Lee Francis Walker

US Patent:

8060927, Nov 15, 2011

Filed:

Oct 31, 2007

Appl. No.:

11/981427

Inventors:

Christopher J. Engdahl - Seattle WA, US
Brian Swander - Bellevue WA, US
Lee Walker - Christiansburg VA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

H04L 29/02
G06F 21/24

US Classification:

726 13, 713154, 726 3

Abstract:

A network firewall may apply policies to packets based on a security classification. Packets with an authenticated and established security connection may be handled at a high throughput while packets with unauthenticated connections may be handed at a low throughput or even discarded. In some embodiments, three or more levels of security classifications may be used to process packets at different speeds or priorities. In some embodiments, one device may classify and tag each packet, while another device within the network may process the packets according to the tags.

US Patent:

8074264, Dec 6, 2011

Filed:

Apr 16, 2008

Appl. No.:

12/104425

Inventors:

Daniel W. Hitchcock - Bothell WA, US
Siddharth Bhai - Redmond WA, US
Nathan D. Muggli - Kirkland WA, US
Brian W. Puhl - Redmond WA, US
Lee F. Walker - Christiansburg VA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

H04L 9/32
H04L 9/00
G06F 17/30

US Classification:

726 7, 726 3, 726 4, 726 5, 726 6, 713155, 713156, 713157, 713158

Abstract:

A server may bridge between a wide area network, such as the Internet, and a local area network and may process authentication requests from clients on the wide area network. The server may filter the requests to enable specific types of requests to pass, and may forward the requests to a credential server within the local area network and pass any responses back to the client. The server may be configured with some or all of a set of domain services objects, but such objects may be stored in a read only format. The server may further contain a minimum of or no sensitive data such that, if compromised, an attacker may gain little advantage. The client may request evidence of authentication available to devices within the local area network and may use the evidence of authentication to access services made available to the wide area network.

US Patent:

20090112814, Apr 30, 2009

Filed:

Oct 31, 2007

Appl. No.:

11/980928

Inventors:

Jeromy S. Statia - Duvall WA, US
Christopher J. Engdahl - Seattle WA, US
Lee Walker - Christiansburg VA, US
William Dixon - Seattle WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 17/30

US Classification:

707 3, 707E17014

Abstract:

A secure DNS query may be made by establishing a secure connection with a specific DNS server to determine an address for a hostname. A client device may have a database that may contain a record of a secure DNS server for one or more hostnames. When a DNS request contains one of the specified hostnames, an authenticated session may be created with the designated secure DNS server and a network address for the hostname is returned using the session. The authenticated session may authenticate a client device to the server as well as authenticate the server to the client. In some embodiments, the secure DNS server may accept connections from authenticated clients and may disregard connection requests from non authenticated clients.

US Patent:

20090254984, Oct 8, 2009

Filed:

Jun 24, 2008

Appl. No.:

12/144863

Inventors:

Nir Nice - Kfar Veradim, IL
Lee F. Walker - Christiansburg VA, US

Assignee:

MICROSOFT CORPORATION - Redmond WA

International Classification:

H04L 9/00
G06F 15/16

US Classification:

726 11

Abstract:

Native IPv6 capabilities are provided to an IPv4 network node, device, or endpoint using a hardware interface that supports network communication under a Direct Access model. The Direct Access model supports IPv6 communication with IPsec and enforces Network Access Protection (“NAP”) health requirement policies for endpoints that are network clients. A Direct Access-ready server is enabled using a hardware interface that implements IPv4 to IPv6 translation and optionally IPsec termination capability. A Direct Access-ready client is enabled using a hardware interface that implements IPv4 to IPv6 translation, IPsec termination capability, and which optionally provides NAP (Network Access Protection) capabilities for Direct Access-ready clients that are configured as mobile information appliances. The hardware interface may be implemented as a network interface card (“NIC”) or as a chipset.

US Patent:

20170329850, Nov 16, 2017

Filed:

Jul 28, 2017

Appl. No.:

15/662922

Inventors:

- Redmond WA, US
Christopher J. Engdahl - Seattle WA, US
Lee Walker - Christiansburg VA, US
William Dixon - Munich, DE

International Classification:

G06F 17/30
H04L 29/12
H04L 29/12
H04L 29/12
H04L 29/06

Abstract:

A secure DNS query may be made by establishing a secure connection with a specific DNS server to determine an address for a hostname. A client device may have a database that may contain a record of a secure DNS server for one or more hostnames. When a DNS request contains one of the specified hostnames, an authenticated session may be created with the designated secure DNS server and a network address for the hostname is returned using the session. The authenticated session may authenticate a client device to the server as well as authenticate the server to the client. In some embodiments, the secure DNS server may accept connections from authenticated clients and may disregard connection requests from non authenticated clients.

US Patent:

20150199430, Jul 16, 2015

Filed:

Jan 12, 2015

Appl. No.:

14/594340

Inventors:

- Redmond WA, US
Christopher J. Engdahl - Seattle WA, US
Lee Walker - Christiansburg VA, US
William Dixon - Seattle WA, US

International Classification:

G06F 17/30
H04L 29/12

Abstract:

A secure DNS query may be made by establishing a secure connection with a specific DNS server to determine an address for a hostname. A client device may have a database that may contain a record of a secure DNS server for one or more hostnames. When a DNS request contains one of the specified hostnames, an authenticated session may be created with the designated secure DNS server and a network address for the hostname is returned using the session. The authenticated session may authenticate a client device to the server as well as authenticate the server to the client. In some embodiments, the secure DNS server may accept connections from authenticated clients and may disregard connection requests from non authenticated clients.