John B Mcdowell

US Patent:

8001596, Aug 16, 2011

Filed:

May 3, 2007

Appl. No.:

11/743755

Inventors:

Matthias Wollnik - Seattle WA, US
Nir Ben Zvi - Redmond WA, US
Hakki Tunc Bostanci - Redmond WA, US
John Richard McDowell - Seattle WA, US
Aaron Goldsmid - Seattle WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 11/00

US Classification:

726 22, 726 23, 726 24, 726 25, 726 26, 726 27, 726 28, 726 29, 726 30, 726 31, 726 32, 726 33, 713189, 713193

Abstract:

A method to apply a protection mechanism to a binary object includes using operating system resources to load a binary object from a storage medium along with a manifest and a digital signature. Authentication of the binary object is performed using the digital signature and the manifest is read to determine a category of protection for the binary object. The operating system selects a protection mechanism corresponding to the protection category and injects protection mechanism code, along with the binary object into a binary image on computer RAM. When the binary image is accessed, the protection mechanism executes and either allows full access and functionality to the binary object or prevents proper access and operation of the binary object. The protection mechanisms may be updated independently from the information on the storage medium.

US Patent:

8010773, Aug 30, 2011

Filed:

Jun 24, 2008

Appl. No.:

12/144699

Inventors:

Hakki Tunc Bostanci - Redmond WA, US
Nathan Jeffrey Ide - Bothell WA, US
Matthias Hermann Wollnik - Seattle WA, US
John Richard McDowell - Seattle WA, US
Karan Singh Dhillon - Renton WA, US
Aaron Payne Goldsmid - New York NY, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 7/38
G06F 9/00
G06F 9/44
G06F 15/00

US Classification:

712226, 712228

Abstract:

Restricting execution by a computing device of instructions within an application program. The application program is modified such that execution of the selected instructions is dependent upon a corresponding expected state of one or more hardware components in the computing device. In an embodiment, the application program is modified to place the hardware components in the expected states prior to execution of the corresponding selected instructions. Creating the dependency on the hardware components prevents the unintended or malicious execution of the selected instructions.

US Patent:

8225390, Jul 17, 2012

Filed:

Jun 27, 2008

Appl. No.:

12/163548

Inventors:

Kenneth D. Ray - Seattle WA, US
Pankaj M. Kamat - Kirkland WA, US
Charles W. Kaufman - Sammamish WA, US
Paul J. Leach - Seattle WA, US
William R. Tipton - Seattle WA, US
Andrew Herron - Redmond WA, US
Krassimir E. Karamfilov - Bellevue WA, US
Duncan G. Bryce - Redmond WA, US
Jonathan D. Schwartz - Kirkland WA, US
Matthew C. Setzer - Woodinville WA, US
John McDowell - Seattle WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 21/00

US Classification:

726 17, 726 27

Abstract:

The present invention extends to methods, systems, and computer program products for licensing protected content to application sets. Embodiments of the invention permit a local machine to increase its participation in authorizing access to protected content. For example, an operating system within an appropriate computing environment is permitted to determine if an application is authorized to access protected content. Thus, the application is relieved from having to store a publishing license. Further, authorization decisions are partially distributed, easing the resource burden on a protection server. Accordingly, embodiments of the invention can facilitate more robust and efficient authorization decisions when access to protected content is requested.

US Patent:

20080229115, Sep 18, 2008

Filed:

Mar 16, 2007

Appl. No.:

11/687252

Inventors:

Matthias Hermann Wollnik - Seattle WA, US
Nir Ben-Zvi - Redmond WA, US
Aaron Goldsmid - Seattle WA, US
Hakki Tunc Bostanci - Redmond WA, US
Karan Singh Dhillon - Renton WA, US
Nathan Jeffrey Ide - Bothell WA, US
John Richard McDowell - Seattle WA, US
David John Linsley - Seattle WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

H04L 9/32

US Classification:

713190

Abstract:

In an example embodiment, executable files are individually encrypted utilizing a symmetric cryptographic key. For each user to be given access to the obfuscated file, the symmetric cryptographic key is encrypted utilizing a public key of a respective public/private key pair. A different public key/private key pair is utilized for each user. Obfuscated files are formed comprising the encrypted executable files and a respective encrypted symmetric cryptographic key. The private keys of the public/private key pairs are stored on respective smart cards. The smart cards are distributed to the users. When a user wants to invoke the functionality of an obfuscated file, the user provides the private key via his/her smart card. The private key is retrieved and is utilized to decrypt the appropriate portion of the obfuscated file. The symmetric cryptographic key obtained therefrom is utilized to decrypt the encrypted executable file.

US Patent:

20090293041, Nov 26, 2009

Filed:

May 20, 2008

Appl. No.:

12/123471

Inventors:

Matthias Wollnik - Seattle WA, US
Nathan Ide - Bothell WA, US
Andrey Lelikov - Bellevue WA, US
John Richard McDowell - Seattle WA, US
Aaron Payne Goldsmid - New York NY, US
Karan Singh Dhillon - Renton WA, US

Assignee:

MICROSOFT CORPORATION - Redmond WA

International Classification:

G06F 9/44

US Classification:

717110

Abstract:

Methods and a tool or instrument for performing the methods of protecting a computer program with a parameter cloud are disclosed. A parameter cloud comprising a plurality of elements may be created. Called functions of a computer program may have defined expected parameter cloud states so that proper behavior of the called function is achieved when the parameter cloud state is the expected parameter cloud state. An expected parameter cloud state may include a selected set of elements of the parameter cloud having assigned values. Static portions of the called functions may depend on a current parameter cloud state, and calling functions may transform the parameter cloud state prior to calling their respective called functions. The methods and instrument may operate on original source code or post-binary targets of the computer program. A fingerprint may be used to identify a specific computer program from a sequence of state transitions.