Salahuddin C Khan

US Patent:

8341723, Dec 25, 2012

Filed:

Jun 28, 2007

Appl. No.:

11/823861

Inventors:

David Abzarian - Kirkland WA, US
Salahuddin Khan - Redmond WA, US
Eran Yariv - Redmond WA, US
Gerardo Diaz Cuellar - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

H04L 29/06

US Classification:

726 13, 713164, 726 1, 726 22

Abstract:

Some embodiments of the invention are directed to techniques for determining whether a process on a computer system that is sending or receiving data, or is attempting to send or receive data, with another computer system is executing in kernel mode or user mode and providing an indicator of this determination to a security engine. In some embodiments, such an indication is provided to a security engine (e. g. , a firewall) that implements a security policy based at least in part on whether the sending or receiving process is in kernel mode or user mode, and filter communications based on a process' operating mode. This enables a security engine to maintain security policies of greater specificity and thus improve security of a computer system.

US Patent:

20030233485, Dec 18, 2003

Filed:

Jun 13, 2002

Appl. No.:

10/170759

Inventors:

Salahuddin Khan - Redmond WA, US

Assignee:

Mircrosoft Corporation - Redmond WA

International Classification:

G06F009/46

US Classification:

709/318000

Abstract:

A novel system and method provide for event management utilizing a single thread or a limited plurality of threads to service queued events. When it is desired to add an event to the event queue, a thread is scheduled or acquired, such as from a thread pool, to service queue events unless such a thread is already active, or unless the current number of such threads equals or exceeds a preset thread limit when multiple threads are permitted. The use of a single thread, or alternatively a limited number of threads, to service the event queue leads to economy of system resources, and also avoids memory overflow due to thread proliferation. The limitation on the number of threads created to handle queued events assists in the avoidance of memory overflow complications. In addition, the elimination of threads that would otherwise occupy memory without providing substantial immediate results conserves system resources.

US Patent:

20090007251, Jan 1, 2009

Filed:

Jun 26, 2007

Appl. No.:

11/821839

Inventors:

David Abzarian - Kirkland WA, US
Michael R. Surkan - Bellevue WA, US
Salahuddin C.J. Khan - Redmond WA, US
Amit A. Sehgal - Kirkland WA, US
Eran Yariv - Redmond WA, US
Emanuel Paleologu - Kirkland WA, US
Gerardo Diaz Cuellar - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 9/00

US Classification:

726 11

Abstract:

A host firewall can determine and consider whether unsolicited traffic is inbound from beyond the edge of the network and allow or block such traffic based at least in part upon this characteristic. In one implementation, an edge traversal parameter can be set on a host firewall rule, which typically includes other parameters such as port, protocol, etc. If the unsolicited traffic received via an edge traversal interface matches a host firewall rule that has the edge traversal criterion, then the firewall does not block the traffic. On the other hand, if the unsolicited traffic received via an edge traversal interface fails to satisfy the edge traversal criterion on any firewall rule, then the firewall blocks the traffic.

US Patent:

20100088418, Apr 8, 2010

Filed:

Dec 7, 2009

Appl. No.:

12/632110

Inventors:

David Abzarian - Kirkland WA, US
Michael R. Surkan - Bellevue WA, US
Salahuddin C.J. Khan - Redmond WA, US
Amit A. Sehgal - Kirkland WA, US
Mohit Talwar - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 15/16

US Classification:

709227, 709235

Abstract:

A system maintains a dormant state in the host, in which no beacons (or “bubbles”) are transmitted from the host when no application or service (collectively, “processes”) of the host is accepting unsolicited traffic via the edge traversal service. When at least one application or service begins to accept unsolicited traffic via the edge traversal service, the host enters a qualified state and begins transmitting the beacons. As each additional application or service begins to accept such traffic, the number of accepting applications and services is maintained. As applications and services terminate acceptance of such traffic, the number of accepting applications and services is decremented. When the last application or service terminates acceptance of unsolicited traffic via the edge traversal service, the host re-enters the dormant state and ceases transmission of its beacons.

US Patent:

20100174921, Jul 8, 2010

Filed:

Jan 7, 2009

Appl. No.:

12/349516

Inventors:

David Abzarian - Kirkland WA, US
Todd L. Carpenter - Monroe WA, US
Harish S. Kulkami - Redmond WA, US
Salahuddin J. Khan - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 11/30
G06F 7/04

US Classification:

713193

Abstract:

Described is a technology by which a transient storage device or secure execution environment-based (e.g., including an embedded processor) device validates a host computer system. The device compares hashes of host system data against valid hashes maintained in protected storage of the device. The host data may be a file, data block, and/or memory contents. The device takes action when the host system data does not match the information in protected storage, such as to log information about the mismatch and/or provide an indication of validation failure, e.g., via an LED and/or display screen output. Further, the comparison may be part of a boot process validation, and the action may prevent the boot process from continuing, or replace an invalid file. Alternatively, the validation may take place at anytime.

US Patent:

20110302314, Dec 8, 2011

Filed:

Aug 16, 2011

Appl. No.:

13/211009

Inventors:

David Abzarian - Kirkland WA, US
Michael R. Surkan - Bellevue WA, US
Salahuddin C.J. Khan - Redmond WA, US
Amit A. Sehgal - Kirkland WA, US
Mohit Talwar - Redmond WA, US

Assignee:

Microsoft Corporation - Redmond WA

International Classification:

G06F 15/16

US Classification:

709227

Abstract:

A system maintains a dormant state in the host, in which no beacons (or “bubbles”) are transmitted from the host when no application or service (collectively, “processes”) of the host is accepting unsolicited traffic via the edge traversal service. When at least one application or service begins to accept unsolicited traffic via the edge traversal service, the host enters a qualified state and begins transmitting the beacons. As each additional application or service begins to accept such traffic, the number of accepting applications and services is maintained. As applications and services terminate acceptance of such traffic, the number of accepting applications and services is decremented. When the last application or service terminates acceptance of unsolicited traffic via the edge traversal service, the host re-enters the dormant state and ceases transmission of its beacons.

US Patent:

20130152186, Jun 13, 2013

Filed:

Nov 30, 2012

Appl. No.:

13/690528

Inventors:

MICROSOFT CORPORATION - Redmond WA, US
Salahuddin Khan - Redmond WA, US
Eran Yariv - Zichron Yaakov, IL
Gerardo Diaz Cuellar - Kirkland WA, US

Assignee:

MICROSOFT CORPORATION - Redmond WA

International Classification:

H04L 29/06

US Classification:

726 11, 726 3

Abstract:

Some embodiments of the invention are directed to techniques for determining whether a process on a computer system that is sending or receiving data, or is attempting to send or receive data, with another computer system is executing in kernel mode or user mode and providing an indicator of this determination to a security engine. In some embodiments, such an indication is provided to a security engine (e.g., a firewall) that implements a security policy based at least in part on whether the sending or receiving process is in kernel mode or user mode, and filter communications based on a process' operating mode. This enables a security engine to maintain security policies of greater specificity and thus improve security of a computer system.

US Patent:

20150058628, Feb 26, 2015

Filed:

Sep 9, 2014

Appl. No.:

14/480640

Inventors:

- Redmond WA, US
Salahuddin Khan - Redmond WA, US
Eran Yariv - Zichron Yaakov, IL
Gerardo Diaz Cuellar - Kirkland WA, US

International Classification:

H04L 29/06

US Classification:

713168, 726 14

Abstract:

Some embodiments of the invention are directed to techniques for determining whether a process on a computer system that is sending or receiving data, or is attempting to send or receive data, with another computer system is executing in kernel mode or user mode and providing an indicator of this determination to a security engine. In some embodiments, such an indication is provided to a security engine (e.g., a firewall) that implements a security policy based at least in part on whether the sending or receiving process is in kernel mode or user mode, and filter communications based on a process' operating mode. This enables a security engine to maintain security policies of greater specificity and thus improve security of a computer system.