Microsoft Technology Licensing, LLC

Microsoft Corporation

Muthukrishnan Paramasivam

Ravindra Pandya

Charles F Rose

Brian LaMacchia

Paul J Leach

Blair Brewster Dillaway

Scott C Cottrille

Gregory Kostal

Vladimir Yarmolenko

Dave M McPherson

Yuhui Zhong

Vasantha K Ravula

Paul England

Xin Wang

Marco A Demello

John D DeTreville

Charles Simonyi

Vinay Krishnaswamy

Sergey M Yekhanin

Peter David Waxman

Paul J Kwiatkowski

Caglar Gunyakti

John L Manferdelli

Thekkthalackal Varugis Kurien

Dheepak Ramaswamy

Thomas DeMartini

Raja Pazhanivel Perumal

Steven Bourne

William Emeric Aitken

Sreeram Nivarthi

David Richter

Janardhan Dattatreya Kulkarni

Ananthatejas Raghavan

Sivakanth Gopi

Aleksey Ashikhmin

Bob Atkinson

Lazar Ivanov

Jagadeesh Virupaksha Huliyar

Satyajit Nath

Steve Eisner

Ioannis Samaragdakis

Anjaneya Malpani

Brian Dickens

Nicolas Payette

Yeu Liu

Charles F Rose, Iii

Scott W P Hsu

Dongmei Gui

Ravi Pandya

Xinyun Sun

Sriradha Selvaraj

Bingran Luo

Dave Mcpherson

Charles F Iii Rose

Ravindra Nath Pandya

Ravindra N Pandya

A system and method for applying noise to data is described. The system accesses a metric value of a metric of each user from a group of users of an application. The metric indicates a measure of an operation of the application by a corresponding user. The system generates noise values and defines a distribution of the noise values to the group of users. The system modifies the metric value of the metric of each user with a corresponding noise value from the noise values based on the distribution.

Noise generation for differential privacy

Translation of role-based authoring models for managing RBAC 'roles' to resource authorization policy (RAP), such as ACL-based applications, is provided. A generic RBAC system is defined from which mappings to other authorization enforcement mechanism make possible the translation of RBAC 'roles' to resource authorization policies applied to resources managed by a resource manager, e.g., a file system resource manager. An implementation is described that uses Windows Authorization Manager as a storage mechanism and object model to manage object types and relationships translated from an RBAC system.

Translating role-based access control policy to resource authorization policy

A flexible use licensing system for an application comprising a plurality of licensable products is provided comprising an application level product policy definition license, and a licensable product policy definition license corresponding to each licensable product. The flexible use license further comprises a rights account certificate for validating the use license against a variety of environmental conditions, and an external validation component for validating the use license at a licensing authority without the transmittal of the entire use license.

Supplementary trust model for software licensing/commercial digital distribution policy

Abstracting access control policy from access check mechanisms allows for richer expression of policy, using a declarative model with semantics, than what is permitted by the access check mechanisms. Further, abstracting access control policy allows for uniform expression of policy across multiple access check mechanisms. Proof-like reasons for any access query are provided, such as who has access to what resource, built from the policy statements themselves, independent of the access check mechanism that provide access. Access is audited and policy-based reasons for access are provided based on the access control policy.

Abstracting security policy from, and transforming to, native representations of access check mechanisms

A license is issued to a user as decryption and authorization portions. The decryption portion is accessible only by such user and has a decryption key (KD) for decrypting corresponding encrypted digital content and validating information including an identification of a root trust authority. The authorization portion sets forth rights granted in connection with the digital content and conditions that must be satisfied to exercise the rights granted, and has a digital signature that is validated according to the identified root trust authority in the decryption portion. The user issued accesses the decryption portion and employs the validation information therein to validate the digital signature of the authorization portion. If the conditions in the authorization portion so allow, the rights in the authorization portion are exercised by decrypting the encrypted content with the decryption key (KD) from the decryption portion and rendering the decrypted content.

Flexible licensing architecture in content rights management systems

A resource of a first organization provides access thereto to a requestor of a second organization. A first administrator of the first organization issues a first credential to a second administrator of the second organization, including policy that the second administrator may issue a second credential to the requestor on behalf of the first administrator. The second administrator issues the second credential to the requester, including the issued first credential. The requestor requests access from the resource and includes the issued first and second credentials. The resource validates that the issued first credential ties the first administrator to the second administrator, and that the issued second credential ties the second administrator to the requester. The resource thus knows that the request is based on rights delegated from the first administrator to the requester by way of the second administrator.

Delegating right to access resource or the like in access management system

Disclosed herein is a technique for certifying distributable objects. The technique involves creating a certification for each distributable object to indicate properties of the object. Using certifications such as this, it is possible to accept objects having certain properties only from specified entities.

Certifying and grouping distributed objects

Supporting statements are provided to help safely and efficiently construct and verify proofs necessary for deciding whether to grant a request from one entity for accessing a resource owned or administered by another entity.

Supporting statements for credential based access control

A computer-implemented mechanism for granting rights to a resource is described. A license identifies one or more principals, resources, rights and conditions in fields of the license. The license fields include one or more instances of one or more variables. The variables are universally quantified so that each variable may be any one of a set of values. All instances of any given variable are bound to the same value.

Digital licenses that include universally quantified variables

A digital certificate is employed to produce a digital signature for a digital construct. In the digital certificate is set forth a certificate validity period defining for the digital certificate a time period during which the digital certificate is to be honored as valid for producing digital signatures, and a signature validity period defining for each digital signature produced based on the digital certificate a time period during which the digital signature is to be honored as valid.

Long-life digital certification for publishing long-life digital content or the like in content rights management system or the like

An improved certificate issuing system may comprise a certificate translation engine for translating incoming certificates and certificate requests from a first format into a second format. A certificate issuing engine may then operate on incoming requests in the common format. The issuing engine can issue certificates to clients according to its certificate issuing policy. The policy may be expressed as data in a policy expression language that can be consumed at runtime, which provides for flexible and efficient changing of issuing policy. Issued certificates can be translated back into a format that is consumed by the requesting client. Such translation can be performed by the translation engine prior to delivery of certificates to requesting clients.

Format-agnostic system and method for issuing certificates

An improved certificate issuing system may comprise a novel arrangement for expressing certificate issuing policy. The policy may be expressed in a human-readable policy expression language and stored for example in a file that is consumed by a certificate issuing system at runtime. The policy may thus be easily changed by altering the digital file. Certain techniques are also provided for extending the capabilities of the certificate issuing system so it may apply and enforce new policies.

Extendable data-driven system and method for issuing certificates

A compiler architecture uses a question and answer methodology between a reduction engine and nodes of a graph representing the program being compiled to provide for easy expandability of the compiler. By using the question and answer methodology, additional functionality can be added to the compiler by users, whether they be part of the original design team of the compiler or be a subsequent user.

Extensible compiler utilizing a plurality of question handlers

Growing community of inventors

Seattle, WA, United States of America

Muthukrishnan Paramasivam