Microsoft Technology Licensing, LLC

Min Feng

Bin Benjamin Zhu

Shipeng Li

Jun Shao

Rui Guo

Aimin Pan

Yao Zhang

Josh D Benaloh

Yuan Kong

Nathan C Sherman

Yang Yang

Xu Yin

Hui Fan

Technologies for distributed single sign-on operable to provide user access to a plurality of services via authentication to a single entity. The distributed single sign-on technologies provide a set of authentication servers and methods for privacy protection based on splitting secret keys and user profiles into secure shares and periodically updating shares among the authentication servers without affecting the underlying secrets. The correctness of the received partial token or partial profiles can be verified with non-interactive zero-knowledge proofs.

Distributed single sign on technologies including privacy protection and proactive updating

Described is an optimistic fair payment protocol in electronic commerce that provides fair payment while resisting an unconscious double spending attack and other attacks. A buyer receives encrypted e-goods from a merchant, and sends payment to the merchant. If decryption information is not received in exchange for the payment, or the decryption information does not render the e-goods useable, the buyer launches a dispute with a third party dispute resolution service. If the decryption information is received and renders the e-goods useable, the buyer determines whether the e-goods are valid, according to a corresponding description. If not valid, the buyer launches a dispute and provides the e-goods and the description. The third party uses the description to evaluate the validity of the goods to determine whether to refund the payment to the buyer or release it to the merchant.

Fair payment protocol with semi-trusted third party

Technologies for distributed single sign-on operable to provide user access to a plurality of services via authentication to a single entity. The distributed single sign-on technologies provide a set of authentication servers and methods for privacy protection based on splitting secret, keys and user profiles into secure shares and periodically updating shares among the authentication servers without affecting the underlying secrets. The correctness of the received partial token or partial profiles can be verified with non-interactive zero-knowledge proofs.

A component-oriented web mashup system and method for communicating between component-oriented Web gadgets to facilitate secure Web mashups. Embodiments of the system and method redefine the traditional definition of gadget to mean a Web component having a verifiable controlled communication channel (a CompoWeb gadget). A CompoWeb gadget is created and defined using new HTML tags and global script objects and functions that extend the functions of the browser. CompoWeb gadget content is treated as a component that is isolated from other gadgets and frames by a browser, and only those allowed access can view data and code therein. Called functions of a CompoWeb gadget are run in the callee's environment instead of the caller's environment. This adds security, because all the requesting CompoWeb gadget receives is the run result. Embodiments of the system and method also include delayed binding of CompoWeb gadgets, such that binding is performed at run time.

Component-oriented architecture for web mashups

An exemplary optimistic protocol for a two-party transaction includes a setup sub-protocol that includes an authorized Diffie-Hellman key agreement, an exchange sub-protocol that includes sending a certificate from a sending party to a receiving party and sending a receipt from the receiving party to the sending party and a dispute sub-protocol that includes a dispute resolution mechanism for resolving disputes between the sending party and the receiving party due to sending of an invalid certificate, due to sending an invalid receipt, or due to abortion of the exchange sub-protocol. Other exemplary methods, systems, etc., are also disclosed.

Efficient certified email protocol

Mobile device assisted secure computer network communications embodiments are presented that employ a mobile device (e.g., a mobile phone, personal digital assistant (PDA), and the like) to assist in user authentication. In general, this is accomplished by having a user enter a password into a client computer which is in contact with a server associated with a secure Web site. This password is integrated with a secret value, which is generated in real time by the mobile device. The secret value is bound to both the mobile device's hardware and the secure Web site being accessed, such that it is unique to both. In this way, a different secret value is generated for each secure Web site accessed, and another user cannot impersonate the user and log into a secure Web site unless he or she knows the password and possesses the user's mobile device simultaneously.

Mobile device assisted secure computer network communication

Technologies for a Consumer Privacy Digital Rights Management system based on stable partially blind signatures that enable a license server to provide licenses for delivery to users without knowing the corresponding digital contents that users access with the license. Therefore consumer privacy is protected during license acquisition. Further, if the client DRM module in the DRM system does not disclose any information about a user's digital content access, and the messages that the client DRM module sends out are in plain text enabling verification that the client DRM module is not disclosing such information, then consumer privacy is fully protected by the DRM system.

Digital rights management system protecting consumer privacy

A security-enhanced login technique that provides a convenient and easy-to-use two factor technique to enhance the security of passwords without requiring any changes on the server side of a client-server network. The technique employs a convenient and easy-to-use two-factor technique to generate strong passwords for Web and other applications. In this technique, a convenient or personal device such as a mouse is used as the other factor besides a user password. A secret stored in the mouse or other personal device is hashed together with the password entered by a user and the server ID, to generate a strong, server-specific password which is used to authenticate the user to the server. This password enhancement operation is carried out inside the personal device.

Security-enhanced log in

Systems and methods provide a content encryption schema for integrating digital rights management (DRM) in a multicast/broadcast encryption system. In one implementation, an exemplary integrated key schema provides content encryption keys that can be employed by a multicast or broadcast process, while providing DRM protection of recorded multicast content via a single DRM decryption secret. The integrated key schema provides high security and allows encrypted multicast content to be saved directly to local files. A license server can efficiently manage and generate DRM keys to be delivered to clients because only a single key needs to be delivered per license to a client. The integrated key schema can be applied together with conventional broadcast or multicast encryption techniques.

Content encryption schema for integrating digital rights management with encrypted multicast

A flexible framework for generating 'scalable layered access' codestreams allows a bitstream architect to select the number of access types and the number of access layers within each access type. At least some of the access layers are encrypted (or scrambled). Some of the access layers may be left unencrypted or unscrambled to allow free access to those layers. The framework facilitates simultaneous access of multimedia content by different users enjoying selective decryption of different access types and different access layers. An exemplary key schema for the framework sends only one or only a few keys to an end user for a given access layer, from which decryption keys for the content can be derived by hashing and then combining under a Group Diffie-Hellman key agreement. In one implementation, only one key is sent in a license to an end user and other partial key information for Group Diffie-Hellman combination with the licensed key is included in the publicly distributed codestream.

Growing community of inventors

Sichuan, China

Min Feng