Microsoft Technology Licensing, LLC

Sermet Iskin

Scott B Graham

John Michael Sheehan

Axel Andrejs

Sashi Raghupathy

Manoj Kumar Biswas

Eric C Perlin

Christopher Scott Dickens

Ranjib Singh Badh

Sarjana Sheth

Harris Syed

Tassaduq Basu

Jayaraman Kalyana Sundaram

Howard S Kapustein

Jacob Andrew Sabulsky

Saji Abraham

Hart Wilson

Zainab Hakim

John Saxon Morrow

Jerome Thomas Holman

Liang Zhao

Erik B Christensen

Tyler Kien Beam

Steven J Ball

Michael James Coulson

Jonathan D Schwartz

Gerardo Diaz-Cuellar

Klaus U Schutz

Robin C Speed

Mathias Jourdain

James H Hong

David L Risney

David Andrew Ross

John Hazen

Monica Ioana Ene-Pietrosanu

Yunus Kilic

Stan Dale Pennington

Vaithialingam Balayoghan

Kavitha Radhakrishnan

Stefan N Richards

Nicholas David Wood

Joshua W Dunn

Katrina M Blanch

Guillermo Enrique Rueda Quintero

Rajesh Ramadoss

Stephen F Scallen

Jorge P Coronel Mendoza

Allen Kim

John A M Hazen

Nicholas D Wood

Techniques for content handling for applications are described. In one or more implementations, a first set of content handling policies is enforced for a first portion of an application that is permitted to invoke code elements of the computing device and a second set of content handling policies is enforced for a second portion of the application that is not permitted to invoke the code elements. Further, a determination is made whether to apply the first set of content handling policies or the second set of content handling policies to content based on which portion of the application is requesting the content.

Content handling for applications

An application based hardware identifier is generated for an application on a device. The application based hardware identifier is generated based on both information describing the application and information describing one or more hardware components of the device. The application based hardware identifier can also optionally be based on an identifier of a user of the device. The application based hardware identifier can be provided by the application to a service provider, allowing the service provider to associate the application based hardware identifier with a particular user or user account. However, as the application based hardware identifier is based on the application information, different applications on the same device will have different application based hardware identifiers. The application based hardware identifier thus helps maintain privacy by preventing tracking of the device across different applications.

Application based hardware identifiers

Methods, systems, and computer program products are provided for enabling selective file system access by applications. An application is installed in a computing device. An application manifest associated with the application is received. The application manifest indicates one or more file types that the application is allowed to access. The indicated file type(s) are registered in a location accessible by a broker service. The application is launched as an application process. The application process is isolated in an application container. The application container prevents direct access by the application process to file system data. An access request related to first data of the file system data is received at the broker service from the application process. Access by the application process to the first data is enabled when the broker service determines that a file type of the first data is included in the registered file type(s).

Selective file access for applications

One or more techniques and/or systems are provided for dynamically maintaining user centric data. For example, a data provider app may have knowledge about user centric data associated with a user (e.g., a social network app may have contact information for a social network friend of the user). A user centric profile may be defined for the user centric data based upon information provided by the data provider app (e.g., a contact card may be generated for the social network friend). Responsive to receiving a request for the user centric profile from a requestor app (e.g., an event planning app), the user centric profile may be exposed to the user but not to the requestor app for security and/or privacy purposes. For example, an operating system may present at least some of the user centric profile within an operating system user interface.

User centric data maintenance

A package identifier for a package from which an application is installed on a computing device is obtained. The package identifier is assigned to each of one or more processes created for running the application and, for each of the one or more processes, whether the process is permitted to access a resource of the computing device is determined based at least in part on the package identifier.

Pervasive package identifiers

Systems, methods, apparatuses, and computer program products are described for checking the integrity of applications installed on a computing device and preventing the launch of applications that appear to have been tampered with or modified. In accordance with embodiments, the content of an application is validated at the time the application is to be launched, but before the launch has actually occurred. In accordance with additional embodiments, integrity protection can also be extended to content that is generated by an application (e.g., documents or other files generated by the application), thereby enabling applications to write their own files and data with the same degree of integrity protection.

Runtime application integrity protection

An isolation execution environment provides an application with limited resources to execute an application. The application may require access to secured resources associated with a particular trust level that are outside of the isolation execution environment. A trust activation engine determines the trust level associated with a request for a resource and operates differently based on the trust level. A broker process may be used to execute components providing access to resources having a partial trust level in an execution environment that is separate from the isolation execution environment.

Trust level activation

Per process networking capability techniques are described. In one or more implementations, a determination is made as to whether access to a network capability is permitted for a process that is executed on the computing device based on a token that is associated with the process. The token has one or more security identifiers that reference one or more network capabilities described in a manifest. The access to the network capability is managed based on the determination.

Per process networking capabilities

The described method and system synchronizes source code with byproducts or artifacts of an application creation process. In one embodiment, a generation tool may be used to produce source code header files based on a design specification, where the source code header files are compiled with a current version of source code. Compilation errors may direct a developer to modify either the specification or the source code to eliminate the errors. The described method and system may be integrated into a development platform that is adapted to direct the user to perform particular revisions or updates to bring the source code in line with the artifacts.

Metadata driven API development

A computing device has a user desktop on which a relatively less-secure user application is executed and a secure desktop elevated from the user desktop on which a relatively more-secure secure application is executed upon a request thereto from the user application. To securely collect information from a user at the computer device with regard to the secure application at the secure desktop, an access interface is securely executed on the secure desktop and is visually presented in conjunction with the requesting user application of the user desktop such that the access interface is visually coupled to the requesting user application and is visually perceived by the user along with such requesting user application.

Secure privilege elevation by way of secure desktop on computing device

A system and method facilitating secure credential management is provided. An aspect of the present invention provides for a credential management system including a credential user interface component, a trusted proxy component and a secure user interface component. The system can facilitate the secure acquisition, storage and/or application of credential(s) for a user (e.g., when accessing a particular resource) through a secure, isolated environment. For example, the system can be a core building block for operating system component(s) and/or application(s) that handle credential(s) in a secure manner.

System and method facilitating secure credential management

Methods and apparatuses are provided that can inform certain processes and/or even the user about the relative strength/weakness of cryptography services being used. In certain methods, for example, at least one cryptography service parameter threshold is established. The method further includes, selectively detecting a request for at least one cryptography service, and selectively performing at least one correctness detection action based on the requested cryptography service and the cryptography service parameter threshold. The cryptography service parameter threshold identifies acceptable/unacceptable cryptography algorithms, acceptable/unacceptable cryptography key size parameters, acceptable/unacceptable cryptography seed size parameters, and other like parameters that the requested cryptography service information can be compared with.

Cryptography correctness detection methods and apparatuses

Growing community of inventors

Bellevue, WA, United States of America

Sermet Iskin