Microsoft Technology Licensing, LLC

Xiaohong Su

Victor W Heller

Rudolph Balaz

Keith R Vogel

Philip Joseph Hallin

Haitao Li

Nelly L Porter

Anthony Paul Penta

Kelvin Sjek Yiu

Muhammad Umar Janjua

Anooshiravan Saboori

Stefan Thom

Yordan Ivanov Rouskov

David Benson Cross

Vijay G Bharadwaj

Bryston Mitsuo Nitta

Kinshuman Kinshumann

Pieter Kasselman

Hao Zhuang

Adrian Frei

Tarek B Kamel

Dayi Zhou

Anoosh Saboori

Eirik Herskedal

Vassil Dimitrov Bakalov

Guruprasad B Aphale

Sankara Narayanan Venkataraman

Anooshiravan Saboor

James Hugh Morgan

Salvatore Francomacaro

Binding a security token to a client token binder, such as a trusted platform module, is provided. A bound security token can only be used on the client on which it was obtained. A secret binding key (k) is established between the client and an STS. The client derives a key (k) from k, signs a security token request with k, and instructs the STS to bind the requested security token to k. The STS validates the request by deriving kusing a client-provided nonce and kto MAC the message and compare the MAC values. If the request is validated, the STS generates a response comprising the requested security token, derives two keys from k: one to sign the response and one to encrypt the response, and sends the response to the client. Only a device comprising kis enabled to use the bound security token, providing increased security.

Token binding using trust module protected keys

A computing device, or a security component of a computing device, implements delayed attestation by initially providing first credentials to a remote access device to establish a first level of trust. The first credentials may be provided before or while the computing device or the security component is obtaining security information from a remote security device. The security information is used to generate second credentials that are subsequently provided to the remote access device to establish a second level of trust. The first credentials may comprise an encryption key that can be generated by the security component without having to retrieve information via a network, and the second credentials may comprise an attestation statement that is more trustworthy than the encryption key and that is generated based on a certificate retrieved from a remote security device (e.g., a certificate authority server).

Efficient and reliable attestation

In many information security scenarios, a certificate issued by a certificate authority may be presented to a client in order to assert a trust level of a certificated item, such as a message or a web page. However, due to a decentralized structure and incomplete coordination among certificate authorities, the presence and exploitation of security vulnerabilities to issue untrustworthy certificates may be difficult to determine, particularly for an individual client. Presented herein are techniques for advising clients of the reputations of respective certificate authorities by evaluating the certificates issued by such certificate authorities, such as the number and types of domains certified by the certificate; the number and pattern of certificates issued for the domain; and the certification techniques used to issue the certificates. Such evaluation enables a determination of a certificate authority trust level that may be distributed to the clients in a certificate authority trust set.

Advising clients about certificate authority trust

In many information security scenarios, a certificate issued by a certificate authority on behalf of a domain is presented to a client in order to verify the identity of the domain. However, due to a decentralized structure and incomplete coordination among certificate authorities, the presence and exploitation of security vulnerabilities to issue untrustworthy certificates may be difficult for an individual client to determine. Presented herein are techniques for advising clients of the trustworthiness of respective certificate authorities by evaluating the certificates issued by such certificate authorities for suspicious indicators, such as hashcode collisions with other certificates and public key re-use. A trust level may be identified of respective certificate authorities according to the presence or absence of suspicious indicators in the certificates issued by the certificate authority, and a certificate authority trust set may be distributed to advise clients of the trustworthiness of certificates issued by the respective certificate authorities.

Certificate evaluation for certificate authority reputation advising

In many information security scenarios, a certificate issued by a certificating authority may be presented to a client in order to assert a trust level of a certificated item, such as a message or a web page. However, due to a decentralized structure and incomplete coordination among certificating authorities, the presence and exploitation of security vulnerabilities to issue untrustworthy certificates may be difficult to determine, particularly for an individual client. Presented herein are techniques for providing a certificating authority trust service that collects and evaluates certificates submitted to clients by certificating authorities, and advises the clients of a certificating authority trust level for respective certificating authorities (e.g., determined as a consensus of the evaluated certificates issued by the certificating authority). The clients may use a certificating authority trust set distributed by the certificating authority trust service to determine whether to trust a certificate issued from a particular certificating authority.

Certificating authority trust evaluation

Techniques for identifying a smart card in a plug and play system. The technique requires identifying a unique code identifier and loading a smart card minidriver according to the unique code identifier.

Identification of a smart card on a plug and play system

An exemplary system enabling credential roaming among a plurality of different computing devices may include an event handler to receive event notifications such as, e.g., a client logon. The event handler may invoke a management service in response to receiving an event notification. The management service may include a synchronizing module to synchronize a user's credentials with a remote directory service, such as, e.g., Active Directory, so that the user's credentials are available from any of a number of different computing devices.

Credential roaming in electronic computing systems

A virtual private network (VPN) enrollment protocol gateway is described herein. The protocol gateway is implemented as a registration authority that operates as an intermediary between routers and a certificate authority, allowing routers operating in accordance with one protocol to obtain and maintain certificates for a VPN from a certificate authority operating in accordance with another protocol. In accordance with one aspect, the gateway protocol supports various requests from the router, including router enrollment requests, get certificate revocation list request, get certificate requests, get certificate authority certificate requests, and password requests.

VPN enrollment protocol gateway

Growing community of inventors

Issaquah, WA, United States of America

Xiaohong Su