Microsoft Technology Licensing, LLC

Nick Voicu

Stefan Thom

Marc R Barbour

Robert Karl Spiger

Himanshu Soni

Kirk Shoop

Xintong Zhou

Liqiang Zhu

Yi Zeng

Rajalakshmi Dani

Neil Shipp

David Hetherington

Jiahui Wang

Anand Madhava Menon

Guanghui He

Zhaoan Liu

Gavin Ackroyd

Magnus NystrÖm

Magnus Nyström

Yu Huang

Yu (Kyle) Huang

When a user inputs an action request, such as a requested command, to be performed on a target machine, a management system receives the request and verifies it with a separate authentication and permission system. The verified command request is sent to the target machine. An authentication worker on the target machine accesses a set of policies, local to the target machine, to identify a least privileged execution environment in which the requested command can be performed. The authentication worker on the target machine launches the requested command within the identified least privileged execution environment on the target machine.

Security and permission architecture

Computing devices utilizing trusted execution environments as virtual smart cards are designed to support expected credential recovery operations when a user credential, e.g., personal identification number (PIN), password, etc. has been forgotten or is unknown. A computing device generates a cryptographic key that is protected with a PIN unlock key (PUK) provided by an administrative entity. If the user PIN cannot be input to the computing device the PUK can be input to unlock the locked cryptographic key and thereby provide access to protected data. A computing device can also, or alternatively, generate a group of challenges and formulate responses thereto. The formulated responses are each used to secure a computing device cryptographic key. If the user PIN cannot be input to the computing device an entity may request a challenge. The computing device issues a challenge from the set of generated challenges. Upon receiving a valid response back, the computing device can unlock the secured computing device cryptographic key associated with the issued challenge and subsequently provide access to protected data.

Secure credential unlock using trusted execution environments

Growing community of inventors

Bellevue, WA, United States of America

Nick Voicu