University of Washington

Microsoft Technology Licensing, LLC

Tadayoshi Kohno

Franziska Roesner

Alexander Nikolavich Moshchuk

Jiahe Helen Wang

David Alexander Molnar

Henry M Levy

Roxana Geambasu

Alan M Dunn

Kiron Lebeck

Eyal Ofek

Suman Kumar Nath

Joshua R Smith

Benjamin Livshits

Oriana Riva

Margus Veanes

Bryan Jeffrey Parno

Helen Jiahe Wang

James Anthony Fogarty

Steven Gribble

Timothy Scott Saponas

Arvind Krishnamurthy

Loris D'Antoni

Kimberly C Ruth

Suman Jana

Gabriel Maganis

Thomas Ristenpart

Alexei Czeskis

Karl Koscher

Michael Toomim

James Landay

Nathan Morris

Temitope Oluwafemi

Xianhang Zhang

Alexander N Moshchuk

David A Molnar

In some embodiments, an augmented reality system is provided. The augmented reality system is configured to detect real-world objects, create software objects that represent the real-world objects, receive requests from applications to present virtual objects at locations associated with the real-world objects, and to present the virtual objects. In some embodiments, an operating system of the augmented reality system is configured to resolve conflicts between requests from multiple applications. In some embodiments, the operating system of the augmented reality system is configured to provide information to applications to allow the applications to avoid or resolve conflicts amongst themselves.

Techniques for enabling multiple mutually untrusted applications to concurrently generate augmented reality presentations

In some embodiments, a method of providing visual cues for private virtual objects is provided. In response to determining that presentation of a protected characteristic of a virtual object is not permitted by an augmented reality system, the augmented reality system presents a placeholder object. In some embodiments, a method of protecting a location from undesirable virtual objects is provided. In response to determining that a location for a virtual object is associated with a protected location, a low-invasiveness version of a mesh of the virtual object is presented. In some embodiments, a method of decoupling a virtual object from a static physical location is provided.

Techniques for managing multi-user content in augmented reality applications

In some embodiments, an augmented reality system is provided that provides output security. In some embodiments, an operating system of the augmented reality system provides trusted management support for presenting virtual objects from untrusted applications executing in multiple isolated processes. With the output security mechanisms enabled, untrusted applications are still provided significant flexibility to create immersive AR experiences, but their presented content is constrained by the augmented reality system based on one or more output policies that are intended to reduce intrusiveness of virtual object presentations. Output policies may be composable, such that more than one output policy may be enforced on a given virtual object in a way that reduces intrusiveness of the presentation of the virtual object.

Methods and systems for providing presentation security for augmented reality applications

Systems and methods for creating and managing per-application profiles are disclosed. A method may include receiving input designating at least a first profile policy and a second profile policy. At least a first application profile and a second application profile may be created based on the received first profile policy and the second profile policy. An application of the plurality of applications may be associated with both the first application profile and the second application profile. A first storage partition and a second storage partition may be created within a storage space of the computing device. The storage space may be associated with the application. The first storage partition may store application data while the application is running under the first application profile. The second storage partition may store application data while the application is running under the second application profile.

System and method for using per-application profiles in a computing device

Functionality is described herein for receiving events which characterize features in an environment, and for identifying at least one policy based on the events. The functionality consults a certificate, associated with the policy, to determine whether the policy is valid. If valid, the functionality uses the policy to govern the behavior of at least one application, such as by controlling the application's consumption of events. A trusted passport authority may be employed to generate the certificates. Each certificate may: (1) identify that it originated from the trusted passport authority; (2) contain context information which describes a context in which the policy is intended to be applied within an environment; and/or (3) contain machine-readable content that, when executed, carries out at least one aspect of the policy.

World-driven access control using trusted certificates

Systems and methods for providing an auditing file system for theft-prone devices are disclosed. The auditing file system supports fine-grained file auditing: a user may obtain reliable, explicit evidence that no files have been accessed after a device's loss. A user may also disable future file access after a device's loss, even in the absence of device network connectivity. In one embodiment, files are encrypted locally but the encryption keys are stored remotely, so that an audit server is queried for encryption keys to access protected files. By configuring the audit server to refuse to return a particular file's key, the user can prevent new accesses after the device is lost.

Systems and methods for file access auditing

A shared renderer maintains shared state information to which two or more augmented reality application contribute. The shared renderer then provides a single output presentation based on the shared state information. Among other aspects, the shared renderer includes a permission mechanism by which applications can share information regarding object properties. The shared renderer may also include: a physics engine for simulating movement of at least one object that is represented by the shared state information; an annotation engine for managing a presentation of annotations produced by plural applications; and/or an occlusion engine for managing the behavior of the output presentation when two or more objects, produced by two or more applications, overlap within the output presentation.

Managing shared state information produced by applications

Functionality is described herein for managing the behavior of one or more applications, such as augmented reality applications and/or other environment-sensing applications. The functionality defines permission information in a world-driven manner, which means that the functionality uses a trusted mechanism to identify cues in the sensed environment, and then maps those cues to permission information. The functionality then uses the permission information to govern the operation of one or more applications.

World-driven access control

Functionality is described herein by which plural environment-sensing applications capture information from an environment in a fine-grained and least-privileged manner. By doing so, the functionality reduces the risk that private information that appears within the environment will be released to unauthorized parties. Among other aspects, the functionality provides an error correction mechanism for reducing the incidence of false positives in the detection of objects, an offloading technique for delegating computationally intensive recognition tasks to a remote computing framework, and a visualization module by which a user may inspect the access rights to be granted (or already granted) to each application.

Managing access by applications to perceptual information

An access system is described herein which allows an application module to access a user-owned resource based on an indication of a user's intent to interact with the user-owned resource. For example, the application module can provide an application user interface which embeds a gadget associated with a particular user-owned resource. The access system can interpret the user's interaction with the gadget as conferring implicit permission to the application module to access the user-owned resource associated with the gadget. In addition, or alternatively, the user may make a telltale gesture in the course of interacting with the application module. The access system can interpret this gesture as conferring implicit permission to the application module to access a user-owned resource that is associated with the gesture.

User-driven access control

A privacy-preserving device-tracking system and method to assist in the recovery of lost or stolen Internet-connected mobile devices. The function of such a system seem contradictory, since it is desirable to hide a device's legitimately-visited locations from third-party services and other parties to achieve location privacy, while still enabling recovery of the device's location(s) after it goes missing by tracking the device to determine its location. An exemplary embodiment uses a DHT for storing encrypted location information and other forensic information in connection with indices that are successively determined based on initial pseudorandom seed information (i.e., state) that is retained by the owner of the device. Using the seed information, the software can determine indices mapped to location information stored after the device went missing, enabling the device to be located. Numerous extensions are discussed for the basic exemplary design that increase its suitability for particular deployment environments.

Privacy-preserving location tracking for devices

An approach for defending radio frequency identification (RFID) tags and other contactless cards against ghost-and-leech (a.k.a. proxying, relay, or man-in-the-middle) attacks incorporates gesture recognition techniques directly implemented with the RFID tags or contactless cards. These tags or cards will only engage in wireless communications when they internally detect 'secret handshakes.' A secret handshake recognition system is implemented on a passive WISP RFID tag having a built-in accelerometer. This approach is backward compatible with existing deployments of RFID tag and contactless card readers and is also designed to minimize the changes to the existing usage model of certain classes of RFID and contactless cards, such as access cards that are kept in a wallet or purse, by enabling execution of secret handshakes without removing the card. This novel approach can also improve the security and privacy properties in other uses of RFID tags, e.g., contactless payment cards.

Radio frequency identification secret handshakes

A configuration for encapsulating data that is unreadable after a predetermined timeout. To encapsulate data a random data key is generated and split into shares. A threshold number of shares are needed to reconstruct the key. The shares are stored at random locations within one or more networks. Each location is configured to delete the stored data after a predetermined time period. Encapsulated data is created by creating a vanishing data object (VDO) comprising the encrypted data, and data sufficient to locate at least a threshold number of key shares from their stored locations. The VDO becomes inaccessible after enough shares of the data are deleted such that the data key cannot be restored. However, if prior to timeout a sufficient number of data key shares are located and retrieved the data key can be reconstructed. The reconstructed data key is then used to decrypt the original data.

Encapsulation and decapsulation for data disintegration

Access to resource(s) intended to be shared with specific groups of individuals is controlled using concise tests of shared knowledge instead of (or in addition) to accounts and access control lists. Users can readily learn the concept and choose questions that will control the access by the desired group with little effort. Such questions can be relatively secure to guesses by those not intended to have access, particularly if the number of allowed guesses is relatively limited. Users can generally predict the security of their questions, but sometimes underestimate the ability of attackers to use Web searching or enumeration to discover answers. In such cases, the system can automatically discover weak questions and then suggest alternatives. By lowering the threshold to access control, shared knowledge tests can enable more types of information to acquire collaborative value on the Internet and on other types of networks.

Growing community of inventors

Seattle, WA, United States of America

Tadayoshi Kohno