John M Lambert

US Patent:

7216337, May 8, 2007

Filed:

Apr 14, 2003

Appl. No.:

10/413276

Inventors:

John Robert Lambert - Bellevue WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 9/45

US Classification:

717124

Abstract:

Computerized testing of an object to identify one or more call sequences that give rise to exceptions. A set of potential operations (consisting of methods and associated parameter values) is automatically generated. A parameter generator may supply interesting parameter values that may more likely result in a thrown exception. A number of call sequences is automatically constructed using the operations in the set of operations as steps in the sequence. Each call sequence is then executed using a new instance of the object. If an exception is thrown, a report may be issued containing information helpful in evaluating whether the exception is appropriate. This information might include the exception type as well as the invalid call sequence that gave rise to the thrown exception. The invalid call sequence may also be minimized to assist the tester in evaluating the root cause and appropriateness of the exception.

US Patent:

7237231, Jun 26, 2007

Filed:

Mar 10, 2003

Appl. No.:

10/385255

Inventors:

John Robert Lambert - Bellevue WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 9/44
G06F 11/00

US Classification:

717127, 717131, 714 38

Abstract:

Computerized testing of a system to identify combinations of input values that expose failures in the system's operation. Attributes are applied to fields in a source code version of a test case template corresponding to the object. Applied attributes can indicate fields that are to be used when generating test cases for the object. The source code version of the test case template is subsequently compiled or interpreted into a binary test case template. Metadata in the binary test case template is inspected (e. g. , through reflection) to identify the fields, data types, and attributes that are to be used when generating test cases. Based on possible input values for the identified fields and generation rules, a plurality of test cases is generated. The generated test cases are executed to identify combinations of input values that expose failures in the system's operation.

US Patent:

7240194, Jul 3, 2007

Filed:

Mar 22, 2002

Appl. No.:

10/104978

Inventors:

Philip J. Hallin - Redmond WA, US
John J. Lambert - Seattle WA, US
Klaus U. Schutz - Kirkland WA, US
Sunil Pai - Bellevue WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

H04L 9/00

US Classification:

713156, 726 2

Abstract:

Systems and methods are described for distributing and updating trusted certification authorities to computer systems and users. When a digital certificate is encountered during a secured electronic transaction, the root authority of the certificate is determined. It is then determined whether the root authority is a trusted authority by attempting to locate the root authority in a trusted root list. If the root authority is not included in the trusted root list, a remote site is accessed and an updated version of the trusted root list is downloaded. The new trusted root list is checked for the presence of the encountered certificate and, if found, the transaction is allowed to proceed. In one implementation, the entire trusted root list is not downloaded. Instead, if an appropriate digital certificate is located, then the certificate is downloaded and added to the trusted root list of the computer system. The transaction may then proceed.

US Patent:

7290138, Oct 30, 2007

Filed:

Feb 19, 2003

Appl. No.:

10/368972

Inventors:

Trevor W. Freeman - Sammamish WA, US
John J. Lambert - Seattle WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

H04L 29/00

US Classification:

713167

Abstract:

Object management is facilitated by signing objects with credentials and through noting and/or using an association between the signed objects and the signing credentials. In an exemplary method implementation, actions include: signing an object with a credential to produce a signed object and noting an association between an object identifier that represents the signed object and the credential. In another exemplary method implementation, actions include: receiving a revocation request for a signed object; accessing a database at an entry for the signed object to retrieve an associated credential, the associated credential having been used to sign an object to produce the signed object; and causing the associated credential to be revoked. In an exemplary electronically-accessible media implementation, a data structure thereof includes: at least one entry that associates a credential with an object identifier, the object identifier representing a signed object that was signed by the credential.

US Patent:

7350204, Mar 25, 2008

Filed:

Jun 8, 2001

Appl. No.:

09/877710

Inventors:

John J. Lambert - Kirkland WA, US
Praerit Garg - Kirkland WA, US
Jeffrey A. Lawson - Austin TX, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 9/45

US Classification:

717172, 726 21

Abstract:

A system and method that automatically, transparently and securely controls software execution by identifying and classifying software, and locating a rule and associated security level for executing executable software. The security level may disallow the software's execution, restrict the execution to some extent, or allow unrestricted execution. To restrict software, a restricted access token may be computed that reduces software's access to resources, and/or removes privileges, relative to a user's normal access token. The rules that control execution for a given machine or user may be maintained in a restriction policy, e. g. , locally maintained and/or in a group policy object distributable over a network. Software may be identified/classified by a hash of its content, by a digital signature, by its file system or network path, and/or by its URL zone. For software having multiple classifications, a precedence mechanism is provided to establish the applicable rule/security level.

US Patent:

7464270, Dec 9, 2008

Filed:

Jul 23, 2003

Appl. No.:

10/625312

Inventors:

Vishnu A. Patankar - Kirkland WA, US
Robert Reichel - Sammamish WA, US
John J. Lambert - Seattle WA, US
Kedarnath A. Dubhashi - Redmond WA, US
Jim E. Thatcher - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 11/30
G06F 12/14
H04L 9/32

US Classification:

713176, 713187, 709220, 709226

Abstract:

The restriction of particular resources includes providing a digital signature for unauthorized resources based on a structure-related parameter of the resource. Thus, attempts at circumventing recognition of such resource will likely result in altering the overall functionality of the resource. Further, such digital signatures are encoded in a critical file required for loading of a resource, thus ensuring that the identity of the resource is considered before execution thereof. Enforcement of the resource restriction includes generating a verification signature for a resource that requests loading. The verification signature is compared to the signature coded into the critical file, and a positive match results in the resource being blocked from loading.

US Patent:

7640573, Dec 29, 2009

Filed:

Feb 16, 2004

Appl. No.:

10/780274

Inventors:

Giovanni M. Della-Libera - Seattle WA, US
Vijay K. Gajjala - Sammamish WA, US
Tomasz Janczuk - Sammamish WA, US
John R. Lambert - Bellevue WA, US
Elliot Waingold - Seattle WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 17/00
G06F 17/30
G06F 7/04
G06F 21/00
H04L 29/06
H04L 9/32
H04N 7/16

US Classification:

726 1, 726 2, 726 26, 713182

Abstract:

A system for processing multiple types of security schemes includes a server having a claims engine that extracts claim(s) from security token(s) and maps extracted claims to other claims. The term claim as used in this context is a statement about a token's subject. The claims engine can extract claim(s) from one or more different types of security tokens corresponding to the multiple security schemes. These extracted claim(s) can then be selectively mapped to other claims using mapping information that is accessible to the server. The security decision can then be based on the extracted and/or derived claim(s) rather than tokens. This system can thereby support multiple security schemes and simplify the security process for the user.

US Patent:

7716728, May 11, 2010

Filed:

Feb 16, 2004

Appl. No.:

10/779922

Inventors:

Giovanni M. Della-Libera - Seattle WA, US
Vijay K. Gajjala - Sammamish WA, US
Tomasz Janczuk - Sammamish WA, US
John R. Lambert - Bellevue WA, US

Assignee:

Microsoft Corproation - Redmond WA

International Classification:

G06F 12/14
G06F 15/16
H04L 29/06

US Classification:

726 13, 726 1, 726 21, 713154, 713167, 707 9

Abstract:

A security system with a mechanism to identify types of information that need to be secured and another mechanism to specify how the types are to be secured. The system includes a sender having an application and a receiver having a security module and one or more datastores to store information related to types of information that need to be secured (e. g. “scopes”), how information is to be secured (e. g. , “profiles”), and a mapping (e. g. , “bindings”) between the scopes and profiles. Scopes can be implemented by application developers. Profiles can be implemented by application deployers and/or administrators. The security module determines which scope is appropriate for the message, and then determines the profile that is mapped to the scope. The security module can then make an access control decision using the profile.