Microsoft Technology Licensing, LLC

Vijay G Bharadwaj

Octavian Tony Ureche

Nelly L Porter

Gopinathan Kannan

Carl Melvin Ellison

Eric Fleischman

Niels Thomas Ferguson

Alexander Thomas Weinert

Kun Liu

Benjamin Richard Vincent

Nathan Jeffrey Ide

Saurav Sinha

Charles Glenn Jeffries

Anooshiravan Saboori

Ruslan Pavlovich Ovechkin

Christopher R Macaulay

Gaurav Sinha

Matthew Z Tamayo-Rios

Tarek Bahaa El-Din Mahmoud Kamel

Cristian Marius Ilac

Himanshu Soni

Michael J Grass

Arthur Baker

Matthew Charles Setzer

Dayi Zhou

Nils Dussart

Stefan Thom

Yordan Ivanov Rouskov

Innokentiy Basmov

Ravindra Pandya

Magnus Bo Gustaf Nyström

Yi Liu

Peter Novotney

Xiaohong Su

Violet Anna Barhudarian

Adrian Frei

Tarek B Kamel

Duncan G Bryce

Son VoBa

Karanbir Singh

Jeremy Dominic Viegas

Jeffrey Edwin Shipman

Ryan Segeberg

Guruprasad B Aphale

Sankara Narayanan Venkataraman

John D T Wood

Mike Hamburg

Denis Issoupov

Arthur H Baker

Son Voba

Charles G Jeffries

Jeremy D Viegas

Techniques for secure data synchronization are described. In one or more implementations, a determination is made as to whether enterprise data is stored locally on a first device corresponding to an enterprise device. Based on a determination that the second device is a non-enterprise device, a determination is made as to whether a permission associated with the first device indicates that the first device is permitted to propagate the enterprise data to non-enterprise devices. If the first device lacks permission to propagate the enterprise data to non-enterprise devices, the enterprise data is prevented from being propagated to the second device.

Secure data synchronization

A multi-factor user authentication framework using asymmetric key includes a host device, a user agent, a gesture system, and an authentication system. The multiple factors include a user credential as well as a user gesture that indicates that the user is present. The user interacts with the user agent via the host device in order to obtain access to something for which user authentication is needed. The authentication system maintains the user credentials, which are provided to authenticate the user in response to the authentication system determining that the user is present (which can be determined in different manners, such as using a personal identification number (PIN), biometric information regarding the user, geographic location of the gesture system, etc.). The user agent, gesture system, and authentication system can be implemented on the same device (e.g., the host device), or alternatively implemented across one or more different devices.

Multi-factor user authentication framework using asymmetric key

Binding a security token to a client token binder, such as a trusted platform module, is provided. A bound security token can only be used on the client on which it was obtained. A secret binding key (k) is established between the client and an STS. The client derives a key (k) from k, signs a security token request with k, and instructs the STS to bind the requested security token to k. The STS validates the request by deriving kusing a client-provided nonce and kto MAC the message and compare the MAC values. If the request is validated, the STS generates a response comprising the requested security token, derives two keys from k: one to sign the response and one to encrypt the response, and sends the response to the client. Only a device comprising kis enabled to use the bound security token, providing increased security.

Token binding using trust module protected keys

In one embodiment, a user login device may create a user identifier templatefor identifying a user by implicitly capturing one or more biometric identifier readings. A user login device may capture an enrollment biometric identifier reading of a user during an operational user action. The user login device may apply the enrollment biometric identifier reading in creating a user identifier template

Informed implicit enrollment and identification

Techniques for secure data synchronization are described. In one or more implementations, techniques may be employed to conserve high cost data storage by storing larger portions of encrypted data in low cost storage, while storing relatively smaller encryption keys in higher cost storage. A device that is granted access to the encryption keys can retrieve the encrypted data from the low cost storage and use the encryption keys to decrypt the encrypted data.

The techniques and systems disclosed herein pertain to preventing unauthorized access to computing resources by unauthorized persons by deploying biometric security. To implement biometric security, the computing device, possibly by the OS, may obtain samples of one or more biometric factors unique to the owner. The computing device may construct pattern-matching templates corresponding to the biometric samples, which may be stored for later use when a protected resource is requested. Computing resources may be selected for protection by a biometric security mechanism by an authorized user or by other techniques or default settings. Before allowing certain restricted actions, the OS may request that the user provide one of the previously registered biometric samples. If the biometric sample matches the user's stored pattern-matching template, the OS may grant access to the computing resource, otherwise, the OS may deny access to the computing resource.

Resource management based on biometric data

Cryptographic key management techniques are described. In one or more implementations, an access control rule is read that includes a Boolean expression having a plurality of atoms. The cryptographic keys that corresponds each of the plurality of atoms in the access control rule are requested. One or more cryptographic operations are then performed on data using one or more of the cryptographic keys.

Cryptographic key management

Single-use authentication methods for accessing encrypted data stored on a protected volume of a computer are described, wherein access to the encrypted data involves decrypting a key protector stored on the computer that holds a volume-specific cryptographic key needed to decrypt the protected volume. Such single-use authentication methods rely on the provision of a key protector that can only be used once and/or that requires a new access credential for each use. In certain embodiments, a challenge-response process is also used as part of the authentication method to tie the issuance of a key protector and/or access credential to particular pieces of information that can uniquely identify a user.

Single-use authentication methods for accessing encrypted data

A portable secure data file includes an encrypted data portion and a metadata portion. When a request associated with a current user of a device to access a portable secure data file is received, one or more records in the metadata portion are accessed to determine whether the current user is permitted to access the file data in the encrypted data portion. If a record indicates the user is permitted to access the file data, a content encryption key in that record is used to decrypt the encrypted data portion.

Portable secure data files

In embodiments of scalable random number generation, a system includes one or more entropy pools that combine entropy data, which is derived from entropy sources based on event data. A root pseudo-random number generator (PRNG) maintains a seeded entropy state that is reseeded by the entropy pools, and a seed version identifier updates to indicate a current seed version of the root PRNG. Processor PRNGs are instantiated one each per logical processor in a kernel of the system, where each processor PRNG maintains a PRNG entropy state that is reseeded from the root PRNG, and a processor PRNG generates a random number from a respective PRNG entropy state when invoked.

Scalable random number generation

A key protector for a storage volume is created by generating an intermediate key and protecting, based at least in part on a public/private key pair, the intermediate key. A volume master key for encrypting and decrypting one or more volume encryption keys that are used to encrypt the storage volume can be encrypted in different manners, including being encrypted based at least in part on the intermediate key. A key protector for the storage volume is stored that includes both the encrypted volume master key and information indicating how to obtain the intermediate key. Subsequently, the key protector can be accessed and, based at least in part on a private key of the entity associated with the key protector, the intermediate key can be decrypted. The intermediate key can then be used to decrypt the volume master key.

Key protector for a storage volume using multiple keys

Growing community of inventors

Sammamish, WA, United States of America

Vijay G Bharadwaj