Microsoft Technology Licensing, LLC

Other

Ford Motor Company Limited

Thomas C Jones

David Benson Cross

Paul J Leach

Arnold Neil Blinn

Marcus Peinado

Matthew W Thomlinson

Philip Joseph Hallin

Rajasekhar Abburi

Jeffrey R C Bell

Paul England

Klaus U Schutz

Peter T Brundrett

Josh D Benaloh

Mariusz Hieronim Jakubowski

John L Manferdelli

Eric C Perlin

Jianrong Gu

Glenn D Pittaway

Ramaranthnam Venkatesan

Hai Ying (Vincent) Yu

Scott Field

Mark Fishel Novak

Richard Bruce Ward

Tanmoy Dutta

Kedarnath Atmaram Dubhashi

Krishnamurthy Ganesan

Jonathan D Schwartz

John J Lambert

Jeffrey B Hamblin

Lawrence Anderson Queener

Sunil P Gottumukkala

Sunil Kadam

Matthew Z Tamayo-Rios

Andreas K Luther

Crispin Cowan

Mark Mikolaiczik

Billy Brackenridge

Oded Ye Shekel

Embodiments for providing differentiated authentication for accessing groups of compartmentalized computing resources, and accessing each compartmentalized computing resources, as displayed on a desktop environment of an operating system. In one embodiment, a method includes organizing one or more computing resources accessible in a desktop environment into a group. The one or more computing resources include a data content, an application, a network portal, and a device. The method also includes providing an authentication policy for actions that can be performed on each computing resource. The authentication policy is configured to associate an authentication input to each action for a particular computing resource. The method further includes receiving an authentication input when the user intends one of the actions on the particular computing resource. The method additionally includes allowing the user to perform the intended action on the particular computing resource when the received authentication input enables the intended action.

Differentiated authentication for compartmentalized computing resources

One aspect relates to a process and associated device for managing digital ID lifecycles for application programs, and abstracting application programs for multiple types of credentials through a common Digital Identity Management System (DIMS) and Application Programming Interface (API) layer.

Digital identity management

For a particular request to access a resource, both a user associated with the request and a service through which the request is made are identified. Whether requested access to a resource is permitted is determined based on a user associated with the requested access and a service through which the access is requested. This determination can be made based on an access control entry of an access control list corresponding to the resource, the access control entry identifying access to the resource that is permitted to the user when accessing the resource through the service.

Access control based on user and service

Computer-executable instructions that are directed to the performance of consequential actions and automatically elevate to execute at a higher privilege level to do so can perform such consequential actions only after user notification. Doing so can enable monitoring processes to avoid presenting duplicative user notification upon detection of such auto-elevation. In addition, prior to presenting user notification, input from the execution environment can be ignored and access to DLLs for performing consequential actions can be avoided. A static analyzer can identify non-conforming computer-executable instructions. A wrapper can be utilized to provide compliance by otherwise unknown or non-conforming computer-executable instructions.

Unobtrusive assurance of authentic user intent

Embodiments for providing differentiated access based on authentication input attributes are disclosed. In accordance with one embodiment, a method includes receiving an authentication input at an authentication authority using an authentication protocol. The authentication input being associated with a client. The method also includes providing one or more representations for the authentication input, wherein each of the representations represents an attribute of the authentication input.

Selective authorization based on authentication input attributes

A system for verifying intent in a card not present transaction is provided. The system includes a late binding token that is distributable to consumers without necessarily being bound to an account. The system also includes a client software that locates a token server configured to facilitate managing and communicating with the late binding token. The system also includes a protocol concerning how to build a verifiably secure structured proposal that carries an offer to the consumer through the client software.

Late binding tokens

Software error feedback information, typically that associated with authorization failures due to operating system resource access checks, is automatically communicated to a software vendor with actions needed to prevent the software application error from occurring on the client computer. If possible, information associated with the software error is communicated to the client computer in order to mitigate the error by modifying how the client computer's operating system interacts with the software application so that the error may be avoided and user interaction minimized. Modifications may include automatically redirecting a resource request associated with the authorization failure in a manner such that authorization will be granted by the operating system and prevent the authorization failure due to the access check.

System and methods for processing software authorization and error feedback

Systems and methods are described that control attempts made by an application to access data. In one embodiment, the application is associated with a security token that includes an application ID. In operation, the system receives a request, initiated by the application, for access to the data. The system is configured to evaluate the request for access based in part on comparison of the security token and a listing of approved application IDs associated with the data.

Controlling execution of computer applications

Controlling computer applications' access to data

A method is disclosed for a device to interdependently validate a digital content package having a piece of digital content in an encrypted form, and a corresponding digital license for rendering the digital content. A first key is derived from a source available to the device, and a first digital signature is obtained from the digital content package. The first key is applied to the first digital signature to validate the first digital signature and the digital content package. A second key is derived based on the first digital signature, and a second digital signature is obtained from the license. The second key is applied to the second digital signature to validate the second digital signature and the license.

Method for interdependently validating a digital content package and a corresponding digital license

An operating system for a computing device has a first session for a user that includes a first base process that has a first privileges token attached thereto. The first privileges token includes substantially a full set of privileges of the user on the operating system. The operating system also has a second session for the user that includes a second base process that has a second privileges token attached thereto. The second privileges token is derived from the first privileges token and includes only a minimum set of privileges of the user on the operating system. Thus, the second, limited token does not have all privileges associated with the first, full token but instead has a limited set of privileges and not extra privileges that could be employed to take actions that would be harmful, deceptive, or malicious.

Providing user on computer operating system with full privileges token and limited privileges token

One aspect relates to a process and associated device that provides a private key of an asymmetric key pair in a key device. A symmetric master key is derived from the private key of the asymmetric key pair. The symmetric master key is stored in a computer memory location. The symmetric master key is used to encrypt or decrypt a file encryption key. The file encryption key can encrypt or decrypt files. In another aspect, the user can still access the files even if a user deactivates the key device by encrypting or decrypting the file encryption key directly from the symmetric master key.

Deriving a symmetric key from an asymmetric key for file encryption or decryption

Growing community of inventors

Sammamish, WA, United States of America

Thomas C Jones