Microsoft Technology Licensing, LLC

Michael S Jerger

Michael Joseph Toutonghi

Jeffrey A Bisset

Craig T Sinclair

Kim Cameron

Max L Benson

Matthias Adam Leibmann

Edward H Wayt

Jing Wu

Kenneth Mark

Subject matter includes exemplary flexible rules for defining an information management process, for example a process that manages information being transferred between databases or with respect to an exemplary metadirectory. The flexible rules have inherent logic to define part of an information management action or a database structure and perform a call out for custom logic. The custom logic performs or defines another part of the information management action or database structure. Besides the exemplary flexible rules, the subject matter describes exemplary identity information management processes, engines, and related methods.

Rules customization and related methods

A computerized method provides unshared local storage space to a process distributed by a trusted source through the use of an identity associated with the process that specifies local capabilities for the identity on a computer. The method obtains the identity and allocates the local storage space based on the information on the local capabilities, securing the space with the identity so that only a process with the same identity can access the space. The method also enforces the local capabilities on the process by monitoring the use of the local storage space. The identity is uniquely defined by a digital certificate or similar security facility. The identity is associated with a data structure, such as a digital signature, that includes the size of the local storage space and, optionally, whether the process is subject to global storage limits set by the computer. A computerized system which executes the method is also disclosed.

Unshared scratch space

Computer-based systems and methods are disclosed for a comprehensive security model for managing active content downloaded from a computer network. The security model includes the configuration of a system security policy that is stored on a host computer. The system security policy is configured by security zone in progressively &ldquo;finer grain&rdquo; levels with each level associated with and defining the previous level. These levels may include: protected operations; user permission sets, permissions, parameters and primitives. In the disclosed method and systems, a publisher of active content specifies a requested permission set that includes a list the permissions (defined by parameters, which are defined by primitives) that the active content requires in order to run on the host system. The requested permission set is external to the active content so that it is not necessary to run the active content in order to discover the permissions that the active content requires in order to run. The requested permission set may be included in a signed code package wherein the identity of the active content publisher is guaranteed. A digital signature of the signed code package also guarantees that the contents of the signed code package, including active content, support files, and the requested permission set have not been altered or otherwise corrupted since the signed code package was published. The requested permission set may also be included in a catalog file that can be downloaded separately from the active content.

Declarative permission requests in a computer system

Computer-based systems and methods are disclosed for a comprehensive security model for managing active content downloaded from a computer network. The security model includes the configuration of a system security policy that is stored on a host computer. The system security policy is configured by security zone in progressively &ldquo;finer grain&rdquo; levels with each level associated with and defining the previous level. These levels may include: protected operations; user permission sets, permissions, parameters and primitives associated with parameters. A requested permission set is provided by the publisher of active content that lists the permissions that the active content requires in order to run on the host system. The requested permission set is automatically compared to one or more user permission sets to determine the permissions, if any that will be granted on the host system. The automated set comparisons includes determining a directional permissions sets comparison result, which is &ldquo;directional&rdquo; in that it maintains the distinction between the &ldquo;superior&rdquo; user-defined set and the &ldquo;inferior&rdquo; requested set. Determining the directional permissions sets comparison result may include determining directional primitive comparison results and merging them into a directional parameter comparison result; and determining directional parameter comparison results and merging them into a directional permission comparison result; and, determining directional permission comparison results and merging them into a directional permissions sets comparison result. The disclosed method may be practiced in the comparison of any two sets where a directional result is desirable.

Directional set operations for permission based security in a computer system

Computer-based systems and methods are disclosed for a comprehensive security model for managing foreign content downloaded from a computer network. The methods and systems include the configuration of a system security policy that is stored on a host computer. The system security policy includes one or more independently configurable security zones. Each security zone corresponds to a group of network locations and may have one or more associated configurable protected operations that control the access to the host system by foreign content downloaded from the computer network. A protected operations may have one or more associated configurable permissions that define the capabilities of the protected operation. Each permission may be defined by one or more parameters and each parameter may be defined by one or more primitives. The permissions may be defined to enable the permission, disable the permission, or prompt the user when the permission is required. The permission may also be configured to the &ldquo;fine grained&rdquo; level of the primitives. Default permission levels that provide predefined parameter and primitive entries that are grouped as high security, medium security, and low security may be selected by the user at most levels of the configuration.

Growing community of inventors

Kirkland, WA, United States of America

Michael S Jerger