Patents by Inventor Kinshumann
Kinshumann has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).
-
Publication number: 20180103097Abstract: An application is installed on a computing device from an application package. An origin of the application (e.g., a managed installer for an enterprise, a reputation checking service) is propagated to files written to a storage device of the computing device as part of the installation, such as by writing origin information to the storage device as metadata associated with the file. The origin information for a file, in conjunction with a policy on the computing device specifying one or more trusted origins for applications on the computing device, is used to identify whether a particular action can be taken with and/or by the file. These actions can include, for example, execution of an application from an executable file. If the origin information for a file indicates an origin that is a trusted origin specified by the policy, then the action can be performed.Type: ApplicationFiled: October 7, 2016Publication date: April 12, 2018Applicant: Microsoft Technology Licensing, LLCInventors: Scott R. Shell, Kinshumann Kinshumann, Thomas W. Caldwell, Jeffrey A. Sutherland, Jeffrey R. McKune, Deskin M. Miller, Scott D. Anderson, Md. Nazmus Sakib
-
Patent number: 9934412Abstract: In one embodiment, a data storage client may establish a virtual replay protected storage system with an agnostic data storage. The virtual replay protected storage system may maintain a trusted counter and a secret key in a trusted client environment. The virtual replay protected storage system may encode a hash message authentication code signature based on the trusted counter, the secret key, and a data set. The virtual replay protected storage system may send a write request of the data set with the hash message authentication code signature to an agnostic data storage.Type: GrantFiled: June 23, 2015Date of Patent: April 3, 2018Assignee: Microsoft Technology Licensing, LLCInventors: Yevgeniy A. Samsonov, Kinshuman Kinshumann
-
Publication number: 20180062833Abstract: Obtaining a sealed secret. The method includes decrypting one or more BLOBs at a computing system from among a plurality of different BLOBs. Each of the BLOBs in the plurality of BLOBs contains the secret. Each of the BLOBs in the plurality of BLOBs is sealed to a different condition from among a plurality of conditions. A given condition is a reflection of a system state where the system state is indicative of whether or not the system can be trusted to receive the secret. The method further includes evaluating one or more of the conditions to determine if at least one of the one or more conditions is met. The method further includes, if at least one of the one or more conditions is met, then providing the secret to an external entity.Type: ApplicationFiled: August 31, 2016Publication date: March 1, 2018Inventors: Kinshumann, Christopher McCarron, Yevgeniy Anatolievich Samsonov
-
Publication number: 20180004531Abstract: In one example, a method includes allocating separate portions of memory for a control stack and a data stack. The method also includes, upon detecting a call instruction, storing a first return address in the control stack and a second return address in the data stack; and upon detecting a return instruction, popping the first return address from the control stack and the second return address from the data stack and raising an exception if the two return addresses do not match. Otherwise, the return instruction returns the first return address. Additionally, the method includes executing an exception handler in response to the return instruction detecting an exception, wherein the exception handler is to pop one or more return addresses from the control stack until the return address on a top of the control stack matches the return address on a top of the data stack.Type: ApplicationFiled: June 30, 2016Publication date: January 4, 2018Applicant: Microsoft Technology Licensing, LLCInventors: Ling Tony Chen, Kenneth D. Johnson, Jonathan E. Lange, Kinshumann, Matthew Miller, Neeraj Singh
-
Patent number: 9836601Abstract: Anti-malware process protection techniques are described. In one or more implementations, an anti-malware process is launched. The anti-malware process is verified based at least in part on an anti-malware driver that contains certificate pairs which contain an identity that is signed with the trusted certificate from a verified source. After the anti-malware process is verified, the anti-malware process may be assigned a protection level, and an administrative user may be prevented from altering the anti-malware process.Type: GrantFiled: August 8, 2016Date of Patent: December 5, 2017Assignee: MICROSOFT TECHNOLOGY LICENSING, LLCInventors: Hari Pulapaka, Nicholas S. Judge, Arun U. Kishan, James A. Schwartz, Jr., Kinshumann Kinshumann, David J. Linsley, Niraj V. Majmudar, Scott D. Anderson
-
Publication number: 20170286664Abstract: A system for changing policy information of a process is provided. When a process is to execute, the system stores policy information for the process in association with the process code. The system also creates a token for the process. The token provides evidence of the policy for the process and includes at least a reference to the stored policy information. The system provides the token to the process for use by the process as evidence of the policy for the process. When the process provides the token to a service provider, the service provider uses the reference to access the policy information for the process. While the process is executing, the system modifies the stored policy information. When the process subsequently provides the token to a service provider, the service provider uses the reference to access the modified policy information for the process.Type: ApplicationFiled: March 31, 2016Publication date: October 5, 2017Inventors: Nazmus Sakib, Yogesh Mehta, Kinshumann Kinshumann, Vishal Agarwal, Giridharan Sridharan, Arnold Paul Pereira, Deskin Miller, Narendra Acharya
-
Patent number: 9705879Abstract: A computing device, or a security component of a computing device, implements delayed attestation by initially providing first credentials to a remote access device to establish a first level of trust. The first credentials may be provided before or while the computing device or the security component is obtaining security information from a remote security device. The security information is used to generate second credentials that are subsequently provided to the remote access device to establish a second level of trust. The first credentials may comprise an encryption key that can be generated by the security component without having to retrieve information via a network, and the second credentials may comprise an attestation statement that is more trustworthy than the encryption key and that is generated based on a certificate retrieved from a remote security device (e.g., a certificate authority server).Type: GrantFiled: February 24, 2015Date of Patent: July 11, 2017Assignee: Microsoft Technology Licensing, LLCInventors: Anoosh Saboori, Victor W. Heller, Xiaohong Su, Dayi Zhou, Kinshuman Kinshumann, James Hugh Morgan, Stefan Thom
-
Publication number: 20170140152Abstract: During booting of a computing device, multiple security boundaries are generated. A security boundary refers to a manner of operation of a computing device or a portion of the computing device, with a program executing in one security boundary being prohibited from accessing data and programs in another security boundary. As part of booting the computing device measurements of (e.g., hash values or other identifications of) various modules loaded and executed as part of booting the computing device are maintained by a boot measurement system of the computing device. Additionally, as part of booting the computing device, public/private key pairs of one of the security boundaries is generated or otherwise obtained. Private keys of the public/private key pairs are provided to the one security boundary, and the public keys of the public/private key pairs are provided to the boot measurement system.Type: ApplicationFiled: January 31, 2017Publication date: May 18, 2017Applicant: Microsoft Technology Licensing, LLCInventors: Yevgeniy A. Samsonov, Kinshumann Kinshumann
-
Publication number: 20170061128Abstract: Booting a machine in a secure fashion in a potentially unsecure environment. The method includes a target machine beginning a boot process. The method further includes the target machine determining that it needs provisioning data to continue booting. The target machine contacts a secure infrastructure to obtain the provisioning data. The target machine provides an identity claim that can be verified by the secure infrastructure. As a result of the secure infrastructure verifying the identity claim, the target machine receives a request from the secure infrastructure to establish a key sealed to the target machine. The target machine provides the established key to the secure infrastructure. The target machine receives the provisioning data from the secure infrastructure. The provisioning data is encrypted to the established key. The target machine decrypts the encrypted provisioning data, and uses the provisioning data to finish booting.Type: ApplicationFiled: November 9, 2016Publication date: March 2, 2017Inventors: Mark Fishel Novak, Nir Ben-Zvi, John Anthony Messec, Kinshuman Kinshumann, Christopher McCarron
-
Patent number: 9582513Abstract: Embodiments of the disclosure provide access to data in a compressed container through dynamic redirection, without storing decompressed data in persistent memory. The compressed container is stored in a first portion of memory. User data and reference files, with redirect pointers, for accessing corresponding files in the compressed container are stored in a second portion of memory. A command to access data is detected by a computing device. The redirect pointer in the reference file associated with the command redirects access to the corresponding compressed version of data stored in the compressed container. The corresponding accessed compressed version of data is decompressed on the fly and provided in response to the command without storing the decompressed data in persistent memory. Some embodiments provide integrity protection to validate the data coming from the compressed container.Type: GrantFiled: December 8, 2013Date of Patent: February 28, 2017Assignee: Microsoft Technology Licensing, LLCInventors: Richard A. Pletcher, Malcolm J. Smith, Alain F. Gefflaut, Alex Bendetov, Andrey Shedel, David J. Linsley, Aaron M. Farmer, James Aaron Holmes, Troy E. Shaw, Emily N. Wilson, Innokentiy Basmov, Michael J. Grass, Alex M. Semenko, Scott D. Anderson, Kinshuman Kinshumann
-
Patent number: 9584317Abstract: During booting of a computing device, multiple security boundaries are generated. A security boundary refers to a manner of operation of a computing device or a portion of the computing device, with a program executing in one security boundary being prohibited from accessing data and programs in another security boundary. As part of booting the computing device measurements of (e.g., hash values or other identifications of) various modules loaded and executed as part of booting the computing device are maintained by a boot measurement system of the computing device. Additionally, as part of booting the computing device, a public/private key pair of one of the security boundaries is generated or otherwise obtained. The private key of the public/private key pair is provided to the one security boundary, and the public key of the public/private key pair is provided to the boot measurement system.Type: GrantFiled: February 4, 2015Date of Patent: February 28, 2017Assignee: Microsoft Technology Licensing, LLCInventors: Kinshuman Kinshumann, Yevgeniy A. Samsonov, Niels T. Ferguson, Mark Fishel Novak
-
Patent number: 9578017Abstract: Deploying an encrypted entity on a trusted entity is illustrated herein. A method includes, at a trusted entity, wherein the trusted entity is trusted by an authority as a result of providing a verifiable indication of certain characteristics of the trusted entity meeting certain requirements, receiving an encrypted entity from an untrusted entity. The untrusted entity is not trusted by the authority. At the trusted entity, a trust credential from the authority is used to obtain a key from a key distribution service. The key distribution service is trusted by the authority. The key is used to decrypt the encrypted entity to allow the encrypted entity to be deployed at the trusted entity.Type: GrantFiled: October 1, 2014Date of Patent: February 21, 2017Assignee: Microsoft Technology Licensing, LLCInventors: Niels T. Ferguson, Yevgeniy Anatolievich Samsonov, Kinshuman Kinshumann, Samartha Chandrashekar, John Anthony Messec, Mark Fishel Novak, Christopher McCarron, Amitabh Prakash Tamhane, Qiang Wang, David Matthew Kruse, Nir Ben-Zvi, Anders Bertil Vinberg
-
Publication number: 20160379015Abstract: In one embodiment, a data storage client may establish a virtual replay protected storage system with an agnostic data storage. The virtual replay protected storage system may maintain a trusted counter and a secret key in a trusted client environment. The virtual replay protected storage system may encode a hash message authentication code signature based on the trusted counter, the secret key, and a data set. The virtual replay protected storage system may send a write request of the data set with the hash message authentication code signature to an agnostic data storage.Type: ApplicationFiled: June 23, 2015Publication date: December 29, 2016Applicant: MICROSOFT TECHNOLOGY LICENSING, LLCInventors: Yevgeniy A. Samsonov, Kinshuman Kinshumann
-
Patent number: 9519787Abstract: Booting a machine in a secure fashion in a potentially unsecure environment. The method includes a target machine beginning a boot process. The method further includes the target machine determining that it needs provisioning data to continue booting. The target machine contacts a secure infrastructure to obtain the provisioning data. The target machine provides an identity claim that can be verified by the secure infrastructure. As a result of the secure infrastructure verifying the identity claim, the target machine receives a request from the secure infrastructure to establish a key sealed to the target machine. The target machine provides the established key to the secure infrastructure. The target machine receives the provisioning data from the secure infrastructure. The provisioning data is encrypted to the established key. The target machine decrypts the encrypted provisioning data, and uses the provisioning data to finish booting.Type: GrantFiled: November 14, 2014Date of Patent: December 13, 2016Assignee: Microsoft Technology Licensing, LLCInventors: Mark Fishel Novak, Nir Ben-Zvi, John Anthony Messec, Kinshuman Kinshumann, Christopher McCarron
-
Publication number: 20160357988Abstract: A virtual secure mode is enabled for a virtual machine operating in a computing environment that is associated with a plurality of different trust levels. First, a virtual secure mode image is loaded into one or more memory pages of a virtual memory space of the virtual machine. Then, the one or more memory pages of the virtual memory space are made inaccessible to one or more trust levels having a relatively lower trust level than a launching trust level that is used by a virtual secure mode loader to load the virtual secure mode image. A target virtual trust level is also enabled on a launching virtual processor for the virtual machine that is higher than the launching trust level.Type: ApplicationFiled: August 22, 2016Publication date: December 8, 2016Inventors: Niels T. Ferguson, Yevgeniy Anatolievich Samsonov, Kinshuman Kinshumann, Samartha Chandrashekar, John Anthony Messec, Mark Fishel Novak, Christopher McCarron, Amitabh Prakash Tamhane, Qiang Wang, David Matthew Kruse, Nir Ben-Zvi, Anders Bertil Vinberg
-
Patent number: 9515832Abstract: The techniques and systems described herein present various implementations of a model for authenticating processes for execution and specifying and enforcing permission restrictions on system resources for processes and users. In some implementations, a binary file for an application, program, or process may be augmented to include a digital signature encrypted with a key such that an operating system may subsequently authenticate the digital signature. Once the binary file has been authenticated, the operating system may create a process and tag the process with metadata indicating the type of permissions that are allowed for the process. The metadata may correspond to a particular access level for specifying resource permissions.Type: GrantFiled: June 24, 2013Date of Patent: December 6, 2016Assignee: Microsoft Technology Licensing, LLCInventors: Vishal Agarwal, Sunil P. Gottumukkala, Arun U. Kishan, Dave M. McPherson, Jonathan M. Andes, Giridharan Sridharan, Kinshuman Kinshumann, Adam Damiano, Salahuddin J. Khan, Gopinathan Kannan
-
Publication number: 20160342790Abstract: Anti-malware process protection techniques are described. In one or more implementations, an anti-malware process is launched. The anti-malware process is verified based at least in part on an anti-malware driver that contains certificate pairs which contain an identity that is signed with the trusted certificate from a verified source. After the anti-malware process is verified, the anti-malware process may be assigned a protection level, and an administrative user may be prevented from altering the anti-malware process.Type: ApplicationFiled: August 8, 2016Publication date: November 24, 2016Inventors: Hari Pulapaka, Nicholas S. Judge, Arun U. Kishan, James A. Schwartz, JR., Kinshumann Kinshumann, David J. Linsley, Niraj V. Majmudar, Scott D. Anderson
-
Publication number: 20160259941Abstract: A device boots in a secure manner that allows measurements reflecting which components are loaded during booting to be generated. Measurements of such components, as well as of a device management agent and the security state of the device, are also obtained. The device management agent accesses an attestation service for an enterprise, which is a collection of resources managed by a management service. The device management agent provides the obtained measurements to the attestation service, which evaluates the measurements and based on the evaluation determines whether the device is verified for use in the enterprise. The management service uses this verification to ensure that the device management agent is running in a secure manner, is accurately providing indications of the state of the device to the management service, and is implementing policy received from the management service.Type: ApplicationFiled: March 6, 2015Publication date: September 8, 2016Inventors: Janani Vasudevan, Peter David Waxman, Kinshuman Kinshumann, Justin A. Hou, Peter J. Kaufman, Yuhang Zhu, Giridhar Viswanathan, Scott R. Shell
-
Patent number: 9424425Abstract: Anti-malware process protection techniques are described. In one or more implementations, an anti-malware process is launched. The anti-malware process is verified based at least in part on an anti-malware driver that contains certificates which contain an identity that is signed with the trusted certificate from a verified source. After the anti-malware process is verified, the anti-malware process may be assigned a protection level, and an administrative user may be prevented from altering the anti-malware process.Type: GrantFiled: May 31, 2013Date of Patent: August 23, 2016Assignee: MICROSOFT TECHNOLOGY LICENSING, LLCInventors: Hari Pulapaka, Nicholas S. Judge, Arun U. Kishan, James A. Schwartz, Jr., Kinshumann Kinshumann, David J. Linsley, Niraj V. Majmudar, Scott D. Anderson
-
Publication number: 20160210457Abstract: A facility for booting a virtual machine hosted on a host is described. In one example facility, the facility boots the virtual machine in accordance with a policy instance associated with the virtual machine. As part of the booting, the facility extracts information needed to complete the booting from a virtual trusted platform module associated with the virtual machine, the extraction based upon the policy instance associated with the virtual machine. At the completion of the booting, the facility copies contents of a policy instance associated with the host into the policy instance associated with the virtual machine.Type: ApplicationFiled: August 12, 2015Publication date: July 21, 2016Inventors: Lawrence Ralph Cleeton, Yevgeniy A. Samsonov, Kinshumann Kinshumann, Jingbo Wu, Kevin Michael Broas, Samartha Chandrashekar