Microsoft Technology Licensing, LLC

Kinshuman Kinshumann

Mark Fishel Novak

Yevgeniy Anatolievich Samsonov

Niels Thomas Ferguson

Nir Ben-Zvi

Christopher Warner McCarron

John Anthony Messec

Stefan Thom

Arun Upadhyaya Kishan

David Matthew Kruse

Scott Randall Shell

Anders Bertil Vinberg

Peter David Waxman

Innokentiy Basmov

Peter J Kaufman

Emily Nicole Wilson

Scott Daniel Anderson

Yuhang Zhu

David John Linsley

Vishal Agarwal

Alex Mark Semenko

Alain Franck Gefflaut

Samartha Chandrashekar

Giridhar Viswanathan

Qiang Wang

Richard Allen Pletcher

Corneliu I Lupu

Youssef M Barakat

Xiaohong Su

Gopinathan Kannan

John David Colleran

Malcolm James Smith

Amitabh Prakash Tamhane

Victor W Heller

Giridharan Sridharan

Michael J Grass

Dave M McPherson

Dayi Zhou

Sunil P Gottumukkala

Janani Vasudevan

Salahuddin Khan

Justin Alexander Hou

Alex Bendetov

Anoosh Saboori

James Aaron Holmes

Andrey Shedel

Jonathan M Andes

Adam Damiano

Troy E Shaw

Aaron M Farmer

James Hugh Morgan

Jinsub Moon

Brian Perkins

Yevgeniy A Samsonov

Christopher Mccarron

A device boots in a secure manner that allows measurements reflecting which components are loaded during booting to be generated. Measurements of such components, as well as of a device management agent and the security state of the device, are also obtained. The device management agent accesses an attestation service for an enterprise, which is a collection of resources managed by a management service. The device management agent provides the obtained measurements to the attestation service, which evaluates the measurements and based on the evaluation determines whether the device is verified for use in the enterprise. The management service uses this verification to ensure that the device management agent is running in a secure manner, is accurately providing indications of the state of the device to the management service, and is implementing policy received from the management service.

Device attestation through security hardened management agent

Constructs to define a Trusted Execution Environment Driver that can implement a standard communication interface in a first environment for discovering and/or exchanging messages with secure applications/services executed in a Trusted Execution Environment (TrEE). The first environment can represent an environment with a different security policy from the TrEE. The TrEE driver can include a standard interface and/or mechanism by which applications/services and drivers within a first environment can access secure applications/services in the TrEE, a standard interface and/or mechanism by which third-party vendors can expose their TrEE applications/services to a first environment, a standard interface and/or mechanism by which a TrEE can request applications/services, on its own behalf, from the first environment, and a standard interface and/or mechanism to facilitate the management of secure application/services and/or provide I/O prioritization and security protection for individual secure applications/services.

Trusted execution environment extensible computing device interface

In one embodiment, a data storage client may establish a virtual replay protected storage system with an agnostic data storage. The virtual replay protected storage system may maintain a trusted counter and a secret key in a trusted client environment. The virtual replay protected storage system may encode a hash message authentication code signature based on the trusted counter, the secret key, and a data set. The virtual replay protected storage system may send a write request of the data set with the hash message authentication code signature to an agnostic data storage.

Implementing replay protected storage

A computing device, or a security component of a computing device, implements delayed attestation by initially providing first credentials to a remote access device to establish a first level of trust. The first credentials may be provided before or while the computing device or the security component is obtaining security information from a remote security device. The security information is used to generate second credentials that are subsequently provided to the remote access device to establish a second level of trust. The first credentials may comprise an encryption key that can be generated by the security component without having to retrieve information via a network, and the second credentials may comprise an attestation statement that is more trustworthy than the encryption key and that is generated based on a certificate retrieved from a remote security device (e.g., a certificate authority server).

Efficient and reliable attestation

Embodiments of the disclosure provide access to data in a compressed container through dynamic redirection, without storing decompressed data in persistent memory. The compressed container is stored in a first portion of memory. User data and reference files, with redirect pointers, for accessing corresponding files in the compressed container are stored in a second portion of memory. A command to access data is detected by a computing device. The redirect pointer in the reference file associated with the command redirects access to the corresponding compressed version of data stored in the compressed container. The corresponding accessed compressed version of data is decompressed on the fly and provided in response to the command without storing the decompressed data in persistent memory. Some embodiments provide integrity protection to validate the data coming from the compressed container.

Accessing data in a compressed container through dynamic redirection

During booting of a computing device, multiple security boundaries are generated. A security boundary refers to a manner of operation of a computing device or a portion of the computing device, with a program executing in one security boundary being prohibited from accessing data and programs in another security boundary. As part of booting the computing device measurements of (e.g., hash values or other identifications of) various modules loaded and executed as part of booting the computing device are maintained by a boot measurement system of the computing device. Additionally, as part of booting the computing device, a public/private key pair of one of the security boundaries is generated or otherwise obtained. The private key of the public/private key pair is provided to the one security boundary, and the public key of the public/private key pair is provided to the boot measurement system.

Identifying security boundaries on computing devices

Deploying an encrypted entity on a trusted entity is illustrated herein. A method includes, at a trusted entity, wherein the trusted entity is trusted by an authority as a result of providing a verifiable indication of certain characteristics of the trusted entity meeting certain requirements, receiving an encrypted entity from an untrusted entity. The untrusted entity is not trusted by the authority. At the trusted entity, a trust credential from the authority is used to obtain a key from a key distribution service. The key distribution service is trusted by the authority. The key is used to decrypt the encrypted entity to allow the encrypted entity to be deployed at the trusted entity.

Secure management of operations on protected virtual machines

Booting a machine in a secure fashion in a potentially unsecure environment. The method includes a target machine beginning a boot process. The method further includes the target machine determining that it needs provisioning data to continue booting. The target machine contacts a secure infrastructure to obtain the provisioning data. The target machine provides an identity claim that can be verified by the secure infrastructure. As a result of the secure infrastructure verifying the identity claim, the target machine receives a request from the secure infrastructure to establish a key sealed to the target machine. The target machine provides the established key to the secure infrastructure. The target machine receives the provisioning data from the secure infrastructure. The provisioning data is encrypted to the established key. The target machine decrypts the encrypted provisioning data, and uses the provisioning data to finish booting.

Secure creation of encrypted virtual machines from encrypted templates

The techniques and systems described herein present various implementations of a model for authenticating processes for execution and specifying and enforcing permission restrictions on system resources for processes and users. In some implementations, a binary file for an application, program, or process may be augmented to include a digital signature encrypted with a key such that an operating system may subsequently authenticate the digital signature. Once the binary file has been authenticated, the operating system may create a process and tag the process with metadata indicating the type of permissions that are allowed for the process. The metadata may correspond to a particular access level for specifying resource permissions.

Process authentication and resource permissions

A system and method for delivering support tools to a computer user's machine, without requiring the user to directly download, install and/or execute the tools. A user in need of support contacts support and in response receives a URL corresponding to a manifest, which is a data file identifying support tools that a user's machine is to run to collect data for analysis. Via HTTP, a control mechanism on the user's machine interprets the manifest, automatically handling downloading and installation of any needed tool, and executes the tools on the machine with appropriate parameters that are present in the manifest. Data is collected, packaged and returned to a support entity, where it is analyzed such that a support solution may be returned to the user. The system and method provide efficient and consistent support to computer users, helping both support personnel while giving computer users a very straightforward support experience.

System and method for providing computer support tools

Growing community of inventors

Redmond, WA, United States of America

Kinshuman Kinshumann