Microsoft Technology Licensing, LLC

Ambit Corporation

Kevin Patrick Kane

Stefan Thom

Ronald Aigner

Anthony Paul Penta

Kelvin Shek Yiu

Andrew Daniel McElroy

Zheng Dong

A Method and apparatus for resilient Decoy Routing without conspiring Autonomous Systems by instead using a DHT routing table is described. In one embodiment of the present invention, there would exist a set of Decoy Routing Nodes which would be connected via a DHT's routing table. This would enable decoy routing nodes to not depend on a predefined list. Traditionally, Decoy Routing depends upon either a pre-configured list of computer systems to connect to or is wholly dependent upon BGP to happen to route to friendly Autonomous Systems that understand the true intent of the packet being routed. This method and apparatus solves these problems by providing a means to use a dynamic routing table, provided by a DHT to ensure that a packet can be delivered to computer systems that understand how to do decoy routing. This approach further ensures that the routing table being used is one that is kept up to date automatically as a function of the DHT providing the routing table. Further, the methodology described ensures that evading censorship, defending against TCP replay attacks, latency analysis, website fingerprinting, and denial of service (DoS) attacks are successfully executed.

Method and apparatus for resilient decoy routing without conspiring autonomous systems (AS) via distributed hash table (DHT) routing

Classifiers may be used to analyze a valid certificate received from an unverified entity in an attempt to establish a secure connection with the unverified entity. The classifiers may determine a probability that the certificate is being used improperly by an unauthorized third party. An action may be taken based on the probability, such as allowing the unverified entity to establish a secure connection, blocking the unverified entity from establishing a secure connection, etc. The classifiers may be trained by employing machine learning techniques on a collection of valid, authorized certificates. Additionally, or alternatively, received certificates may be sampled for further analysis based on the probability and/or predefined sampling percentages.

Probabilistic classifiers for certificates

A computing device described herein utilizes a secure cryptoprocessor of the computing device to compute a response to a request for authorization received from another local or remote device. The secure cryptoprocessor computes the response based on protected authorization credentials stored by the secure cryptoprocessor for one or more devices. The computing device then provides the computed response to the other device to cause the other device to grant or deny authorization. The computing device may also display information associated with the request for authorization, receive input indicating approval of the request, and utilize the secure cryptoprocessor in response to the received input.

Secure cryptoprocessor for authorizing connected device requests

Growing community of inventors

Bellevue, WA, United States of America

Kevin Patrick Kane