Microsoft Technology Licensing, LLC

Vijay Gajjala

Giovanni Moises Della-Libera

Krishnamurthy Ganesan

Jeffrey Richard McKune

Tomasz Janczuk

Clifford Paul Strom

Philip J Lafornara

Charlie David Chase, Jr

Kenneth D Ray

Darko Kirovski

Arun K Nanda

Benjamin Livshits

Colin Harrison Brace

Elliot Lee Waingold

Gennady Medvinsky

Stuart L S Kwan

John Robert Lambert

Vijayavani Nori

Vaithialingam Balayoghan

Rashmi Raj

Derek T Del Conte

Christopher G Kaler

Erik B Christensen

Kenneth David Wolf

Kim Cameron

Stephen James Millet

David Wortendyke

James Ernest Johnson

Tirunelveli R Vishwanath

Lance Olson

Richard Douglas Hill

Hervey O Wilson

Umesh Madan

Stefan R Batres

Michael James Coulson

Stefan Harrington Pharies

John David Doty

Craig Andrew Critchley

Jesper B Lind

Michael Marucheck

Stephane Plante

Uday Sooryakant Hegde

Krishnan Srinivasan

Geary L Eppley

Matthew Thomas Tavis

David Edwin Levin

Stephen T Swartz

Michael Steven Vernal

Gershom L Payzer

Shy Cohen

Richard Dievendorff

Max A Feingold

Natasha Harish Jethanandani

Douglas M Purdy

David Owen Driver

Saurab Nog

Siddhartha Puri

Aaron Stern

Jesus Ruiz-Scougall

Timothy Arthur Gill

Anastasios Kasiolas

Douglas A Walter

Kapil Gupta

Stephan Zachwieja

Vipul A Modi

Ryan Thomas Sturgell

Pierre N Martin

Evgeny Osovetsky

Mohammad Makarechian

Sowmyanarayanan K Srinivasan

Alexander Martin DeJarnatt

Jonathan T Wheeler

Scott Christopher Seely

Mauro Ottaviani

Michael Thomas Dice

Craig Alan Gick

Chaitanya Dutt Upadhyay

James T Jacoby

Yaniv Pessach

Erin Honeycutt

Ajay S Kang

Eugene Shvets

Alfred M Lee, Iv

Yasser Shohoud

Mohamed-Hany Essam Ramadan

Mehmet Erkilic

Caleb S Atwood

Manuel C Ovena

Richard K Costleigh

Luke Jared Lenhart

Vaithialingam B Balayogan

Serge Sverdlov

Anand Rjagopalan

Craig A Gick

Examples of the disclosure remotely activate a secure device for application development. A request is received at a device entitlement component for a developer kit from a secure device in a user mode via a network. A determination is made as to whether the secure device is in at least one allowed development group. In response to determining that the secure device is in the at least one allowed development group, a certificate is generated defining a permissions level associated with the developer identifier for the secure device. The certificate is transmitted to the secure device, including a key that interacts with a security processor of the secure device to convert hardware capabilities of the secure device to provide a developer mode at the secure device.

Remote hardware device conversion

Embodiments are disclosed for managing and providing access to a collection of digital resources. One embodiment provides a method comprising receiving a request to access a resource for a principal and determining one or more principal groups to which the principal belongs. The method further comprises obtaining resource set membership information indicating a resource set to which the resource belongs, and obtaining resource set access policy information for the resource set to which the resource belongs. The method yet further comprises determining whether the principal is allowed to access the resource based on the principal group membership information and the resource set access policy information, and, if the principal is allowed to access the resource, then permitting access to the resource by the principal.

Discretionary policy management in cloud-based environment

Various embodiments are disclosed that relate to the automated identification of one or more computer program functions for potentially placing on a remote computing device in a split-computational computing environment. For example, one disclosed embodiment provides, on a computing device, a method of determining a factorable portion of code to locate remotely from other portions of the code of a program to hinder unauthorized use and/or distribution of the program. The method includes, on a computing device, receiving an input of a representation of the code of the program, performing analysis on the representation of the code, the analysis comprising one or more of static analysis and dynamic analysis, and based upon the analysis of the code, outputting a list of one or more functions determined from the analysis to be candidates for locating remotely.

Identifying factorable code

A signature system with a mechanism to identify element(s) of a signed document includes a sender having a signature module with a digest generator. The digest generator generates digests for identifying selected elements of the document. The resulting 'identifying' digests are then used in generating a signature in which the sender signs the digests rather than the original elements. The receiver can then process the signature and use these digests to distinguish between elements, as needed.

Digests to identify elements in a signature process

Embodiments are disclosed that relate to hindering unauthorized use or distribution of a middleware program contained within an application. One example embodiment provides a method for hindering unauthorized use or distribution of a middleware program contained within an application. The method comprises acquiring factored middleware code, the factored middleware code having a missing function residing on a remote computing device, and building an application around the factored middleware code such that the application is configured to call to the remote computing device for execution of the missing function during use. The application may be configured to send a call to the remote computing device for execution of the missing function during use.

Factoring middleware for anti-piracy

A system and method for provisioning digital identity representations ('DIRs') uses various techniques and structures to ease administration, increase accuracy, and decrease inconsistencies of a digital-identity provisioning system. Various methods are provided for creating new DIRs, requesting DIRs, notifying principals of available DIRs, and approving issuance of new DIRs.

Provisioning of digital identity representations

A system and method for provisioning digital identity representations ('DIRs') uses various techniques and structures to ease administration, increase accuracy, and decrease inconsistencies of a digital-identity provisioning system. A system is provided using a common identity data store for both DIR issuance and identity token issuance, decreasing synchronization issues. Various methods are provided for creating new DIRs, notifying principals of available DIRs, and approving issuance of new DIRs.

A retailer facilitates issuance of a digital license from a licensor to a customer for a corresponding piece of digital content. The retailer receives payment for the license from the customer, where the payment is to be shared with the licensor in a pre-determined manner. The retailer also receives customer-based information from the customer. The retailer then composes an actual license request including the obtained customer-based information, and including retailer-based information identifying the retailer to the licensor and acknowledging to the licensor that the retailer owes a portion of the received payment to the licensor. Thereafter, the retailer forwards the actual license request to the licensor. The licensor notes based on the retailer-based information in the actual license request that the retailer identified thereby owes the licensor at least a portion of the forwarded payment. If an individual sends a license request directly to the licensor and thus fails to forward payment for the license to a retailer, the actual license request as composed by the individual fails to include the retailer-based information. Accordingly, the licensor refuses to issue a license as requested based on the lack of retailer-based information.

Retail transactions involving digital content in a digital rights management (DRM) system

A security system with a mechanism to identify types of information that need to be secured and another mechanism to specify how the types are to be secured. The system includes a sender having an application and a receiver having a security module and one or more datastores to store information related to types of information that need to be secured (e.g. 'scopes'), how information is to be secured (e.g., 'profiles'), and a mapping (e.g., &#x201c;bindings&#x201d;) between the scopes and profiles. Scopes can be implemented by application developers. Profiles can be implemented by application deployers and/or administrators. The security module determines which scope is appropriate for the message, and then determines the profile that is mapped to the scope. The security module can then make an access control decision using the profile.

Security scopes and profiles

A system for processing multiple types of security schemes includes a server having a claims engine that extracts claim(s) from security token(s) and maps extracted claims to other claims. The term claim as used in this context is a statement about a token's subject. The claims engine can extract claim(s) from one or more different types of security tokens corresponding to the multiple security schemes. These extracted claim(s) can then be selectively mapped to other claims using mapping information that is accessible to the server. The security decision can then be based on the extracted and/or derived claim(s) rather than tokens. This system can thereby support multiple security schemes and simplify the security process for the user.

Generic security claim processing model

A web services namespace pertains to an infrastructure for enabling creation of a wide variety of applications. The infrastructure provides a foundation for building message-based applications of various scale and complexity. The infrastructure or framework provides APIs for basic messaging, secure messaging, reliable messaging and transacted messaging. In some embodiments, the associated APIs are factored into a hierarchy of namespaces in a manner that balances utility, usability, extensibility and versionability.

Interface infrastructure for creating and interacting with web services

Content revocation is achieved by disabling licenses issued to a computing device for the content. A content revocation is delivered within a license to the computing device. Upon license storage the content revocation is recognized, validated, and stored in a secure state store under the public key of the content server (PU-CS) that issued the content. Each license has a (PU-CS) therein, and each license evaluation considers each content revocation stored in the state store and having the same (PU-CS). The license is disabled or otherwise affected based on the considered content revocation. A content revocation is one form of a license modification that may be delivered within a license.

Content revocation and license modification in a digital rights management (DRM) system on a computing device

Growing community of inventors

Sammamish, WA, United States of America

Vijay Gajjala