John D Lambert

US Patent:

7216337, May 8, 2007

Filed:

Apr 14, 2003

Appl. No.:

10/413276

Inventors:

John Robert Lambert - Bellevue WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 9/45

US Classification:

717124

Abstract:

Computerized testing of an object to identify one or more call sequences that give rise to exceptions. A set of potential operations (consisting of methods and associated parameter values) is automatically generated. A parameter generator may supply interesting parameter values that may more likely result in a thrown exception. A number of call sequences is automatically constructed using the operations in the set of operations as steps in the sequence. Each call sequence is then executed using a new instance of the object. If an exception is thrown, a report may be issued containing information helpful in evaluating whether the exception is appropriate. This information might include the exception type as well as the invalid call sequence that gave rise to the thrown exception. The invalid call sequence may also be minimized to assist the tester in evaluating the root cause and appropriateness of the exception.

US Patent:

7237231, Jun 26, 2007

Filed:

Mar 10, 2003

Appl. No.:

10/385255

Inventors:

John Robert Lambert - Bellevue WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 9/44
G06F 11/00

US Classification:

717127, 717131, 714 38

Abstract:

Computerized testing of a system to identify combinations of input values that expose failures in the system's operation. Attributes are applied to fields in a source code version of a test case template corresponding to the object. Applied attributes can indicate fields that are to be used when generating test cases for the object. The source code version of the test case template is subsequently compiled or interpreted into a binary test case template. Metadata in the binary test case template is inspected (e. g. , through reflection) to identify the fields, data types, and attributes that are to be used when generating test cases. Based on possible input values for the identified fields and generation rules, a plurality of test cases is generated. The generated test cases are executed to identify combinations of input values that expose failures in the system's operation.

US Patent:

7350204, Mar 25, 2008

Filed:

Jun 8, 2001

Appl. No.:

09/877710

Inventors:

John J. Lambert - Kirkland WA, US
Praerit Garg - Kirkland WA, US
Jeffrey A. Lawson - Austin TX, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 9/45

US Classification:

717172, 726 21

Abstract:

A system and method that automatically, transparently and securely controls software execution by identifying and classifying software, and locating a rule and associated security level for executing executable software. The security level may disallow the software's execution, restrict the execution to some extent, or allow unrestricted execution. To restrict software, a restricted access token may be computed that reduces software's access to resources, and/or removes privileges, relative to a user's normal access token. The rules that control execution for a given machine or user may be maintained in a restriction policy, e. g. , locally maintained and/or in a group policy object distributable over a network. Software may be identified/classified by a hash of its content, by a digital signature, by its file system or network path, and/or by its URL zone. For software having multiple classifications, a precedence mechanism is provided to establish the applicable rule/security level.

US Patent:

7464270, Dec 9, 2008

Filed:

Jul 23, 2003

Appl. No.:

10/625312

Inventors:

Vishnu A. Patankar - Kirkland WA, US
Robert Reichel - Sammamish WA, US
John J. Lambert - Seattle WA, US
Kedarnath A. Dubhashi - Redmond WA, US
Jim E. Thatcher - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 11/30
G06F 12/14
H04L 9/32

US Classification:

713176, 713187, 709220, 709226

Abstract:

The restriction of particular resources includes providing a digital signature for unauthorized resources based on a structure-related parameter of the resource. Thus, attempts at circumventing recognition of such resource will likely result in altering the overall functionality of the resource. Further, such digital signatures are encoded in a critical file required for loading of a resource, thus ensuring that the identity of the resource is considered before execution thereof. Enforcement of the resource restriction includes generating a verification signature for a resource that requests loading. The verification signature is compared to the signature coded into the critical file, and a positive match results in the resource being blocked from loading.

US Patent:

7640573, Dec 29, 2009

Filed:

Feb 16, 2004

Appl. No.:

10/780274

Inventors:

Giovanni M. Della-Libera - Seattle WA, US
Vijay K. Gajjala - Sammamish WA, US
Tomasz Janczuk - Sammamish WA, US
John R. Lambert - Bellevue WA, US
Elliot Waingold - Seattle WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 17/00
G06F 17/30
G06F 7/04
G06F 21/00
H04L 29/06
H04L 9/32
H04N 7/16

US Classification:

726 1, 726 2, 726 26, 713182

Abstract:

A system for processing multiple types of security schemes includes a server having a claims engine that extracts claim(s) from security token(s) and maps extracted claims to other claims. The term claim as used in this context is a statement about a token's subject. The claims engine can extract claim(s) from one or more different types of security tokens corresponding to the multiple security schemes. These extracted claim(s) can then be selectively mapped to other claims using mapping information that is accessible to the server. The security decision can then be based on the extracted and/or derived claim(s) rather than tokens. This system can thereby support multiple security schemes and simplify the security process for the user.

US Patent:

7716728, May 11, 2010

Filed:

Feb 16, 2004

Appl. No.:

10/779922

Inventors:

Giovanni M. Della-Libera - Seattle WA, US
Vijay K. Gajjala - Sammamish WA, US
Tomasz Janczuk - Sammamish WA, US
John R. Lambert - Bellevue WA, US

Assignee:

Microsoft Corproation - Redmond WA

International Classification:

G06F 12/14
G06F 15/16
H04L 29/06

US Classification:

726 13, 726 1, 726 21, 713154, 713167, 707 9

Abstract:

A security system with a mechanism to identify types of information that need to be secured and another mechanism to specify how the types are to be secured. The system includes a sender having an application and a receiver having a security module and one or more datastores to store information related to types of information that need to be secured (e. g. “scopes”), how information is to be secured (e. g. , “profiles”), and a mapping (e. g. , “bindings”) between the scopes and profiles. Scopes can be implemented by application developers. Profiles can be implemented by application deployers and/or administrators. The security module determines which scope is appropriate for the message, and then determines the profile that is mapped to the scope. The security module can then make an access control decision using the profile.

US Patent:

8020194, Sep 13, 2011

Filed:

Oct 6, 2005

Appl. No.:

11/244017

Inventors:

John Lambert - Seattle WA, US
Matthew Thomlinson - Seattle WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 21/00

US Classification:

726 3, 707600, 707705, 709225, 709252, 713164, 713165, 713166, 713167, 726 4, 726 25

Abstract:

A privilege elevation flaw detection analysis is performed on a host system on a network. In addition, accounts on the host system are identified that have access to, or corresponding accounts on, other systems on the network. Privilege elevation analyses are performed on one or more of the network systems corresponding to the identified accounts. A privilege elevation graph is generated of the host system from the privilege elevation analysis. The graph includes account nodes and edges illustrating the detected privilege elevations between the accounts on the host system. In addition, nodes for the network systems are added to the graphs along with edges connecting to the nodes corresponding to the accounts identified as having access to the particular network systems. The user may then select a particular network system node and view its detected privilege elevations in relation to the host system.

US Patent:

8196178, Jun 5, 2012

Filed:

Oct 5, 2005

Appl. No.:

11/244023

Inventors:

John Lambert - Seattle WA, US
Matthew Thomlinson - Seattle WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 21/00

US Classification:

726 2, 713182, 726 25

Abstract:

A data collection application is executed on a target system. Various data indicative of privilege elevation pathways is collected, including user account data, file permission data, and system registry data. The collected data is analyzed according to heuristics. System accounts are displayed on a graph as nodes. Detected privilege elevations between the accounts are displayed as edges between their corresponding accounts. A user may customize the displayed graph to focus on particular goal accounts, and categories of privilege elevations.