Microsoft Technology Licensing, LLC

Lee Walker

Christopher J Engdahl

Jeromy Scott Statia

William Dixon

Daniel Wade Hitchcock

Nir Nice

Brian D Swander

Nathan Daniel Muggli

William H Dixon

Siddharth Bhai

Rajat Luthra

Zachary Michael Edwards

Colin Trent

Brian W Puhl

Poulomi Bandyopadhyay

Authentication request notifications are selectively suppressed, reducing notification fatigue and susceptibility to social engineering attacks. Authentication request notifications may be suppressed by not presenting a push notification on the user's phone. The authentication request may still be accessed and approved by manually opening the authenticator app. Notifications may be suppressed based on an estimation that the person attempting to login is not who they say they are. This estimation may be based on applying heuristics and/or machine learning models to the context of the login attempt, such as the IP address that originated the login request, time of day, recent user actions, patterns of previous logins, etc. One heuristic determines that the user has repeatedly ignored notifications caused by a particular IP address. Machine learning models generate a risk score from the login context, and notifications may be suppressed if the risk score exceeds a threshold.

Selectively and intelligently displaying authentication notifications to protect users

A secure DNS query may be made by establishing a secure connection with a specific DNS server to determine an address for a hostname. A client device may have a database that may contain a record of a secure DNS server for one or more hostnames. When a DNS request contains one of the specified hostnames, an authenticated session may be created with the designated secure DNS server and a network address for the hostname is returned using the session. The authenticated session may authenticate a client device to the server as well as authenticate the server to the client. In some embodiments, the secure DNS server may accept connections from authenticated clients and may disregard connection requests from non authenticated clients.

Secure DNS query

Native IPv6 capabilities are provided to an IPv4 network node, device, or endpoint using a hardware interface that supports network communication under a Direct Access model. The Direct Access model supports IPv6 communication with IPsec and enforces Network Access Protection ('NAP') health requirement policies for endpoints that are network clients. A Direct Access-ready server is enabled using a hardware interface that implements IPv4 to IPv6 translation and optionally IPsec termination capability. A Direct Access-ready client is enabled using a hardware interface that implements IPv4 to IPv6 translation, IPsec termination capability, and which optionally provides NAP (Network Access Protection) capabilities for Direct Access-ready clients that are configured as mobile information appliances. The hardware interface may be implemented as a network interface card ('NIC') or as a chipset.

Hardware interface for enabling direct access and security assessment sharing

A server may bridge between a wide area network, such as the Internet, and a local area network and may process authentication requests from clients on the wide area network. The server may filter the requests to enable specific types of requests to pass, and may forward the requests to a credential server within the local area network and pass any responses back to the client. The server may be configured with some or all of a set of domain services objects, but such objects may be stored in a read only format. The server may further contain a minimum of or no sensitive data such that, if compromised, an attacker may gain little advantage. The client may request evidence of authentication available to devices within the local area network and may use the evidence of authentication to access services made available to the wide area network.

Secure key distribution to internet clients

A network firewall may apply policies to packets based on a security classification. Packets with an authenticated and established security connection may be handled at a high throughput while packets with unauthenticated connections may be handed at a low throughput or even discarded. In some embodiments, three or more levels of security classifications may be used to process packets at different speeds or priorities. In some embodiments, one device may classify and tag each packet, while another device within the network may process the packets according to the tags.

Security state aware firewall

Growing community of inventors

Christiansburg, VA, United States of America

Lee Walker