism with the mobile device. For efficiency, the first server can provide an identity token which provides the mobile device's public key in a trusted manner, enabling more efficient generation of the shared secret with the second server.

One time password key ring for mobile computing device

Methods, systems, and apparatus for generation, distribution and verification of tokens are described. In an implementation, a method is described in which a value of an offer is determined and a token for representing the offer is generated. The token has a number of characters based on the determination of the value of the offer.

Generation, distribution and verification of tokens using a secure hash algorithm

Growing community of inventors

Redmond, WA, United States of America

Josh D Benaloh