Microsoft Technology Licensing, LLC

Matthew Charles Setzer

Malcolm Erik Pearson

Kenneth D Ray

Carl Melvin Ellison

Vijay G Bharadwaj

Charles Glenn Jeffries

Michael J Grass

Gaurav Sinha

Paul England

Paul J Leach

Charles W Kaufman

William R Tipton

Nathan T Lewis

David Rudolph Wooten

Andrew M Herron

Jonathan D Schwartz

Krassimir Emilov Karamfilov

Duncan G Bryce

Pankaj Mohan Kamat

John Richard McDowell

Krassimir E Karamfilov

John Mcdowell

Ducan G Bryce

Scalable handling of billing events that affect one or more accounts. A computing system partitions received events into a number of channels, perhaps by account identifier. The channels receive the events, process the events, and forwards the events to an aggregator to allow the events to be aggregated by account to allow for easier computation of a bill. The aggregator also performs de-duplication of events to help reduce the risk of double billing.

Scalable billing with de-duplication in aggregator

A portable secure data file includes an encrypted data portion and a metadata portion. When a request associated with a current user of a device to access a portable secure data file is received, one or more records in the metadata portion are accessed to determine whether the current user is permitted to access the file data in the encrypted data portion. If a record indicates the user is permitted to access the file data, a content encryption key in that record is used to decrypt the encrypted data portion.

Portable secure data files

A computing system partitions received events into a number of channels by account identifier. The channels receive the events and perform de-duplication of the events. This de-duplication can be performed with a filter that is updated to reflect the receipt of any original event. The filter may be used to either determine that the event is not a duplicate of another, or to determine that the event cannot be ruled out as being a duplicate of another. In the latter case, further processing may be performed to for definitively determine whether the event is truly a duplication, or in the alternative, the event may be immediately treated as a duplicate.

De-duplication in billing system

Computer systems and environments implemented herein permit a local machine increased participation in authorizing access to protected content. An operating system attests to a computing environment at a corresponding computer system. If the computing environment is one permitted to access protected content, the operating system is permitted to regulate further (e.g., application) access to protected content in accordance with a procreation policy. As such, authorization decisions are partially distributed, easing the resource burden on a content protection server. Accordingly, this computing environment can facilitate more robust and efficient authorization decisions when access to protected content is requested.

Attested content protection

Scalable handling of billing events that affect one or more accounts. A computing system partitions received events into a number of channels, perhaps by account identifier. The channels receive the events, and perform de-duplication of the events. This de-duplication may be performed using a Bloom filter that is updated to reflect the receipt of any original event. The Bloom filter may be used to either determine that the event is not a duplicate of another, or to determine that the event cannot be ruled out as being a duplicate of another. In the latter case, further processing may be performed to for definitively determine whether the event is truly a duplication, or in the alternative, the event may be immediately treated as a duplicate.

The present invention extends to methods, systems, and computer program products for licensing protected content to application sets. Embodiments of the invention permit a local machine to increase its participation in authorizing access to protected content. For example, an operating system within an appropriate computing environment is permitted to determine if an application is authorized to access protected content. Thus, the application is relieved from having to store a publishing license. Further, authorization decisions are partially distributed, easing the resource burden on a protection server. Accordingly, embodiments of the invention can facilitate more robust and efficient authorization decisions when access to protected content is requested.

Licensing protected content to application sets

A virtual PCR (VPCR) construct is provided that can be cryptographically tagged as optionally resettable or as enduring for the life of a client (process, virtual machine, and the like) and that can be loaded into a resettable hardware PCR to make use of the functionality of a Trusted Platform Module (TPM). The VPCRs may cryptographically reflect their characteristics (resettable or not) in their stored values. Also, since the PCRs are virtualized, they are (effectively) unlimited in number and may be given general names (UUIDs) that are less likely to collide. The VPCRs can be loaded into a physical PCR as needed, but in a way that stops one piece of software from impersonating another piece of software. The VPCRs thus enable all software using the TPM to be given access to TPM functionality (sealing, quoting, etc.) without security concerns.

Virtualization of software configuration registers of the TPM cryptographic processor

Growing community of inventors

Woodinville, WA, United States of America

Matthew Charles Setzer