David M Cross

US Patent:

7325115, Jan 29, 2008

Filed:

Nov 25, 2003

Appl. No.:

10/721562

Inventors:

Benjamin A. Leis - Seattle WA, US
David B. Cross - Redmond WA, US
Duncan G. Bryce - Redmond WA, US
Jianrong Gu - Bellevue WA, US
Rajeev Y. Nagar - Sammamish WA, US
Scott A. Field - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 12/00

US Classification:

711164, 713193

Abstract:

An operating system copies data from memory pages into a paging file on disk, in order to free up space in the memory. A mechanism is disclosed that causes the data to be encrypted as it is copied into the paging file, thereby protecting the paged data from unauthorized (or otherwise undesired) observation. The data that is stored in the paging file is encrypted with a session key, that is generated shortly after the machine on which the paging file exists is started. The session key, which is used both for encryption and decryption of the paging file data, is stored in volatile memory, so that the key is not persisted across boots of the machine. Since the key is not persisted across boots, old paging file data that was stored prior to the most recent boot cannot be recovered in clear text, thereby protecting the data from observation.

US Patent:

7434253, Oct 7, 2008

Filed:

Jul 14, 2005

Appl. No.:

11/181525

Inventors:

Christopher J. Crall - Seattle WA, US
Gennady Medvinsky - Issaquah WA, US
Joshua Ball - Lake Forest Park WA, US
Karthik Jaganathan - Redmond WA, US
Paul J. Leach - Seattle WA, US
Liqiang Zhu - Kirkland WA, US
David B. Cross - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

H04L 9/32
H04L 9/00

US Classification:

726 10, 726 14, 713175

Abstract:

A hint containing user mapping information is provided in messages that may be exchanged during authentication handshakes. For example, a client may provide user mapping information to the server during authentication. The hint (e. g. , in the form of a TLS extension mechanism) may be used to send the domain/user name information of a client to aid the server in mapping the user's certificate to an account. The extension mechanism provides integrity and authenticity of the mapping data sent by the client. The user provides a hint as to where to find the right account or domain controller (which points to, or otherwise maintains, the correct account). Based on the hint and other information in the certificate, the user is mapped to an account. The hint may be provided by the user when he logs in. Thus, a certificate is mapped to an identity to authenticate the user.

US Patent:

20130145428, Jun 6, 2013

Filed:

Dec 5, 2011

Appl. No.:

13/310816

Inventors:

Lee HOLMES - Renton WA, US
Hitesh RAIGANDHI - Redmond WA, US
Nathan BURKHART - Seattle WA, US
David B. CROSS - Redmond WA, US
Manoj K. AMPALAM - Sammamish WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 21/00

US Classification:

726 4

Abstract:

An input port for a computer system may retain potentially authenticable requests for processing while removing other connection requests from an incoming queue or request pool. The input port may continue to receive new requests even during a denial of service attack, allowing potentially legitimate requests to be processed. In a typical embodiment, a first in, first out buffer may be used to receive and process connection requests. When the buffer is full, any request that comes from a device having a previous connection with the computer system may be retained for authentication, while removing requests that come from unknown devices. Some embodiments may retain a list of known devices associated with administrators or other known users, and the list may be updated as those users are authenticated.