Mark J Novak

US Patent:

8365264, Jan 29, 2013

Filed:

Oct 12, 2009

Appl. No.:

12/577711

Inventors:

Mark F. Novak - Newcastle WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

H04L 29/06

US Classification:

726 7

Abstract:

A password may be provided along with a validation code, which can help prevent the password from being sent to the wrong recipient. When a password is created, a validation code may be created based on (a) the password, and (b) the identity of the target of authentication (TA) to which the password is intended to be sent. When a user is requested to provide a password, validation component intercepts the request and asks the user to enter both the password and validation code. The validation component then re-calculates the validation code based on the entered password and on the TA that is requesting the password. If the re-calculated validation code matches the validation code entered by the user, then the password is released to the user agent that the user uses to communicate with the TA, and the user agent sends the password to the requesting TA.

US Patent:

8417962, Apr 9, 2013

Filed:

Jun 11, 2010

Appl. No.:

12/813955

Inventors:

Mark F. Novak - Newcastle WA, US
Robert Karl Spiger - Seattle WA, US
Stefan Thom - Snohomish WA, US
David J. Linsley - Seattle WA, US
Scott A. Field - Redmond WA, US
Anil Francis Thomas - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 11/30
G06F 12/14

US Classification:

713188

Abstract:

Booting a computing device includes executing one or more firmware components followed by a boot loader component. A protection component for the computing device, such as an anti-malware program, is identified and executed as an initial component after executing the boot loader component. One or more boot components are also executed, these one or more boot components including only boot components that have been approved by the protection component. A list of boot components that have been previously approved by the protection component can also be maintained in a tamper-proof manner.

US Patent:

8528069, Sep 3, 2013

Filed:

Jan 27, 2011

Appl. No.:

13/015202

Inventors:

Mark Novak - Newcastle WA, US
Yair Tor - Shorashim, IL
Eugene Neystadt - Kfar-Saba, IL
Yoav Yassour - Zikhron Yaakov, IL
Alexey Efron - Nesher, IL
Amos Ortal - Kfar Yona, IL
Daniel Alon - Tel Mond, IL
Ran Didi - Haifa, IL

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 15/16

US Classification:

726 10, 726 8, 726 3, 709203

Abstract:

Embodiments of the invention enable a client device to procure trustworthy device claims describing one or more attributes of the client device, have those device claims included in a data structure having a format suitable for processing by an application, and use the data structure which includes the device claims in connection with a request to access the application. The application may use the device claims to drive any of numerous types of application functionality, such as security-related and/or other functionality.

US Patent:

8561152, Oct 15, 2013

Filed:

May 17, 2011

Appl. No.:

13/109530

Inventors:

Mark F. Novak - Newcastle WA, US
Karanbir Singh - Seattle WA, US
David M. McPherson - Bothell WA, US
Andrey Popov - Renton WA, US
Ming Tang - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 21/00

US Classification:

726 4, 726 1, 726 8, 713150, 713165, 709229, 705 51

Abstract:

A context of a principal is built, at a target system controlling access to a resource, independently of the principal requesting access to the resource. An authorization policy is applied, at the target system, to the context to determine whether the principal is permitted to access the resource, and an indication of whether the principal is permitted to access the resource is provided (e. g. , to an administrator). Modifications can be made to the context and the authorization re-applied to determine whether a principal having the modified context is permitted to access the resource.

US Patent:

8621561, Dec 31, 2013

Filed:

Jan 4, 2008

Appl. No.:

11/969456

Inventors:

David B. Cross - Redmond WA, US
Mark F. Novak - Newcastle WA, US
Oded Ye Shekel - Bellevue WA, US
Paul J. Leach - Seattle WA, US
Andreas Luther - Kirkland WA, US
Thomas C. Jones - Sammamish WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

H04L 29/06
G06F 21/00

US Classification:

726 2, 726 1, 726 3, 726 4, 726 5, 726 6, 726 7, 726 9, 726 10, 726 16, 726 17, 726 18, 726 19, 726 20, 726 21, 726 26, 726 27, 726 28, 726 29, 726 30, 713155, 713156, 713159, 713168, 713169, 713172, 713173, 713182, 713183, 713184, 713185, 713186, 705 65, 705 66, 705 67, 705 72, 705 76, 709217, 709219, 709225, 709229

Abstract:

Embodiments for providing differentiated access based on authentication input attributes are disclosed. In accordance with one embodiment, a method includes receiving an authentication input at an authentication authority using an authentication protocol. The authentication input being associated with a client. The method also includes providing one or more representations for the authentication input, wherein each of the representations represents an attribute of the authentication input.

US Patent:

8627464, Jan 7, 2014

Filed:

Nov 2, 2010

Appl. No.:

12/938363

Inventors:

Stefan Thom - Snohomish WA, US
Nathan Ide - Bothell WA, US
Scott Danie Anderson - Seattle WA, US
Robert Karl Spiger - Seattle WA, US
David J. Linsley - Seattle WA, US
Mark Fishel Novak - Newcastle WA, US
Magnus Nyström - Sammamish WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 12/14

US Classification:

726 22, 726 26

Abstract:

An event log can comprise, not only entries associated with components instantiated since a most recent power on of a computing device, but also entries of components instantiated prior to that power on, such as components that were instantiated, and represent, a state of the computing device prior to hibernation that has now been resumed. Upon hibernation, the current values of the Platform Configuration Registers (PCRs) of a Trusted Platform Module (trusted execution environment), as well as a quote of those current values, and a current value of a monotonic counter of the trusted execution environment can be logged. The monotonic counter can be incremented at each power on to track successive generations of the computing device and to guard against an intervening, not-logged generation. A subsequent parsing of the event log can verify the prior generational entries with reference to the PCR values in the log that are associated with those generations.

US Patent:

8640210, Jan 28, 2014

Filed:

Sep 1, 2011

Appl. No.:

13/224257

Inventors:

Mark Novak - Newcastle WA, US
Paul J. Leach - Seattle WA, US
Yi Zeng - Bothell WA, US
Saurav Sinha - Kirkland WA, US
K Michiko Short - Renton WA, US
Gopinathan Kannan - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 21/00
H04L 9/32
H04L 9/00
H04L 29/06
G06F 15/00

US Classification:

726 6, 726 7, 380 44, 380 45, 380281, 380286

Abstract:

A distributed system in which time-dependent credentials are supplied by controllers that operate according to different local times. Errors that might arise from the controllers generating inconsistent credentials because of time skew are avoided by identifying credentials generated during transition intervals in which different ones of the controllers may generate different credentials at the same absolute time. During a transition interval, controllers and other devices may use credentials differentially based on the nature of the authentication function. Each controller may periodically renew its credentials based on self-scheduled renewals or based on requests from other devices, such that renewal times are offset by random delays to avoid excessive network traffic. Controllers may determine which credential is valid for any given time, based on a cryptographically secure key associated with that time and information identifying the entity that is associated with that credential.

US Patent:

20100071048, Mar 18, 2010

Filed:

Sep 12, 2008

Appl. No.:

12/209489

Inventors:

Mark F. Novak - Newcastle WA, US
Daniel Kaminsky - Seattle WA, US

Assignee:

MICROSOFT CORPORATION - Redmond WA

International Classification:

H04L 9/32
G06F 21/00

US Classification:

726 10

Abstract:

Embodiments for performing service binding between a client and a target server are disclosed. In accordance with one embodiment, a clear text client service binding value is received from a client at the target server, the client service binding value is compared to a server service binding value, and a communication channel is formed between the client and the target server when the client service binding value matches the server service binding value.