Microsoft Technology Licensing, LLC

Philip J Lafornara

Michael David Marr

Robert George Atkinson

Antony S Williams

Clifford Paul Strom

Krishnamurthy Ganesan

Vijay Gajjala

Andrew L Bliss

Jeffrey Richard McKune

Charlie David Chase, Jr

Alexander G Tilles

Philip Ljubicich

John L Manferdelli

Charles F Rose

Scott A Brender

Rushmi U Malaviarachchi

Robert Ian Oliver

Kenneth D Ray

Scott Field

Russell Humphries

Carl Melvin Ellison

Brian LaMacchia

Niels Thomas Ferguson

Blair Brewster Dillaway

Thekkthalackal Varugis Kurien

Jamie Hunter

Ram Pratap Singh

Steven Edward Jackson

Bradley S Serbus

Jon D Pulsipher

Timothy J Oerting

Brian A Lamacchia

Rushimi U Malaviarachchi

Charles F Iii Rose

Technologies are described herein for launching an online support chat session in response to an occurrence of a support event on a personal computer and transmitting detailed event information via the chat session for display to support personnel. When an error or other event occurs on a computer, an online support chat session is established using an online support chat client associated with the error or event. The pertinent information about the error or event along with additional data regarding the computer and the user are transmitted via the online support chat session for display to the support personnel.

Initiating a support chat session in response to the occurrence of a support event with transmission of detailed event information

Systems, methods, and computer-readable media for identifying executable scenario solutions relevant to a user query and returning such executable scenario solutions as search results in response to the user query are provided. Upon receiving a user query, a plurality of results is returned, each result being representative of a series of steps which may be implemented to address a particular issue relevant to the received user query. Often, a series of steps or scenario includes a number of sub-scenarios, each of which is to be executed sequentially to achieve the desired result. Accordingly, upon selection of a particular search result, the user may be guided through a series of sub-scenario result options until an item having direct association to a series of steps is selected. Once selected, the executable scenario solution is presented to the user for execution.

Identifying executable scenarios in response to search queries

Access to a storage device, such as a disk, is controlled by performing a disk operation using a single cryptographic engine. Keys associated with each layer of a layered structure associated with controlling access to the storage device are combined. The resultant of this combination is used as the key to the cryptographic engine. Data to be retrieved from and written to the storage device are operated on by the cryptographic engine utilizing the combined key. Keys are combined by combining functions associated with layers of the layered structure. A combining function can include an exclusive or function, a cryptographic hash function, or a combination thereof.

Storage device controlled access

The import address table of a software module is verified in order to prevent detouring attacks. A determination is made regarding which entries in the IAT must be verified; all of the entries may be verified or some subset of the entries that are critical may be verified. For each external function, the external module containing the external function is loaded, if it is not already loaded. The function address in the exported function table is found. That address is compared to the address for the function in the IAT. Additionally, the external module, in one embodiment, is verified to ensure that it has not been modified. For a delay load IAT, a similar procedure is followed; however the delay load IAT may be periodically checked to ensure that the delay load IAT entries are either valid (indicating that the external function has been bound) or in their initial state (indicating that no binding has yet occurred).

Import address table verification

Dynamic run-time verification of a module which is loaded in memory (in whole or in part) for execution is enabled by using pre-computed portion-level verification data for portions of the module smaller than the whole (e.g. at the page-level). A portion of the module as loaded into memory for execution can be verified. Pre-computed portion-level verification data is retrieved from storage and used to verify the loaded portions of the executable. Verification data may be, for example, a digitally signed hash of the portion. Where the operating system loader has modified the portion for execution, the modifications are reversed, removing any changes performed by the operating system. If the portion has not been tampered, this will return the portion to its original pre-loaded state. This version is then used to determine validity using the pre-computed portion-level verification. Additionally, during execution of the module, new portions/pages of the module which are loaded can be verified to ensure that they have not been changed, and a list of hot pages of the module can be made, including pages to be continually reverified, in order to ensure that no malicious changes have been made in the module.

Portion-level in-memory module authentication

A digital certificate identifies an entity as having authority over the certificate to revoke same as delegated by the issuer. The certificate also has at least one revocation condition relating to possible revocation of the certificate. To authenticate the certificate, the identification of the delegated revocation authority, a location from which a revocation list is to be obtained, and any freshness requirement to be applied to the revocation list are determined from the certificate. It is then ensured that the revocation list from the location is present and that the present revocation list satisfies the freshness requirement, that the revocation list is promulgated by the delegated revocation authority identified in the certificate, and that the certificate is not identified in the revocation list as being revoked.

Revocation of a certificate and exclusion of other principals in a digital rights management (DRM) system based on a revocation list from a delegated revocation authority

In order to allow for security beyond revocation lists, a policy regarding when permissions may be granted (in the form of a rights document, e.g. a use license or a certificate) is enforced. When a request is made for a rights document, the requester submits an account certificate which includes certain metadata regarding the requester. This metadata is analyzed to determine whether it meets a specific policy before the request is granted. If the request is not granted, the cause of the rejection may be overcome, for example by updating or upgrading some system component (hardware or software) in the requesting system. In certain cases, such an update to overcome a policy-based rejection may be performed transparently to the user.

Enhancing digital rights management system security through policy enforcement

Content revocation is achieved by disabling licenses issued to a computing device for the content. A content revocation is delivered within a license to the computing device. Upon license storage the content revocation is recognized, validated, and stored in a secure state store under the public key of the content server (PU-CS) that issued the content. Each license has a (PU-CS) therein, and each license evaluation considers each content revocation stored in the state store and having the same (PU-CS). The license is disabled or otherwise affected based on the considered content revocation. A content revocation is one form of a license modification that may be delivered within a license.

Content revocation and license modification in a digital rights management (DRM) system on a computing device

A method and system for interfacing an application program with a compound document storage system. The present invention provides an interface which an application program uses to manipulate compound documents. In a preferred embodiment, this interface is implemented in a multilayered architecture. The first layer provides methods which an application program uses to access a compound document using the functions of the second layer. The second layer maps requests to store data in the compound document to a storage format using the functions of the third layer. The third layer maps requests to write to a file to an arbitrary storage medium.

Method and system for storing and accessing data in a compound document

Method and system for storing data objects using a small object data

A method and system for interfacing an application program with a compound document storage system. The present invention provides an interface which an application program uses to manipulate compound documents. In a preferred embodiment, this interface is implemented in a multilayered architecture. The first layer provides methods which an application program uses to access a compound document using the functions of the second layer. The second layer maps requests to store data in the compound document to a storage format using the functions of the third layer. The third layer maps requests to write to a file to an arbitrary storage medium. In another aspect, the present invention provides for the transactioning of modifications to data in a file that is stored in a tree structure having nodes. When modifications are made to a node that is not transacted, the modifications are associated with the closest ancestor node that is transacted. When modifications are made to a node that is transacted, the modifications are associated with that node. When such associated modifications are committed, the modifications are disassociated from that node and associated with the closest ancestor node that is transacted.

Method and system for transactioning of modifications to a tree

Growing community of inventors

Bellevue, WA, United States of America

Philip J Lafornara