Abstract: The present invention extends to methods, systems, and computer program products for licensing protected content to application sets. Embodiments of the invention permit a local machine to increase its participation in authorizing access to protected content. For example, an operating system within an appropriate computing environment is permitted to determine if an application is authorized to access protected content. Thus, the application is relieved from having to store a publishing license. Further, authorization decisions are partially distributed, easing the resource burden on a protection server. Accordingly, embodiments of the invention can facilitate more robust and efficient authorization decisions when access to protected content is requested.

Abstract: The various embodiments described below are directed to providing authenticated and confidential messaging from software executing on a host (e.g. a secure software application or security kernel) to and from I/O devices operating on a USB bus. The embodiments can protect against attacks that are levied by software executing on a host computer. In some embodiments, a secure functional component or module is provided and can use encryption techniques to provide protection against observation and manipulation of USB data. In other embodiments, USB data can be protected through techniques that do not utilized (or are not required to utilize) encryption techniques. In accordance with these embodiments, USB devices can be designated as “secure” and, hence, data sent over the USB to and from such designated devices can be provided into protected memory. Memory indirection techniques can be utilized to ensure that data to and from secure devices is protected.

Abstract: An avatar generator for a virtual environment reflects a physiological characteristic of the user, injecting a degree of reality into the capabilities or appearance. Thereby, many of the incentives of the real world are replicated in a virtual environment. Physiological data that reflect a degree of health of the real person can be linked to rewards of capabilities of a gaming avatar, an amount of time budgeted to play, or a visible indication. Thereby, people are encouraged to exercise. Physiological data that reflect the health and perhaps also mood also improve social interaction in virtual environments. People seeking to meet and become acquainted with particular types of people are not thwarted by the artificiality of avatars. The physiological data can be gleaned from a third party health data collection repository, a healthcare smart card, a real-time physiological sensor (e.g., blood pressure, heart rate, blood glucose, peak flow, pedometer, etc.

Abstract: A social network service provides trusted, timely and managed communications between a querying individual and an informed individual by optimizing distribution of queries to reflect a requisite amount of expertise necessary (i.e., interest, background, education, demographic attribute, etc.). Those candidate recipients with a rare level of expertise or specialization can specify a desired level of participation, which is respected. In order not to exhaust their availability, those who are less qualified or part of a larger demographic category appropriate for the query are selected to handle queries of lesser difficulty or less specialization. Anonymity if desired by the recipient party can be supported by increasing the pool of candidate recipients so that the querying party cannot reasonably ascertain who is responding. Timeliness of response, as well as satisfaction in the response, is tracked in order to affect redirection of a query.

Abstract: The present invention extends to methods, systems, and computer program products for a centrally accessible policy repository. Protection policies for protecting resources within an organization are stored at a central policy repository. Thus, an administrator can centrally create, maintain, and manage resource protection polices for all of the organizational units within an organization. Accordingly, resources consumed when performing these protection policy related operations is significantly reduced. Additionally, since protection policies are centrally located, there is increased likelihood of being able to consistently apply an organization's protection policies within different organizational units, even when protection policies change.

Abstract: The claimed subject mater provides systems and/or techniques that provide biometric feedback monitoring of brain activity. The system includes mechanisms that obtain indication of brain activity associated with an individual which can be utilized to ensure that the individual is maximizing his or her brain activity. Where it is determined that the individual is not optimally utilizing his or her brain, feedback can be directed to the individual in order to stimulate brain activity in a specified response center of the brain.

Abstract: The secure application of content protection policies to content. The secure application of content protection polices is accomplished by having an enforcement mechanism monitor policy application points to detect the transfer of content. The enforcement mechanism accesses the content and a determination is made to protect the content. A usage policy is then identified by the enforcement mechanism to apply to the content and the usage policy is then applied to the content, resulting in a usage policy for the content.

Abstract: A method and apparatus to decrease the amount of time it takes to obtain friendly names of Bluetooth devices is presented. A name server caches friendly names for devices that it has acquired from other devices or from other name servers. The name server is any device that caches friendly names of Bluetooth devices and that makes the friendly names available to other devices. A requesting device determines if a name server has responded to an inquiry command. If a name server has responded, the device gets the friendly names the name server has cached and requests the friendly names of devices that responded that have not been cached by the name server. Identification of a name server is accomplished by embedding a marker in the friendly name field after the null character to indicate that the device is a name server.

Abstract: The claimed subject matter provides a system and/or a method that facilitates identifying a medical facility for an emergency medical situation. An interface can receive a portion of data related to an emergency medical incident and a corresponding location. A match component can evaluate the portion of data to select a medical facility in which to transport a patient involved in the emergency medical incident, wherein the medical facility can be ascertained based on a distance between the location of the emergency medical incident and a location for the selected medical facility and traffic related to a route there between.

Abstract: Systems and methods for controlling access to data on a computer with a secure boot process can provide a highly efficient mechanism for preventing future access to encrypted digital resources. This may be advantageous in a range of scenarios, for example where a computer is sold and assurance is desired that no stray private data remains on the hard disk. Data resources, for example all data associated with one or more particular hard disk partitions, may be encrypted. The decryption key may be available through a secure boot process. By erasing, altering, or otherwise disabling a secret, such as a decryption key or a process that obtains a decryption key, the data formerly accessible using such secret becomes inaccessible.

Abstract: The claimed subject matter provides a system and/or a method that facilitates scheduling an incoming patient appointment for a medical facility. A medical facility can provide healthcare to a patient, wherein the medical facility can utilize a schedule with an available time slot to assign an appointment to a patient. A match component can evaluate a portion of transportation data to select a patient to which an appointment on the schedule is allotted. A dynamic schedule component can automatically adjust the schedule based upon the evaluation.

Abstract: Prevention of unpermitted use of enabling bits is achieved by sealing the enabling bits to an environment in such a way that the bits can only be unsealed by or from the environment, and by using an isolation mechanism to isolate the environment from other environments on the machine on which the environment operates. The environment is trusted not to use the enabling bits except in accordance with a set of rules governing the bits. The enabling bits may be a decryption key for DRM-protected content, and the rules may be a license governing the use of that content. Trust that the enabling bits will not be misused is established by trusting the environment not to use the enabling bits contrary to the rules, trusting the isolation mechanism to isolate the environment, and trusting the unsealing mechanism only to unseal the bits for the environment.

Abstract: In a single machine that has entities running in an untrusted environment and entities running in a trusted environment, the trustworthiness of the entities in the trusted environment is projected to the entities in the untrusted environment. This is applicable, for example, to Microsoft®'s Next Generation Secure Computing Base (NGSCB), where a regular operating system (e.g., the Windows® operating system) hosts a secure operating system (e.g., the nexus).

Abstract: Procedures for resumption from a low activity condition are discussed. In implementations, a persistent state file, or a portion thereof, is secured via an encryption algorithm, with the decryption key secured via the operating system (OS) login user credentials. Once a user is authenticated via the OS login, the persistent state file may be decrypted and inserted in the OS boot path with resumption occurring through the persistent state file.

Abstract: Tools and techniques for securely launching encrypted operating systems are described herein. The tools may provide computing systems that include operating systems (OSs) that define boot paths for the systems. This boot path may include first and second OS loader components. The first loader may include instructions for retrieving a list of disk sectors from a first store, and for retrieving these specified sectors from an encrypted second store. The first loader may also store the sectors in a third store that is accessible to both the first and the second loader components, and may invoke the second loader to try launching the OS using these sectors. In turn, the second loader may include instructions for retrieving these sectors from the third store, and for unsealing a key for decrypting these sectors. The second loader may then decrypt these sectors, and attempt to launch the OS from these sectors.

Abstract: Systems and methods are provided for maintaining and updating a secure boot process on a computer with a trusted platform module (TPM). A boot process may be maintained by inspecting a log of TPM activity, determining data that prevented a secret to unseal, and returning the data to an original state. In situations where this type of recovery is not workable, techniques for authenticating a user may be used, allowing the authenticated user to bypass the security features of the boot process and reseal the boot secrets to platform configuration register (PCR) values that may have changed. Finally, a secure boot process may be upgraded by migrating TPM sealed secrets to a temporary storage location, updating one or more aspects of a secure boot process, and resealing the secrets to the resulting new platform configuration. Other advantages and features of the invention are described below.

Abstract: Techniques are disclosed to provide security for user output and input in which a first, host operating system is used along with a second, high assurance operating system (nexus), where the first system provides at least some of the infrastructure for the second system. A trusted UI engine has a trusted input manager and a trusted output manager. The trusted input manager controls access to trusted input, distributing decrypted input to the host operating system where appropriate, or to the appropriate process running in the nexus. The trusted output manager manages output to the display, and allows trusted agents in the nexus to output data for display without needing to be aware of output-device-dependent details.

Abstract: Systems and methods for validating integrity of an executable file are described. In one aspect, the systems and methods determine that an executable file is being introduced into a path of execution. The executable file is then automatically evaluated in view of multiple malware checks to detect if the executable file represents a type of malware. The multiple malware checks are integrated into an operating system trust verification process along the path of execution.

Abstract: The various embodiments described below are directed to providing authenticated and confidential messaging from software executing on a host (e.g. a secure software application or security kernel) to and from I/O devices operating on a USB bus. The embodiments can protect against attacks that are levied by software executing on a host computer. In some embodiments, a secure functional component or module is provided and can use encryption techniques to provide protection against observation and manipulation of USB data. In other embodiments, USB data can be protected through techniques that do not utilized (or are not required to utilize) encryption techniques. In accordance with these embodiments, USB devices can be designated as “secure” and, hence, data sent over the USB to and from such designated devices can be provided into protected memory. Memory indirection techniques can be utilized to ensure that data to and from secure devices is protected.

Abstract: A resource is obtained from a resource provider (RP) for a resource requester (RR) operating on a computing device. The RR has an identity descriptor (id) associated therewith, where the id including security-related information specifying an environment in which the RR operates. A code identity (code-ID) is calculated corresponding to and based on the loaded RR and loaded id. The RP verifies that the calculated code-ID in a request for the resource matches one of one or more valid code-IDs for the identified RR to conclude that the RR and id can be trusted, and the RP responds to the forwarded request by providing the requested resource to the RR.