Microsoft Technology Licensing, LLC

Scott Field

Jason Garms

Thekkthalackal Varugis Kurien

Michael Todd Kramer

David Benson Cross

Matthew W Thomlinson

Rishi Kumar

Peter Tracy

Greg Morrow

Paul J Leach

Ramesh Chinta

Gilad Golan

Allan J Cooper

Kenneth D Ray

Paul England

Nadim Y Abdo

Adrian Mihail Marinescu

Edward F Reus

Mihai Costea

Adam J Overton

Anil Francis Thomas

Art Shelest

Michael Joseph Healy

Peter T Brundrett

Narasimha Rao S S Nagampalli

Anthony Blumfield

Duncan G Bryce

Saud A Alshibani

Alvin Loh

Joseph Dadzie

Henricus Johannes Maria Meijer

John R Douceur

Stefan Thom

Pradeep Bahl

Mark Fishel Novak

Richard Bruce Ward

Praerit Garg

Marc E Seinfeld

John E Brezak

Brandon S Baker

Liqiang Zhu

Robert Karl Spiger

Bhalchandra Pandit

Mario C Goertzel

Jonathan D Schwartz

David John Linsley

Alex Mark Semenko

Carl M Carter-Schwendler

David E Kays

Jeffrey B Hamblin

Jianrong Gu

John E Parsons, Jr

Robert P Reichel

Mohamed Rouatbi

Dayi Zhou

Julian Federico Gonzalez

Yi-Min Wang

Eric P Traut

Yun Lin

Daniel Chaim Robbins

Cormac E Herley

Jason Duane Clark

Alice Jane Bernheim Brush

Carl Melvin Ellison

Srivatsan Parthasarathy

Tanmoy Dutta

David N Cutler

Sterling M Reasor

Andrew J Ritz

Thomas C Jones

Forrest Curtis Foltz

Shishir P Pardikar

Gareth Alan Howell

Klaus U Schutz

Alexey A Polyakov

James A Schwartz, Jr

Clifford P Van Dyke

Roopesh C Battepati

Suyash Sinha

Rajeev Y Nagar

Mark Vayman

John J Lambert

David Charles LeBlanc

Jeffrey M Cooperstein

John E Parsons

Pradeep Madhavarapu

Philip J Lafornara

Jeffrey F Spelman

Gopinathan Kannan

Kelvin Shek Yiu

Benjamin A Leis

Michael C Johnson

Rajesh K Dadhia

Jaroslav Dunajsky

Karthik Jaganathan

Vikas Malhotra

Ryan James Fairfax

Varugis Kurien

Gary Scot Henderson

Arindam Chatterjee

The subject disclosure relates to techniques for monitoring contextual and performance information of a device for anticipatorily sending update information to the device. An interface component can receive, from the client, contextual information indicating an operating environment of the client and performance information that is associated with one or more operations being performed by the client based on the operating environment, and send, based on correlation information, update information to the client. Further, a service component can to infer a relationship between the contextual information and the performance information to obtain the correlation information. In other embodiments, a client can populate a cache with portion(s) of the contextual information to obtain cached information, and send at least a portion of the cached information to a system including one or more aspects of the service component.

Discovery and mining of performance information of a device for anticipatorily sending updates to the device

A system and method for efficiently determining that a received file is not malware is presented. In operation, when a file is received at a computing device, an evaluation is made as to whether the file includes user-modifiable, or superficial, data areas, i.e., areas of the file that by their nature do not typically carry or embed malware. If the file includes superficial data areas, those superficial data areas are filtered out and a file signature is generated based on the remaining portions of the received file. The file can then be compared to a list of know malware to determine if the file is malware. Alternatively, the file can be compared to a list of known, trusted files to determine whether the file is trustworthy.

Efficient white listing of user-modifiable files

Security risks associated with scanning a computer are at least mitigated by performing the scanning off node. State data of a target node, or computer, can be acquired in various ways. The acquired state data can be subsequently employed to generate a virtual replica of the target computer or portion thereof on a second computer isolated from the target computer. The virtual replica of the target computer provides a scanner access to the data needed to perform a scan on the second computer without accessing or being able to impact the target computer.

Off node scanning

Systems and methods are provided for adding security to client data by maintaining keys providing access to the client data remotely from the client data. In some circumstances, the systems encrypt a cluster of data using an encryption key, associate the cluster of encrypted data with a unique identifier and send the unique identifier and the decryption key to a server for storage. The decryption key is then received from the server and is used to decrypt the cluster of encrypted data. A server can also perform policy checks or trigger additional authentication such as SMS, phone, or email notification before allowing access to a key. Furthermore, in some instances, the server can also prevent access to the stored keys in response to anomalies, such as decommissioning and other asset management events.

Theft and tamper resistant data protection

Systems and methods are provided for adding security to client data by maintaining decryption keys at a server that provide access to encrypted keys that are maintained at a client system with encrypted client data. A specialized protocol is utilized for accessing the decryption keys from the server. Once obtained, the decryption key is used to decrypt the encrypted key at the client and then the newly decrypted decryption key is used to decrypt the encrypted data. A server can also perform policy checks or trigger additional authentication such as SMS, phone, or email notification before allowing access to the server decryption key. Furthermore, in some instances, the server can also prevent access to the server decryption keys in response to anomalies, such as decommissioning and other asset management events.

This disclosure describes methods, systems, and application programming interfaces for creating a credential managed account. This disclosure describes creating a new password managed account, defining the password managed account, wherein the password managed account is to access a service on a managed computing device, identifying the password managed account for a lifecycle, and automatically managing the password managed account by updating and changing a password for the password managed account on a periodic basis.

Isolation of services or processes using credential managed accounts

In the host operating system of a computing device, entropy data is collected based at least in part on each of one or more hardware components of the computing device. An entropy pool is updated based at least in part on the collected entropy data, and data from the entropy pool is provided to a guest operating system running as a virtual machine of the computing device. The guest operating system maintains a guest operating system entropy pool based on the data from the entropy pool provided by the host operating system. The guest operating system accesses the guest operating system entropy pool and uses the guest operating system entropy pool as a basis for generating values including random numbers.

Entropy pools for virtual machines

Embodiments are directed to establishing a secure connection between computing systems and to providing computer system virtualization on a secure computing device. In one scenario, a computer system receives a request that at least one specified function be initiated. The request includes user credentials and a device claim that identifies the computing device. The computer system authenticates the user using the received user credentials and determines, based on the device claim, that the computing device is an approved computing device that has been approved to initiate performance of the specified function. Then, upon determining that the user has been authenticated and that the computing device is approved to initiate performance the specified function, the computer system initiates performance of the specified function.

Establishing secure computing devices for virtualization and administration

Embodiments described herein are directed to preventing development of insecure web pages, preventing deployment of insecure web pages and to preventing access to insecure web pages. In one embodiment, a computer system accesses a web page that includes one or more web elements. The computer system then determines that the web page includes at least one element that requests user authentication and determines whether various specified secure protocols have been implemented on the web page. Then, if the specified secure protocols have not been implemented on the web page, the computer system displays a warning or error indicating that the web page is insecure.

Providing multi-level password and phishing protection

Systems and methods that establish a secured compartment that manages sensitive user transactions/information on a user's machine. The secured compartment qualifies user interaction with the machine, and separates such qualified interaction from other user activity on the machine. A user is switched to such secured compartment upon occurrence of a predetermined event, such as in form of: an explicit request (e.g., a secure attention sequence); an implicit request (e.g., inference of user activities); and presence of a peripheral device that is bound to the secured compartment (e.g., a USB)&#x2014;wherein such actions typically cannot be generated by an application running outside the secured compartment.

Secured compartment for transactions

Methods for using scenario solution-related information to generate customized user experiences are provided. Upon receiving a user query, a plurality of results is returned, each result being representative of a scenario solution which may be utilized to address a particular issue relevant to the received query. At the time of authoring, each scenario solution is organized based upon one or more keywords and/or one or more categories (i.e., namespaces). Data associated with a namespace/keyword corresponding to a returned search result may be mined to determine information beyond basic scenario solution search results that may be of interest to the user. As the namespace(s)/keyword(s) in association with which to organize a particular executable scenario solution is determined by the author of the scenario solution, other information associated with the same namespace/keyword (and/or a namespace/keyword having a relationship thereto) is likely to be more relevant than information organized based upon keywords alone.

Using scenario-related information to customize user experiences

A facility for applying a software patch is described. Using an automatic patching agent, the facility receives the software patch. In response to receiving the software patch, without user intervention, the facility performs the following acts: First, the facility identifies an instance of an executable module that is currently loaded, and to which the received software patch pertains. Second, the facility applies the received software patch to the identified loaded executable module instance to modify the behavior of the identified executable module instance.

Efficient patching

Computer-executable instructions that are directed to the performance of consequential actions and automatically elevate to execute at a higher privilege level to do so can perform such consequential actions only after user notification. Doing so can enable monitoring processes to avoid presenting duplicative user notification upon detection of such auto-elevation. In addition, prior to presenting user notification, input from the execution environment can be ignored and access to DLLs for performing consequential actions can be avoided. A static analyzer can identify non-conforming computer-executable instructions. A wrapper can be utilized to provide compliance by otherwise unknown or non-conforming computer-executable instructions.

Unobtrusive assurance of authentic user intent

Growing community of inventors

Redmond, WA, United States of America

Scott Field