Microsoft Technology Licensing, LLC

Scott Randall Shell

Igor B Peev

Yuhang Zhu

Md Nazmus Sakib

Octavian Tony Ureche

Innokentiy Basmov

Roman Sherman

Peter Novotney

Yogesh A Mehta

Jeffrey A Sutherland

Christopher Leonard Walstad

Lee M Butler

Neil Laurence Coles

Matthew Whiting Taylor

Yadhu Nandh Gopalan

Andrew Michael Rogers

Scott Daniel Anderson

Garrett R Vargas

Jeffrey Richard McKune

Kinshumann Kinshumann

Upender Sandadi

Alan W Shen

Hung Minh Dang

Michael E Markley

Deskin M Miller

Matthew G Lyons

Thomas W Caldwell

Ling Tony Chen

Kevin Timothy Shields

Kevin John Savage

Scott Michael Bragg

Nicholas Milton Hofmeister

Angelo Renato Vals

Christopher Ross Jordan

Jeffrey D Glaum

David L Anson

Mihai Irinel Susan

Bogdan Andreiu

Miller Thomas Abel

Sachin C Patel

Peter David Waxman

John Mark Miller

George Joy

Peter J Kaufman

Loren Kohnfelder

David John Linsley

Giridhar Viswanathan

Bor-Ming Hsieh

Daryn Elliot Robbins

Kinshuman Kinshumann

Mark Plagge

Andrew D Rogers

Andrew D Padawer

Daniel N Boone

Sharath Viswanathan

Andrew Raffman

Janani Vasudevan

Brian David Cross

Justin Alexander Hou

Kinshumann

Keith C Bentley

Jon Vincent

Dale R Rolf

JianMing M Zhou

Mark Scott Tonkelowitz

Ian James McCarty

Anthony Kitowitz

Anthony Kitowicz

Brian Hudson

Miguel A Claudio

William E Stelzel

Avinashreddy Bathula

Jimmy Alexander

Deven Robert Desai

Jaskaran Singh Khurana

Jessica M Krynitsky

Zoheb Vacheri

Katharine O Holdsworth

Jeffery D Glaum

Lorna Rebecca McNeill

Mukkul Dasgupta

Ian Mccarty

- Kinshumann

Jianming M Zhou

A computing device can perform operations to unlock encrypted volumes of the computing device while the computing device is in a recovery environment. In some examples, the computing device can work in conjunction with a test computing device to unlock the encrypted volumes using an unlock token and a PIN. In other examples, the computing device can perform operations without a test computing device. For example, the computing device can, while in the recovery environment, use credentials associated with a user of the computing device to obtain a recovery password to unlock keys for interpreting the encrypted volumes. In some examples, the computing device can use a shortened recovery password in conjunction with anti-hammering capabilities of a Trusted Platform Module in order to unlock keys for interpreting the encrypted volumes. These and other operations can facilitate secure unlock of volumes of encrypted data on a consumer device.

Unlock and recovery for encrypted devices

An application is installed on a computing device from an application package. An origin of the application (e.g., a managed installer for an enterprise, a reputation checking service) is propagated to files written to a storage device of the computing device as part of the installation, such as by writing origin information to the storage device as metadata associated with the file. The origin information for a file, in conjunction with a policy on the computing device specifying one or more trusted origins for applications on the computing device, is used to identify whether a particular action can be taken with and/or by the file. These actions can include, for example, execution of an application from an executable file. If the origin information for a file indicates an origin that is a trusted origin specified by the policy, then the action can be performed.

Propagating origin information for applications during application installation

Integrity verification of a containerized application using a block device signature is described. For example, a container deployed to a host system is signed with a single block device signature. The operating system of the host system implements an integrity policy to verify the integrity of the container when the container is loaded into memory and when its program code executes. During such events, the operating system verifies whether the block device signature is valid. If the block device signature is determined to be valid, the operating system enables the program code to successfully execute. Otherwise, the program code is prevented from being executed. By doing so, certain program code or processes that are not properly signed are prevented from executing, thereby protecting the host system from such processes. Moreover, by using a single block device signature for a container, the enforcement of the integrity policy is greatly simplified.

Block device signature-based integrity protection for containerized applications

Embodiments are directed to managing software components loaded on a device by identifying a platform manifest having a valid certificate, confirming that the platform manifest is bound to the device, identifying components listed on the platform manifest, confirming that the listed components have a valid certificate, and loading listed components with valid certificates on the device. The components may be binaries and packages for an operating system. The components may be signed in an embedded manner or with detached signatures. The platform manifest may be bound to the device in a manner that allows for identification of unauthorized platform manifests.

Securely defining operating system composition without multiple authoring

A device boots in a secure manner that allows measurements reflecting which components are loaded during booting to be generated. Measurements of such components, as well as of a device management agent and the security state of the device, are also obtained. The device management agent accesses an attestation service for an enterprise, which is a collection of resources managed by a management service. The device management agent provides the obtained measurements to the attestation service, which evaluates the measurements and based on the evaluation determines whether the device is verified for use in the enterprise. The management service uses this verification to ensure that the device management agent is running in a secure manner, is accurately providing indications of the state of the device to the management service, and is implementing policy received from the management service.

Device attestation through security hardened management agent

When theft protection of a computing device is initiated, credentials of the user are provided to one or more services that verify the credentials and generate a recovery key. A data value is generated based on the recovery key and an identifier of the computing device (e.g., by applying a cryptographic hash function to the recovery key and the computing device identifier), and the data value is provided to the computing device, which stores the data value at the computing device. When a user is prompted to prove his or her ownership of the device, the owner can prove his or her ownership of the device in different manners by accessing the one or more services via a network (e.g., the Internet), or by providing the recovery key (e.g., obtained using another computing device) to the computing device.

Device theft protection associating a device identifier and a user identifier

An inter-process messaging security management may be provided. A message comprising an operation to be performed may be sent from a process operating in a process chamber to a second process operating in another chamber. Before the message is allowed to be delivered, the validity of the operation contained in the message may be verified and a security policy may be examined to determine whether the message is permitted to be sent from the first process to the second process. If the security policy permits the second process to execute the operation requested by the first process, the message may be delivered to the second process. If the operation is not permitted, the message may not be delivered and an error message may be returned to the first process.

Inter-process message security

Embodiments provide a security infrastructure that may be configured to run on top of an existing operating system to control what resources can be accessed by an applications and what APIs an application can call. Security decisions are made by taking into account both the current thread's identity and the current thread's call chain context to enable minimal privilege by default. The current thread context is captured and a copy of it is created to be used to perform security checks asynchronously. Every thread in the system has an associated identity. To obtain access to a particular resource, all the callers on the current thread are analyzed to make sure that each caller and thread has access to that resource. Only when each caller and thread has access to that resource is the caller given access to that resource.

Granting least privilege access for computing processes

This disclosure describes techniques of using a centralized rule database to control the abilities of software processes to perform actions with regard to resources provided by a computer. As described herein, each software process executing in a computer executes within a chamber and each resource provided by the computer is associated with a canonical name that uniquely identifies the resource. Furthermore, the computer stores a set of security rules in a centralized rule database. In addition, this disclosure describes techniques of enforcing the rules stored in the centralized rule database.

Centralized enforcement of name-based computer system security rules

Growing community of inventors

Kirkland, WA, United States of America

Scott Randall Shell