Jamie Christine Hunter

US Patent:

7694121, Apr 6, 2010

Filed:

Jun 30, 2004

Appl. No.:

10/882134

Inventors:

Bryan Mark Willman - Kirkland WA, US
Paul England - Bellevue WA, US
Kenneth D. Ray - Seattle WA, US
Jamie Hunter - Bothell WA, US
Lonnie Dean McMichael - Redmond WA, US
Derek Norman LaSalle - Redmond WA, US
Pierre Jacomet - Sammamish WA, US
Mark Eliot Paley - Sammamish WA, US
Thekkthalackal Varugis Kurien - Sammamish WA, US
David B. Cross - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 9/00

US Classification:

713 2, 713161, 713165, 713172

Abstract:

A mechanism for protected operating system boot that prevents rogue components from being loaded with the operating system, and thus prevents divulgence of the system key under inappropriate circumstances. After a portion of the machine startup procedure has occurred, the operating system loader is run, the loader is validated, and a correct machine state is either verified to exist and/or created. Once the loader has been verified to be a legitimate loader, and the machine state under which it is running is verified to be correct, the loader's future behavior is known to protect against the loading of rogue components that could cause divulgence of the system key. With the loader's behavior being known to be safe for the system key, the validator may unseal the system key and provides it to the loader.

US Patent:

8046593, Oct 25, 2011

Filed:

Jun 7, 2006

Appl. No.:

11/449553

Inventors:

Carl M. Ellison - Seattle WA, US
Jamie Hunter - Bothell WA, US
Kenneth D. Ray - Seattle WA, US
Niels T. Ferguson - Redmond WA, US
Philip J. Lafornara - Bellevue WA, US
Russell Humphries - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 12/14

US Classification:

713193, 713189, 726 26, 726 27, 726 31

Abstract:

Access to a storage device, such as a disk, is controlled by performing a disk operation using a single cryptographic engine. Keys associated with each layer of a layered structure associated with controlling access to the storage device are combined. The resultant of this combination is used as the key to the cryptographic engine. Data to be retrieved from and written to the storage device are operated on by the cryptographic engine utilizing the combined key. Keys are combined by combining functions associated with layers of the layered structure. A combining function can include an exclusive or function, a cryptographic hash function, or a combination thereof.