Microsoft Technology Licensing, LLC

Michael Howard

Vikas Malhotra

Daniel Ron Simon

Josh D Benaloh

Boyd Cannon Multerer

Praerit Garg

Henry L Sanders

James E Allard

Matthew W Thomlinson

Michael W Thomas

Loren Kohnfelder

Timothy D Sellers

Nathan Fink

David Rogers Treadwell, Iii

Lara N Dillingham

Quentin J Clark

John F Ludeman

Kim A Stebbens

Dean Justus

Ronald Meijer

Don L Brown

Douglas C Henbenthal

Cameron Ferroni

Sophia Chung

A system for providing a client's credentials to a computer program comprises a database remote from the client and a single signon server module. The single signon server module can receive a request for the client's credentials from the computer program, determine whether the client's credentials are stored in the database, and send the client's credentials from the database to the computer program in response to a determination that the client's credentials are stored in the database. The single signon server module can store the client's credentials in the database in response to a determination that the client's credentials are not stored in the database. The single signon server module can encrypt the client's credentials prior to storing the client's credentials in the database and can decrypt the client's credentials prior to sending the client's credentials to the computer program.

System and method for providing program credentials

The relative attack surface quotient is computed for products to determine their relative susceptibility to attack. The relative attack surface can be calculated by identifying known avenues of attack that correspond to the product and by determining bias values that should be applied to the avenues of attack based upon desired criteria, including, the potential damage that can be caused by an attack. The appropriate bias is applied to each avenue of attack and the resulting bias-applied values are combined into a single relative attack surface quotient. The relative attack surface can be determined prior to or during utilization of a product. The product may include software, computing devices and networks. Upon determining a relative attack surface is too high, utilization of the product can be restricted.

Determining relative attack surface

First and second computing devices are selectively operatively coupled together. The first device provides data to the second device. The second device can be a portable computing device. The second device is configured to encrypt/decrypt the data, as needed by the first device. The second device maintains the cryptographic key data internally. As such, the first device, which, for example, may be a personal computer will only maintain the returned encrypted data following encryption and only temporarily use any returned decrypted data. Thus, by physically and operatively distributing the cryptographic processing/maintenance between the two devices, additional security is provided for protecting private data.

Distributed cryptographic methods and arrangements

The following subject matter provides for modeling an application's potential security threats at a logical component level early in the design phase of the application. Specifically, in a computer system, multiple model components are defined to represent respective logical elements of the application. Each model component includes a corresponding set of security threats that could potentially be of import not only to the component but also to the application as a whole in its physical implementation. The model components are interconnected to form a logical model of the application. One or more potential security threats are then analyzed in terms of the model components in the logical model.

Rapid application security threat analysis

Methods and systems of screening input strings that are intended for use by a Web server are described. In the described embodiment, an attack pattern is determined that can be used to attack a Web server. A search pattern is defined that can be used to detect the attack pattern. The search pattern is defined in a flexible, extensible manner that permits variability among its constituent parts. An input string that is intended for use by a Web server is received and evaluated using the search pattern to ascertain whether the attack pattern is present. If an attack pattern is found that matches the search pattern, then a remedial action is implemented.

Methods and systems for screening input strings intended for use by Web servers

Methods and systems for screening input strings intended for use by web servers

Methods and apparatus for synchronizing access control in a web server are described. A plurality of security scenarios are defined, each of which has one or more security settings associated therewith. The security settings are those that are associated with a plurality of access control mechanisms that control access to a web server or to resources that are used by the web server. One or more of the security settings for one or more of the access control mechanisms are set when a security scenario is selected. Thus, the security settings for a number of different access control mechanisms can be set contemporaneously by selecting one security scenario.

Methods and apparatus for synchronizing access control in a web server

An information server adapted to service requests for information has an integral database containing configuration information, application information, and/or content information. The information in the database is stored in a hierarchical fashion with elements that correspond, in some degree, with physical storage structure or individual information objects on the information server. Path names received in information requests are broken into constituent components and are used to retrieve configuration information, application information, and/or content information from the database and information objects from physical storage. In the database properties stored at one hierarchical level may be inherited by lower hierarchical levels. The database is preferably provided with a programmatic interface that allows concurrent access to and administration of the database. Mechanisms to notify registered users of changes or events that occur with respect to the database are implemented.

System and method for administering a meta database as an integral

Growing community of inventors

Bellevue, WA, United States of America

Michael Howard