Microsoft Technology Licensing, LLC

Klaus U Schutz

Eric C Perlin

Daniel C Griffin

Richard Bruce Ward

Thomas C Jones

Peter T Brundrett

Stefan N Richards

Gilad Odinak

Paul J Leach

David Milstein

Scott Bates Guthery

Cristian Marius Ilac

Vinay Deo

Sriram Sampath

Sterling M Reasor

Ara Bernardi

Eric R Flo

John Scott Stephens

Glenn D Pittaway

Benjamin A Hutz

Scott Field

Chris J Guzak

Mark Joseph Zbikowski

Praerit Garg

John E Brezak

Matthew W Thomlinson

Kedarnath Atmaram Dubhashi

Jonathan D Schwartz

Brian D Wentz

Clifford P Van Dyke

Philip Joseph Hallin

Sermet Iskin

John J Lambert

John M Hawkins

Jeffrey B Hamblin

Jianrong Gu

Brian D Andrew

Wesley Allan Witt

David Ruzyski

Sunil Pai

James H Hong

Monica Ioana Ene-Pietrosanu

Brian K McNeil

Mike K Lai

Stefan Richards

Systems and methods are described for providing security through sessions. In an implementation, a method includes initiating a session, by an operating system, in which operating system services are executable and initiating another session, by the operating system, in which a user-interactive application is executable.

Systems and methods for providing security through sessions

Techniques are described herein for securely prompting a user to confirm sensitive operations, input sensitive information or the like. The techniques include receiving or intercepting calls from applications to prompting routines. When a call to a prompting routine is received or intercepted a hint may be provided to the user to switch to a secure desktop. When the user switches from the user desktop to the secure desktop the particular prompt is displayed. The input to the prompt is received on the secure desktop and verified to have been provided by the user. The user input or a representation of the input is then returned to the application running on the user desktop. Using these techniques, interception of prompting messages by malware does not result in sensitive information being revealed. Furthermore, spoofing of new messages by malware does not lead to the dismissal of critical prompting.

Secure prompting

Systems and methods are described that control attempts made by an application to access data. In one embodiment, the application is associated with a security token that includes an application ID. In operation, the system receives a request, initiated by the application, for access to the data. The system is configured to evaluate the request for access based in part on comparison of the security token and a listing of approved application IDs associated with the data.

Controlling execution of computer applications

Systems and/or methods are described that enable a credential interface. These systems and/or methods may build a credential user interface enabling a user to choose between multiple credentials and submit an authenticator for a chosen credential. These systems and/or methods may also gather information about arbitrary credentials and build a user interface for submission of authenticators for these arbitrary credentials.

Credential interface

Controlling computer applications' access to data

Methods and apparatuses are provided for use with smartcards or other like shared computing resources. By selectively granting exclusive use to a requesting entity for a period of time, performance is improved by reducing unnecessary redundant overhead data, communication, storage and/or processing for an applicable series of transactions associated with a granted access request operation.

Performance optimized smartcard transaction management

A system and method facilitating secure credential management is provided. An aspect of the present invention provides for a credential management system including a credential user interface component, a trusted proxy component and a secure user interface component. The system can facilitate the secure acquisition, storage and/or application of credential(s) for a user (e.g., when accessing a particular resource) through a secure, isolated environment. For example, the system can be a core building block for operating system component(s) and/or application(s) that handle credential(s) in a secure manner.

System and method facilitating secure credential management

Methods and apparatuses are provided for use with smartcards or other like shared computing resources. A global smartcard cache is maintained on one or more computers to reduce the burden on the smartcard. The global smartcard cache data is associated with a freshness indicator that is compared to the current freshness indicator from the smartcard to verify that the cached item data is current.

Global smartcard cache methods and apparatuses

An operating system for a computing device has a first session for a user that includes a first base process that has a first privileges token attached thereto. The first privileges token includes substantially a full set of privileges of the user on the operating system. The operating system also has a second session for the user that includes a second base process that has a second privileges token attached thereto. The second privileges token is derived from the first privileges token and includes only a minimum set of privileges of the user on the operating system. Thus, the second, limited token does not have all privileges associated with the first, full token but instead has a limited set of privileges and not extra privileges that could be employed to take actions that would be harmful, deceptive, or malicious.

Providing user on computer operating system with full privileges token and limited privileges token

A credential is translated with one of different credential provider modules each translating a corresponding different type of credential into a common protocol. The translated credential is communicated through an API to a logon UI module to an operating system (OS) of a local machine. An OS logon module is called by the logon UI module to authenticate the translated credential against a credential database. A user identified by the translated credential is logged on to access the local machine when the authentication is successful. The credential can also be used with a selection received from the logon UI module via a corresponding one of different pre-log access provider (PLAP) modules that each communicate with the API. The API establishes a network session with an access service specified by the selected PLAP module when the credential is authenticated with the credential database.

Interoperable credential gathering and access modularity

An integrated circuit (IC) card is presented comprising an input/output (I/O) interface and a smart card development interface (SCDI), coupled to the I/O interface, to receive and identify debug frames interlaced within a normal communication flow between the IC card and a host system.

Interlaced protocol for smart card application development

Systems and methods are described for distributing and updating trusted certification authorities to computer systems and users. When a digital certificate is encountered during a secured electronic transaction, the root authority of the certificate is determined. It is then determined whether the root authority is a trusted authority by attempting to locate the root authority in a trusted root list. If the root authority is not included in the trusted root list, a remote site is accessed and an updated version of the trusted root list is downloaded. The new trusted root list is checked for the presence of the encountered certificate and, if found, the transaction is allowed to proceed. In one implementation, the entire trusted root list is not downloaded. Instead, if an appropriate digital certificate is located, then the certificate is downloaded and added to the trusted root list of the computer system. The transaction may then proceed.

Systems and methods for distributing trusted certification authorities

Described herein is an implementation of a technology for managing credentials. With an implementation, a credential manager is domain-authentication aware and concurrent authentications with multiple independent networks (e.g., domains) may be established and maintained. Moreover, a credential manager provides a credential model retrofit for legacy applications that only understand the password model. The manager provides a mechanism where the application is only a 'blind courier' of credentials between the trusted part of the OS to the network and/or network resource. The manager fully insulates the application from 'read' access to the credentials. This abstract itself is not intended to limit the scope of this patent. The scope of the present invention is pointed out in the appending claims.

Credential management

Apparatuses and methods are provided for interface logic that is configurable to operatively couple cryptography support logic and cryptography providing logic. The interface logic provides at least one management function to the cryptography providing logic. The management function includes at least one of the following four management functions: an identity management function, a file management function, a container management function, and a cryptography management function.

Base cryptographic service provider (CSP) methods and apparatuses

Growing community of inventors

Kirkland, WA, United States of America

Klaus U Schutz