Microsoft Technology Licensing, LLC

Other

Octavian Tony Ureche

Innokentiy Basmov

Preston Derek Adam

Narendra Shripati Acharya

Sai Vinayak

Alex Mark Semenko

Yogesh A Mehta

Peter Novotney

Christopher Leonard Walstad

Vijay G Bharadwaj

Scott Randall Shell

Carl Melvin Ellison

Niels Thomas Ferguson

Vishal Agarwal

Stefan Thom

Cristian Marius Ilac

Nelly L Porter

Alexander Thomas Weinert

Benjamin Richard Vincent

Nathan Jeffrey Ide

Michael J Grass

Anooshiravan Saboori

Karanbir Singh

Christopher R Macaulay

Tarek Bahaa El-Din Mahmoud Kamel

Nils Dussart

Karan Mehra

Himanshu Soni

Scott A Brender

Ping Xie

Magnus Bo Gustaf Nyström

Saurav Sinha

Charles Glenn Jeffries

Grigory Borisovich Lyakhovitskiy

Dustin Michael Ingalls

Dayi Zhou

Nicolae Voicu

Son VoBa

Michael David Marr

Kenneth D Ray

David Abzarian

John Michael Sheehan

Russell Humphries

Rajsekhar Das

Nathan T Lewis

David Rudolph Wooten

Darren Glen Moss

Erik Lee Holt

Jonathan D Schwartz

Asad Yaqoob

Yi Liu

Gopinathan Kannan

Michael A Halcrow

Jack Smith Richins

Hui Huang

Yashar Bahman

Gaurav Sinha

Elden Christensen

Yifan Wang

Peter Nicholas Biddle

Aleksandr Radutskiy

Akil M Merchant

Sainath Narendranath Thadkal

Troy Alan Funk

Salil Bhagurkar

Michael Darweesh

Philip LaFornara

Piyush Joshi

Michael D Ward

Mugdha Lakhani

Soumya D Pani

Samarth Sudhanshu Zankharia

Denis Issoupov

Stefen Thom

Son Voba

Charles G Jeffries

Narendra S Acharya

Peter J Novotney

A computing device can perform operations to unlock encrypted volumes of the computing device while the computing device is in a recovery environment. In some examples, the computing device can work in conjunction with a test computing device to unlock the encrypted volumes using an unlock token and a PIN. In other examples, the computing device can perform operations without a test computing device. For example, the computing device can, while in the recovery environment, use credentials associated with a user of the computing device to obtain a recovery password to unlock keys for interpreting the encrypted volumes. In some examples, the computing device can use a shortened recovery password in conjunction with anti-hammering capabilities of a Trusted Platform Module in order to unlock keys for interpreting the encrypted volumes. These and other operations can facilitate secure unlock of volumes of encrypted data on a consumer device.

Unlock and recovery for encrypted devices

Methods and systems are disclosed for activating data encryption at rest in a storage device server in a cloud storage. In particular, an encryption orchestrator orchestrates activation processes through encryption controllers that controls policies and privileges to access data in storage device servers. To reduce a risk of a data loss and time loss in activations, the encryption controller pre-checks a storage device server for anomalies in configurations in network connectivity, encryption keys, and security certificates before starting the activation. Furthermore, the encryption controller performs a health-check of the storage device servers to detect anomalies that require restarting the storage device servers. The health-check reduces a risk of data loss when the storage device servers become unable restart itself. User interface tools may be provided to visually identify and manage encryption statuses and policies of the encryption controllers, the storage device servers, and data storage devices.

Reliable datacenter protection at scale

Methods and devices for accessing encrypted data on a computer device may include determining that a current device state of the computer device is locked. The methods and devices may include using a level two encryption key to encrypt data associated with at least one application while the computer device is locked. The methods and devices may include using a temporary decryption key in memory of the computer device to access level two encrypted data while the computer device is locked.

Device state driven encryption key management

A data protection policy can specify which applications are allowed and/or dis-allowed from accessing cloud data that is subject to a data protection policy (i.e., data that has been assigned a classification and/or an owner.) To enforce that policy, the operating system (or other trusted entity) that stores or caches access credentials only provides these credentials to applications that are allowed by the policy. In this manner, because they are not provided with the credentials required to access the network resource, the dis-allowed applications cannot access the 'protected' data thereby helping prevent these dis-allowed (or non-compliant) applications from leaking data.

Data classification and access control for cloud based data

A multi-factor user authentication framework using asymmetric key includes a host device, a user agent, a gesture system, and an authentication system. The multiple factors include a user credential as well as a user gesture that indicates that the user is present. The user interacts with the user agent via the host device in order to obtain access to something for which user authentication is needed. The authentication system maintains the user credentials, which are provided to authenticate the user in response to the authentication system determining that the user is present (which can be determined in different manners, such as using a personal identification number (PIN), biometric information regarding the user, geographic location of the gesture system, etc.). The user agent, gesture system, and authentication system can be implemented on the same device (e.g., the host device), or alternatively implemented across one or more different devices.

Multi-factor user authentication framework using asymmetric key

A system may identify resources such as applications or network locations that are not adequately covered by an enterprise's security policy to notify a network administrator of such deficiencies. An exemplary security policy may allow or deny access to individual functional resources (e.g. computing devices and/or applications) or groups of functional resources to individual data resources (e.g. enterprise network storage locations and/or enterprise data) or groups of data resources. The system may monitor enterprise network activity to identify when a security policy fails to define permissions corresponding to the use of particular resources. In response to identifying such gaps in the security policy, the system may enter policy enforcement event information into a policy learning log. The system may further generate a policy gap notification and transmit this notification to a policy management service to prompt a network administrator to take remedial action if appropriate.

Incremental security policy development for an enterprise network

A data protection policy can specify which applications are allowed and/or dis-allowed from accessing cloud data that is subject to a data protection policy (i.e., data that has been assigned a classification and/or an owner.) To enforce that policy, the operating system (or other trusted entity) that stores or caches access credentials only provides these credentials to applications that are allowed by the policy. In this manner, because they are not provided with the credentials required to access the network resource, the dis-allowed applications cannot access the 'protected' data thereby helping prevent these dis-allowed (or noncompliant) applications from leaking data.

Content on a device is encrypted and protected based on a data protection key. The protected content can then be copied to cloud storage, and from the cloud storage the protected content can be transferred to various other ones of the user's devices. A key used to retrieve plaintext content from the protected content is associated with an identifier of a particular device that provides the key, the device providing the key being the device that generated the key, or another managed device to which the protected content was transferred. A wipe command can similarly be transferred to the various ones of the user's devices, causing any keys associated with a particular device to be deleted from each of the various ones of the user's devices.

Roaming content wipe actions across devices

Content on a device is encrypted and protected based on a data protection key corresponding to a particular identity of the user of the device. The protected content can then be stored to cloud storage, and from the cloud storage the protected content can be transferred to various other ones of the user's devices. A data protection key that is used to retrieve the plaintext content from the protected content is maintained by the user's device. This data protection key can be securely transferred to other of the user's devices, allowing any of the user's devices to access the protected content.

Secure key management for roaming protected content

Data files are encrypted based on a key associated with an entity that sets a data protection policy controlling access to the data files. The data protection policy identifies various restrictions on how the plaintext data of the encrypted data in the data files can be used. The data files have corresponding metadata identifying the entity that sets the data protection policy, and processes that are running instances of applications that are allowed to access the plaintext data are also associated with the identifier of the entity. These identifiers of the entity, as well as the data protection policy, are used by an operating system of a computing device to protect the data in accordance with the data protection policy, including having the protection be transferred to other devices with the protected data, or preventing the protected data from being transferred to other devices.

Preserving data protection with policy

Growing community of inventors

Bellevue, WA, United States of America

Octavian Tony Ureche