Microsoft Technology Licensing, LLC

Kristjan Eric Hatlelid

Caglar Gunyakti

Marc R Barbour

Nir Ben Zvi

Carl Melvin Ellison

Janet Lynn Schneider

Pieter Kasselman

Xiaoxi Tan

Vladimir A Shubin

Andrey V Lelikov

Uri London

Donald H Rule

Andrey Lilikov

Aidan T Hughes

Amar Dinesh Patel

Mario C Goertzel

Ravindra Pandya

Ning Zhang

Magnus Bo Gustaf Nyström

Kelvin Shek Yiu

Yue Liu

Lazar Ivanov

Providing safe access of a data item accessed through one of a plurality of access channels while concurrently providing a policy check of the data item. An indication associated with accessing a data item through one access channel of a plurality of access channels may be received. In response to receiving the indication associated with accessing the data item, the data item may be automatically analyzed to determine whether the data item satisfies a policy. Also in response to receiving the indication associated with accessing the data item and while determining whether the data item satisfies the policy, safe access of the data item may be provided. Regardless of the access channel through which the data item was accessed, any of the policy check, the safe access, and the analysis of the data item may be the same.

Safe data access through any data channel

An access component sends an access request to an intermediary component, the access request being a request to access a service or resource without credentials of a current user of the intermediary component being revealed to the access component. The intermediary component obtains user credentials, for the current user, that are associated with the service or resource. The access request and the user credentials are sent to the service or resource, and in response session state information is received from the service or resource. The session state information is returned to the access component, which allows the access component and the service or resource to communicate with one another based on the session state information and independently of the first component.

Protecting user credentials using an intermediary component

Techniques and systems for authentication with an untrusted root between a client and a server are disclosed. In some aspects, a client may connect to a server. The server and client may initiate a secure connection by exchanging certificates. The server may accept a client certificate having an untrusted root that does not chain up to a root certificate verifiable to the server certificate authority. In further aspects, the server may enable the client to associate an untrusted certificate with an existing account associated with the server. The client certificate may be hardware based or generated in software, and may be issued to the client independent of interactions with the server.

Authentication with an untrusted root

A collection of multiple user credentials each associated with one of multiple different users is obtained at a device, and one or more of the multiple user credentials are verified. A determination is made as to whether access to a resource is permitted, by at least comparing the collection of multiple user credentials to a threshold combination of user credentials to be satisfied to access the resource. An indication of whether access to the resource by a requesting user is permitted is returned or provided to another device.

Resource access based on multiple credentials

A collection of multiple user credentials each associated with one of multiple different users is obtained at a device, and one or more of the multiple user credentials are verified. The collection of multiple user credentials is also compared to a threshold combination of user credentials to be satisfied to access the resource, and a determination is made, based on the comparing and the verifying, as to whether access to the resource is permitted. An indication of whether access to the resource by a requesting user is permitted is returned or provided to another device.

Upon a first process encountering a triggering device, a second process chooses whether to proxy-execute code corresponding to the triggering device of the first process on behalf of such first process based at least in part on whether a license evaluator of the second process has determined that the first process is to be operated in accordance with the terms and conditions of a corresponding digital license. The license evaluator at least in part performs such determination by running a script corresponding to the triggering device in the code of the first process. Thus, the first process is dependent upon the second process and the license for operation thereof.

First computer process and second computer process proxy-executing code on behalf of first process

A first computer process has code including at least one triggering device, and a digital license corresponding to the first process sets forth terms and conditions for operating same. A second computer process proxy-executes code corresponding to each triggering device of the first process on behalf of same. The second process includes a license evaluator for evaluating the license to determining that the first process is to be operated in accordance with the terms and conditions set forth in such license. A third computer process includes the code corresponding to each triggering device of the first process and an address of the triggering device in the first process. Thus, the first process is dependent on and cannot be operated without the second process and the third process.

First computer process and second computer process proxy-executing code from third computer process on behalf of first process

A first process operating on a computer comprises code to be executed in connection therewith, where the code includes at least one triggering device. A digital license corresponds to the first process and sets forth terms and conditions for operating the first process. A second process operating on the computer proxy-executes code corresponding to each triggering device of the first process on behalf of such first process. The second process includes a license evaluator for evaluating the license to determine whether the first process is to be operated in accordance with the terms and conditions set forth in such license, and the second process chooses whether to in fact proxy-execute based at least in part on determination of the license evaluator. Thus, the first process is dependent upon the second process for operation thereof.

First computer process and second computer process proxy-executing code on behalf thereof

Distributed module authentication allows security checks to be initiated by multiple software modules. Module authentication processes can be inserted into two or more modules in an operating system and/or various other applications. These module authentication processes can verify the integrity of binaries associated with one or more modules in computer memory. Security checks can be performed on modules stored on disk, in active system memory, or in any other location. Various security checks can be coordinated with each other to ensure variety and frequency of module authentication, as well as to randomize the module authentication process that performs a particular security check. In addition, security processor code can be interleaved within normal application code, so the security code is difficult for attackers to remove or disable without damaging the useful functionality of an application.

System and method for distributed module authentication

A mechanism is provided, where a post-build utility is used to store stack and call tree information within a section of an executable program or separate file. The stack information aids an authentication module during the execution of the program in walking up a stack in order to obtain return addresses on the stack. In one aspect of the invention, by comparing the return address sequence to the call tree sequence, which specifies the allowed function call sequence of the program, a determination can be made whether the program is executing (as evidenced by the stack) the way it should be executing (as required by the call tree). If the call tree sequence differs from the return address sequence, a suspicion is raised that a hacker is attempting to jump from foreign code into sensitive code of the program by changing the function calling sequence.

Post build process to record stack and call tree information

A method and system are provided that override constructors such that the constructors not only initialize objects but also provide notification about virtual pointers of the objects. This notification is provided to a list that stores which virtual pointers are created and where they are supposed to be pointing. By knowing the address of the virtual tables that the virtual pointers are supposed to be pointing to, a determination can be made whether the virtual tables are the correct virtual tables or whether they may be different virtual tables that have been substituted in by a hacker and that contain pointers to foreign code.

Overriding constructors to provide notification in order to detect foreign code

A mechanism for redirecting a code execution path in a running process. A one-byte interrupt instruction (e.g., INT 3) is inserted into the code path. The interrupt instruction passes control to a kernel handler, which after executing a replacement function, returns to continue executing the process. The replacement function resides in a memory space that is accessible to the kernel handler. The redirection mechanism may be applied without requiring a reboot of the computing device on which the running process is executing. In addition, the redirection mechanism may be applied without overwriting more than one byte in the original code.

Changing code execution path using kernel mode redirection

A method for reactivation of software products includes activating a first software product associated with a reactivation policy group. A hardware identifier derived from the computer hardware configuration is bound with the first software product activation. A second software product is activated having an associated reactivation binding list. Reactivation is requested for the first software product and an updated hardware identifier is associated with a reactivation policy group of the first software product. The second software product may be spared the request for reactivation if the second product can be associated with the reactivation of the first software product given the binding list is compatible with the reactivation policy group.

Method and system for single reactivation of software product licenses

A unique volume license key (VLK) is provided to a volume license holder. A signed file containing the VLK and the data derived from volume license holder's submitted computing environment information is provided to the volume license holder along with the licensed software. The license file is stored in a central location, such as on an installation server, or locally on client machines, in a rather large file of any type. Upon logon, the license file is read, the data authenticated and the system is activated. If license data cannot be authenticated, a connected system either fully functions in grace period or run in reduced functionality mode until authentication succeeds. If the system is disconnected, the system is functional only with disconnected features until it joins a network again. In a completely off-line installation, the license file is generated by the volume license holder using software vendor assigned specific VLK and software vendor provided security hardware device. The distribution methods of software package, the VLK, and the license file can be flexible, including, but not limited to, single or multiple media.

Growing community of inventors

Sammamish, WA, United States of America

Kristjan Eric Hatlelid