Microsoft Technology Licensing, LLC

Tecumseh Products Company

Todd L Carpenter

David Abzarian

William Jefferson Westerinen

David Steeves

Harish Kulkarni

David Jay Foster

Kim Cameron

Quentin S Miller

Shon Schmidt

Andras Tantos

Mark Myers

David Jaroslav Sebesta

Alexander Frank

Gregory D Hartrell

Stephen Richard Drake

Hanumant Kumar Yadav

Zhangwei Xu

Andrew J Ritz

Curt Andrew Steeb

John Herbert Chiloyan

Allen Marshall

James Duffus

Salahuddin Khan

Ronald J Donahue

J David Kirk

Vladimir Sadovsky

Thomas G Phillips

Martin Holladay

Scot A Koehler

Lawrence Brian Ripsher

Ricardo Lopez-Barquilla

Seshagiri Panchapagesan

Tse-Ching Yu

Karl W Monis

Cinthya R Urasaki

Shaun Wiley

Severan Rault

Gregory C Hintz

Dennis P Ward

Mark St John

David J Steeves

Don Hyun

John Chiloyan

Harish S Kulkarni

A token or other storage device uses Internet identities to set file access attribute rights. Subsequently, requests to access a file can be controlled by confirming the Internet identity of the requestor by either validating the request with a known public key or retrieving the public key from an Internet identity provider. Files may be stored encrypted and may be re-encrypted with the public key associated with Internet identity making the request.

Trusted internet identity

Technology is described for enabling passive enforcement of security at computing systems. A component of a computing system can passively authenticate or authorize a user based on observations of the user's interactions with the computing system. The technology may increase or decrease an authentication or authorization level based on the observations. The level can indicate what level of access the user should be granted. When the user or a component of the computing device initiates a request, an application or service can determine whether the level is sufficient to satisfy the request. If the level is insufficient, the application or service can prompt the user for credentials so that the user is actively authenticated. The technology may enable computing systems to 'trust' authentication so that two proximate devices can share authentication levels.

Passive security enforcement

Technology is described for protecting transactions. The technology may include a switching component that a user can employ to switch an associated mobile device into a secure mode so that a user can confirm the transaction. After initiating a transaction request, the user can confirm the transaction request by activating the switching component, which can cause the mobile device to switch into a secure mode. In the secure mode, the mobile device may prevent the mobile device from conducting various normal activities, such as executing applications, receiving input, providing output, and so forth. The switching component may disable other processing temporarily. Upon receiving the confirmation from the user, the switching component may send a confirmation communication to complete the transaction.

Protecting transactions

Described is a technology by which a transient storage device or secure execution environment-based (e.g., including an embedded processor) device validates a host computer system. The device compares hashes of host system data against valid hashes maintained in protected storage of the device. The host data may be a file, data block, and/or memory contents. The device takes action when the host system data does not match the information in protected storage, such as to log information about the mismatch and/or provide an indication of validation failure, e.g., via an LED and/or display screen output. Further, the comparison may be part of a boot process validation, and the action may prevent the boot process from continuing, or replace an invalid file. Alternatively, the validation may take place at anytime.

Device side host integrity validation

A device configuration silo is arranged to be accessed as an IEEE 1667-compatible silo which exposes interfaces to a host application to make changes to the presence of one or more other silos, as well as make changes to silo configurations on a per-silo basis for data and method sharing among silos across the ACTs on a storage device such as a transient storage device. The interfaces exposed by the device configuration silo are arranged to enable an authenticated provisioner, like administrator in a corporate network environment, to perform configuration changes to silos after the storage device is released into the field through a secure provisioning mechanism. In addition, users may make configuration changes to silos at runtime in some usage scenarios, for example to enable discrete portions of functionality on a storage device, by using a secure secondary authentication mechanism that is exposed by the device configuration silo.

Transient storage device configuration silo

An electronic device can be locked and secured by activating a hardware locking mechanism on the device. The locking mechanism is controlled by a locking policy that is defined and implemented from the client side. If the locking mechanism is activated, then the device operates in a limited mode of operation instead of in a normal mode of operation. The locking mechanism can be deactivated, placing the device into the normal mode of operation, when a specified condition is satisfied.

Client controlled lock for electronic devices

The described implementations relate to capturing a computing experience. In one case, a user session capture tool can launch a remote user session where a user-interface and user inputs are gathered from a single computing device. Remote user session data produced by the remote user session can be analyzed to determine user activity.

Capturing a computing experience

A storage token has a display and a keyboard, or other input device, that allows a user to view a request to access a memory location and enter a response to the request. The display allows presentation of details of the request, such as a pathname to a requested memory location, metadata describing a cryptographic key for use in a transaction confirmation, and/or transaction details which are awaiting verification by a credential stored on the token. The storage token may also include a cryptographic engine and a secure memory allowing signing data returned in response to the request.

Trusted storage and display

Described is a technology by which files that are hardware protected on a storage device, such as a USB flash drive, are managed on a host, including by integration with an existing file system. Each file maintained on a storage device is associated with a protection attribute that corresponds to that file's device hardware protection level. Requests directed towards accessing metadata or actual file data are processed based upon the protection attribute and a state of authentication, e.g., to allow or deny access, show file icons along with their level of protection, change levels, and so forth. Also described is splitting a file system file table into multiple file tables, one file table for each level of protection. Entries in the split file tables are maintained based on each file's current level; space allocation tracking entries are also maintained to track the space used by other split tables.

Device enforced file level protection

Growing community of inventors

Monroe, WA, United States of America

Todd L Carpenter