Microsoft Technology Licensing, LLC

Robert Ian Oliver

Michael David Marr

Scott A Brender

Philip J Lafornara

Alexander Frank

Mukesh Karki

Garrett R Vargas

Yusuf Atas

Daniel J Makoski

Krista L Johnson

Bradley L Carpenter

Serdar Unal

Mohammed Zubair Ansari

Timothy J Oerting

Flag

In various embodiments, a user may, via a processing device, indicate a desire to purchase a feature of an installed software product. A purchase request may be sent to an e-commerce server, or other server. The purchase request may be validated and information concerning the software product, the feature of the software product, and the processing device may be stored. Enabling information may be sent to the processing device to enable the feature of the software product. In some embodiments, the user may request a trial of a feature of a software product before purchasing the feature. In other embodiments, the user may deactivate a purchased feature of a software product on one processing device and may activate the purchased feature of the software product on a different processing device.

Purchasing of individual features of a software product

A computer network firewall or network filter functions normally to pass data on open ports to a respective service or data source associated with an open port. In addition, traffic arriving on closed ports may be directed to a handler for analysis and response. The handler may analyze and catalog the source and type of traffic arriving on the closed ports. The handler may then send a response with either a fixed response or data tailored to the type and nature of the traffic. The handler may respond slowly to cause the source of the traffic to wait for the response, thereby slowing the speed at which a potential attacker can identify valid targets and proceed past non-valid targets.

Leveraging active firewalls for network intrusion detection and retardation of attack

A method and user interface permits the display of objects in a portion of a display. The objects may initial be a first size, then shrink to a smaller size after a period of time. The objects may stack on top of each other. In addition, the objects may disappear all together after a further amount of time.

Un-intrusive display areas

The import address table of a software module is verified in order to prevent detouring attacks. A determination is made regarding which entries in the IAT must be verified; all of the entries may be verified or some subset of the entries that are critical may be verified. For each external function, the external module containing the external function is loaded, if it is not already loaded. The function address in the exported function table is found. That address is compared to the address for the function in the IAT. Additionally, the external module, in one embodiment, is verified to ensure that it has not been modified. For a delay load IAT, a similar procedure is followed; however the delay load IAT may be periodically checked to ensure that the delay load IAT entries are either valid (indicating that the external function has been bound) or in their initial state (indicating that no binding has yet occurred).

Import address table verification

Dynamic run-time verification of a module which is loaded in memory (in whole or in part) for execution is enabled by using pre-computed portion-level verification data for portions of the module smaller than the whole (e.g. at the page-level). A portion of the module as loaded into memory for execution can be verified. Pre-computed portion-level verification data is retrieved from storage and used to verify the loaded portions of the executable. Verification data may be, for example, a digitally signed hash of the portion. Where the operating system loader has modified the portion for execution, the modifications are reversed, removing any changes performed by the operating system. If the portion has not been tampered, this will return the portion to its original pre-loaded state. This version is then used to determine validity using the pre-computed portion-level verification. Additionally, during execution of the module, new portions/pages of the module which are loaded can be verified to ensure that they have not been changed, and a list of hot pages of the module can be made, including pages to be continually reverified, in order to ensure that no malicious changes have been made in the module.

Portion-level in-memory module authentication

Growing community of inventors

Issaquah, WA, United States of America

Robert Ian Oliver