Microsoft Technology Licensing, LLC

Trevor William Freeman

Jeffrey B Kay

Scott Manchester

Benjamin E Nick

Dalen Matthew Abraham

Eric Dean Tribble

Malcolm Erik Pearson

Mayank Mehta

Bernard D Aboba

Hao Zhang

Jeremy De Souza

Timothy Mark Moore

Daniel Ron Simon

Josh D Benaloh

Anton W Krantz

Matthias Adam Leibmann

Mohammad Shabbir Alam

Frank Byrum

Roy Williams

Jean-Pierre Duplessis

Tim M Moore

John J Lambert

Ladislau Conceicao

Samuel Neely

Steven Hubbell

Atul Kumar Shah

Bill Hanlon

K John Biccum

Bernard D Adoba

A method for confidential electronic communication between a sender workstation and a receiver workstation is provided, whereby privacy is guaranteed for the electronic communications transmitted over the public Internet. The method of confidential communication is equipped with message tracking and message receipt verification. The system for implementing the method includes a sender server that creates a session content encryption key along with a message envelope that includes a content encryption key encrypted message and a confidential mail token. The content encryption key is stored securely inside the sender organization's system which transmits the message envelope to an intended recipient. The intended recipient processes the message envelope in order to generate a message receipt verification, which is transmitted to the sender. The message receipt verification is processed by the sender server to verify that the message envelope reached the intended recipient. The message receipt verification, which is comprised of the confidential mail token and unique verification data generated by the intended recipient allows the sender server to verify that the message envelope reached the intended receiver and that the message envelope identified as received is authentic. Following verification that the message transmitted by the sender reached the intended receiver and is authorized, the sender transmits the content encryption key to the intended receiver.

Confidential mail with tracking and authentication

In a distributed electronic messaging system authorized information comprising metadata concerning a message is passed along from one mail server to another mail server. A receiving computer determines if the sending computer has the necessary authorizations to pass along the metadata. If so, the authorized information is passed along with the message body, enabling repetitious actions to be eliminated. If the sending computer is not authorized to pass along the metadata, the metadata is stripped off the message, changed or annotated.

Mail server coordination activities using message metadata

Certificate remoting and recovery may be provided. A computer may identify required security certificates and determine whether at least one required security certificate is not available. If the certificate is not available, the computer may identify a peer server and request the missing certificate from the peer server. The computer may also be operative to receive certificate management instructions from other computers.

Certificate remoting and recovery

A protocol for total email and collaborative software (e.g., Exchange-brand server) session security. By way of example, securing the traffic between two servers within the same organization or cross organizations is critical to maintaining privacy of electronic data and communications. For example, securing communications between two Exchange-brand servers is particularly useful for individuals and organizations that routinely send and receive confidential information via electronic mail. It is important for the receiving side (server) to authorize the sending side (client) to send the information; the sending side should authorize the receiving side to receive information to prevent unauthorized information disclosure. The novel system and/or protocol disclosed herein can provide a mutually authenticated, authorized, and encrypted channel between two servers both within the same organization and across disparate organizations.

Total exchange session security

Single-use character combinations are a secure mechanism for user authentication. Such 'one-time passwords' (OTPs) can be generated by a mobile device to which the user otherwise maintains easy access. A key exchange, such as in accordance with the Diffie-Hellman algorithm, can provide both the mobile device and a server with a shared secret from which the OTPs can be generated. The shared secret can be derived from parameters posted on the server and updated periodically, and the mobile device can obtain such parameters from the server before generating an OTP. Such parameters can also specify the type of OTP mechanism to be utilized. A second site can, independently, establish an OTP mechanism with the mobile device. For efficiency, the first server can provide an identity token which provides the mobile device's public key in a trusted manner, enabling more efficient generation of the shared secret with the second server.

One time password key ring for mobile computing device

A portable computer-readable media device and method of use enable automatic configuration of a computing device, such as a conventional network device or a thin client device, for operation in a network. Configuration information, including network settings and security information, is incorporated in an XML file written to the portable media device while it is installed in a first device. This configuration is then automatically transferred to a second device by installing the portable media device in the second device. The second device then writes device information, incorporated in an XML file, to the portable media device, to be uploaded to the first device.

Configuring network settings using portable storage media

A transmitting gateway may utilize a retrieved domain-specific key to secure an outbound message, and a receiving gateway may utilize another retrieved domain-specific key to authenticate and validate the secured message.

Key distribution for secure messaging

Generating symmetric keys among distributed appliances, includes generating public and private values on at least one appliance, importing a public value from another appliance via an out-of-band entity, and generating a secret value as a function of the private value corresponding to the local appliance and the public value received from the other appliance.

Security associations for devices

An Extensible Mark-up Language (XML) schema is used to generate configuration settings files. A wireless configuration XML schema defines an XML file for configuring wireless network settings on a wireless device. A wide area network (WAN) configuration schema defines an XML file for configuring a WAN device. A local area network (LAN) configuration schema defines an XML file for configuring a LAN device. A broadband modem configuration schema defines an XML file for configuring a broadband modem device. A device configuration schema defines an XML file for reporting the configuration of a device.

XML schema for network device configuration

The principles of the present invention relate to systems, methods, and computer program products for more efficiently and securely authenticating computing systems. In some embodiments, a limited use credential is used to provision more permanent credentials. A client receives a limited-use (e.g., a single-use) credential and submits the limited-use credential over a secure link to a server. The server provisions an additional credential (for subsequent authentication) and sends the additional credential to the client over the secure link. In other embodiments, computing systems automatically negotiate authentication methods using an extensible protocol. A mutually deployed authentication method is selected and secure authentication is facilitated with a tunnel key that is used encrypt (and subsequently decrypt) authentication content transferred between a client and a server. The tunnel key is derived from a shared secret (e.g., a session key) and nonces.

Efficient and secure authentication of computing systems

A discovery secret is transmitted from the source domain to the correspondent domain. The discovery secret includes a data element specific to the correspondent domain and. The discovery secret includes a source domain address to which the correspondent domain is permitted send a message in order to determine that a potential correspondent has compatible secure email technology so that a link between the source domain and the correspondent domain may be established. The discovery secret is received by the correspondent domain including receiving the data element and the source domain address. An invitation is transmitted from the correspondent domain to the source domain address. The invitation includes the data element or an element corresponding to the data element. The source domain initiates a process to establish a link with the correspondent domain upon receipt by the source domain of the invitation.

System and method for establishing that a server and a correspondent have compatible secure email

Object management is facilitated by signing objects with credentials and through noting and/or using an association between the signed objects and the signing credentials. In an exemplary method implementation, actions include: signing an object with a credential to produce a signed object and noting an association between an object identifier that represents the signed object and the credential. In another exemplary method implementation, actions include: receiving a revocation request for a signed object; accessing a database at an entry for the signed object to retrieve an associated credential, the associated credential having been used to sign an object to produce the signed object; and causing the associated credential to be revoked. In an exemplary electronically-accessible media implementation, a data structure thereof includes: at least one entry that associates a credential with an object identifier, the object identifier representing a signed object that was signed by the credential.

Growing community of inventors

Sammamish, WA, United States of America

Trevor William Freeman