Microsoft Technology Licensing, LLC

Google Inc.

Tony Ureche

Nathan Jeffrey Ide

Saurav Sinha

Michael David Marr

Stefan Thom

David Rudolph Wooten

Jonathan D Schwartz

Gopinathan Kannan

Dan Sledz

Yashar Bahman

Pranav Kukreja

Ibrahim Mohammad Ismail

Michael Darweesh

Aya Mahmoud Ebrahim Elsayed

Nikita Podguzov

Alex Huie

Sergey Poromov

Stefan Kölbl

Roy D'Souza

Douglas M Maclver

Eric Holt

Shawn Corey

According to an aspect, a method includes receiving data loss prevention (DLP) restriction data, where the DLP restriction data defines a first DLP control. The first DLP control identifies at least one content attribute of restricted content. The first DLP control identifies a restriction to a computer function when the restricted content is rendered on a display of a computing device. The method includes storing the DLP restriction data in a memory device associated with an operating system of the computing device, detecting, by the operating system, that content rendered on the display of the computing device includes at least a portion of the restricted content as identified by the at least one content attribute, and restricting the computer function during a period of time in which the portion of the restricted content is rendered on the display.

Data protection for computing device

According to an aspect, a method for accessing a computing device includes receiving, by the computing device, an authentication credential for recovery access to the computing device, the authentication credential being different from an authentication credential used to access encrypted data on the computing device, obtaining, in response to receipt of the authentication credential for recovery access, a first key portion stored on the computing device, transmitting, over a network, a request to receive a second key portion, receiving, over the network, a response that includes the second key portion, recovering a decryption key using the first key portion and the second key portion, and decrypting the encrypted data on the computing device using the decryption key.

Data recovery for a computing device

In one embodiment, a user device may reestablish access to a user resource while forgoing use of a user credential during a system reboot. The user device may receive the user credential from a user during an initial login to access the user resource. The user device may create an ephemeral entropy to access the user resource. The user device may access the user resource using the ephemeral entropy.

Resumption of logon across reboots

In one embodiment, a client devicemay use an attestation serviceto verify a secure serverThe secure servermay receive a signed trusted credentialfrom an attestation servicevalidating the secure serveras trustworthy to a client deviceseeking access. The secure servermay protect the signed trusted credentialin a server secure module

Verifying the security of a remote server

Firmware of a system is configured to allow secondary devices, such as a smart card, to be used for authentication. In an example embodiment, the secondary device is a CCID smart card in compliance with the ISO 7816 specification. The smart card is inserted into a card reader coupled to the system prior to booting the system. The firmware comprises an emulator and driver configured to allow authentication information from the smart card to be utilized to allow execution of the boot process. In an example embodiment, the smart card comprises external keys for use with BITLOCKER&#x2122;. The secondary device is compatible with systems implementing a BIOS and with systems implementing EFI. Authentication also can be accomplished via devices that do not provide data storage, such as a biometric device or the like.

Platform authentication via a transparent second factor

The execution of software may be controlled by a security policy expressed in a manifest. The software vendor or distributor specifies requirements for the use of software (e.g., which modules may be loaded into the software's address space, which module-signing keys are trustworthy, etc.), using a manifest specification language. A generation tool reads the specification and creates a manifest based on the specification. The tool may handle such details as retrieving keys from key files, computing software hashes, and the like. The manifest is distributed with the software and used by the environment in which the software executes to enforce the security policy.

System and method for manifest generation

Growing community of inventors

Bellevue, WA, United States of America

Tony Ureche