Microsoft Technology Licensing, LLC

Google Inc.

Shankar Ganesh

Venkatraman V Kudallur

John Green Bedworth

Roberto Anthony Franco

Marc Adam Silbey

Govind Varshney

Vishu Gupta

Kurt James Schmucker

Robert Impollonia

Joerg Heilig

Jian H Li

Jocelyn C Lin

Jesse Savage

David Andrew Ross

Othman Laraki

Anantha P Ganjam

John Fu

Sundar Pichai

Ann Mei Chang

Sorin Jianu

Sujal S Parikh

Lauren B Lavoie

Kusuma P Vellanki

Carl Schedvin

Various embodiments pertain to ascertaining domain contexts. In one embodiment, an application receives content that may contain a script (i.e. code). In this case, the domain context is ascertained and the script is executed in the context of the domain associated with the received content, rather than requiring the application or some other component to navigate to a location, such as a web location, to attempt to ascertain the domain context of the script. In another embodiment, third party objects or code are required to provide their domain context to an application in order for the application to make a security-based decision.

Ascertaining domain contexts

Systems and techniques to provide for software installation. In general, in one implementation, the technique includes detecting selection of one or more applications by a user; creating a manifest for the one or more applications, the manifest including a reference to the one or more applications and a reference to one or more installers, where each of the one or more applications is associated with a unique one of the one or more installers; and providing the manifest to a target system where each of the one or more applications can be installed, none of the applications or installers being provided in the manifest.

Common installer server

A model restricts un-trusted data/objects from running on a user's machine without permission. The data is received by a protocol layer that reports a MIME type associated with the DATA, and caches the data and related cache file name (CFN). A MIME sniffer is arranged to identify a sniffed MIME type based on the cached data, the CFN, and the reported MIME type. Reconciliation logic evaluates the sniffed MIME type and the CFN to determine a reconciled MIME type, and to update the CFN. A class ID sniffer evaluates the updated CFN, the cached data, and the reconciled MIME type to determine an appropriate class ID. Security logic evaluates the updated CFN, the reported class ID, and other related system parameters to build a security matrix. Parameters from the security matrix are used to intercept data/objects before an un-trusted data/object can create a security breach on the machine.

MIME handling security enforcement

A security model restricts binary behaviors on a machine based on identified security zones. Binary behaviors can be attached to an element of a document, web-page, or email message. The binary behavior potentially threatens security on the local machine. A security manager intercepts download requests and/or execution requests, identifies a security zone for the requested binary behavior, and restricts access based on the security zone. The binary behavior can identify a security zone according to the related URL. In one example, all binary behaviors associated with a security zone are handled identically. In another example, a list of permissible binary behaviors is associated with a security zone such that only specified binary behaviors are granted access. In still another example, a list of impermissible binary behaviors is associated with a security zone such that binary behaviors that are found in the list cannot initiate access.

Security restrictions on binary behaviors

A method and system for locking down a local machine zone associated with a network browser is provided. Placing the local machine zone in a lockdown mode provides stricter security settings that are applied to active content attempting to publish within a local page open in the network browser. The stricter setting are provided in a new set of registry keys that correspond to the lockdown mode of the local machine zone. The original security settings remain unchanged so that other systems and applications functionality that depends on the original security settings remains unaffected for the local machine zone. A user may also selectively allow active content to render despite the local machine zone being locked down.

Security context lockdown

Systems and techniques to provide for software installation. In general, in one implementation, the technique includes receiving a manifest, the manifest including a reference to one or more applications to be installed, obtaining an installer associated with an application, and using the associated installer to install the application on a target system, the application and the associated installer not being provided in the manifest.

Common installer client

System and method for local machine zone lockdown with relation to a network browser

A method and system for determining whether to allow a network browser action when a transition occurs between security zones as a result of the action is provided. Gaining access to a local machine zone may be a goal for unauthorized entities attempting to improperly access a user's content. The present invention therefore may be initiated to block transitions from the security zones with stricter security restrictions to zones with less security restrictions. In addition, a selected alternative may be commenced depending on the relative weight of the security zones involved the zone transition. Depending on the relative weight of security zones, the transition between zones may be allowed, prevented, or the user may be prompted to decide whether to allow or prevent the action that results in the zone transition.

System and method for zone transition mitigation with relation to a network browser

Described is a method and system by which document servers/applications (document objects) hosted by the browser may integrate with the browser's travel log. As a result, the user can use browser navigation commands, particularly forward and back commands, as well as a drop-down list of entries, to navigate among a hosted document's pages. Integration also allows the document object to add travel entries, persist relevant state, delete travel entries and update existing travel entries with new state. The browser and document object may communicate to update the browser's address bar, and to communicate various navigation events to keep each other synchronized. In one implementation, the browser limits navigation to top-level travel entries and the sub-navigation entries of the currently hosted document object, by filtering out sub-navigation entries that do not correspond to the currently-hosted document object. Frames no longer valid are also filtered from those available for navigation.

Providing travel log integration for objects hosted in a browser

Growing community of inventors

Bellevue, WA, United States of America

Shankar Ganesh