Granted Patent B2

US 12,505,258 · App. 18/575,055 · Granted Dec 23, 2025

Inventors: Maxwell Christopher Renke (Sammamish, WA); Andrea Allievi (Seattle, WA); Giridhar Viswanathan (Redmond, WA); Benjamin M. Schultz (Bellevue, WA); Hari R. Pulapaka (Redmond, WA); David Guy Weston (Seattle, WA)

Assignee: Microsoft Technology Licensing, LLC

G06F21/74

Abstract

Claims (35)

1 . A computer system for enforcing attestation of read-only protected memory during an attestation validity period, comprising:

a processor; and

a hardware storage device that stores computer-executable instructions that are executable by the processor to cause the computer system to at least:

identify a change in a read-only memory protection (ROMP) status for a software component loaded at the computer system;

determine that a validity time period of an attestation report is unexpired, the attestation report comprising one or more attested properties, including one or more ROMP attested properties for read-only protected memory allocated to the software component;

determine that at least one ROMP attested property for the software component is no longer valid due to the change in the ROMP status for a software component;

based on the at least one ROMP attested property for the software component being no longer valid, initiate a remedial action to prevent interaction of the software component with a relying party computer system, the remedial action comprising blocking a communication from the software component; and

permit communication by the software component after expiration of the validity time period.

2 . The computer system of claim 1 , wherein the remedial action also comprises suspending one or more processes corresponding to the software component.

3 . The computer system of claim 2 , wherein the computer-executable instructions are also executable by the processor to cause the computer system to resume the one or more processes after expiration of the validity time period.

4 . The computer system of claim 1 , wherein the remedial action also comprises terminating one or more processes corresponding to the software component.

5 . The computer system of claim 1 , wherein the remedial action also comprises initiating obtaining a new attestation report.

6 . The computer system of claim 1 , wherein the remedial action also comprises notifying the relying party computer system.

7 . A method, implemented at a computer system that comprises a processor for enforcing attestation of read-only protected memory during an attestation validity period, the method comprising:

identifying a change in a read-only memory protection (ROMP) status for a software component loaded at the computer system;

determining that a validity time period of an attestation report is unexpired, the attestation report comprising one or more attested properties, including one or more ROMP attested properties for read only protected memory allocated to the software component;

determining that at least one ROMP attested property for the software component is no longer valid due to the change in the ROMP status for a software component;

based on the at least one ROMP attested property for the software component being no longer valid, initiating a remedial action to prevent interaction of the software component with a relying party computer system, the remedial action comprising blocking a communication from the software component; and

permit communication by the software component after expiration of the validity time period.

8 . The method of claim 7 , wherein the remedial action also comprises suspending one or more processes corresponding to the software component.

9 . The method of claim 8 , further comprising resuming the one or more processes after expiration of the validity time period.

10 . The method of claim 7 , wherein the remedial action also comprises terminating one or more processes corresponding to the software component.

11 . The method of claim 7 , wherein the remedial action also comprises

initiating obtaining a new attestation report.

12 . The method of claim 7 , wherein the remedial action also comprises notifying the relying party computer system.

13 . A hardware storage device that stores computer-executable instructions that are executable by a processor to cause a computer system to at least: identify a change in a read-only memory protection (ROMP) status for a software component loaded at the computer system;

determine that a validity time period of an attestation report is unexpired, the attestation report comprising one or more attested properties, including one or more ROMP attested properties for read-only protected memory allocated to the software component;

determine that at least one ROMP attested property for the software component is no longer valid due to the change in the ROMP status for a software component;

based on the at least one ROMP attested property for the software component being no longer valid, initiate a remedial action to prevent interaction of the software component with a relying party computer system, the remedial action comprising blocking a communication from the software component; and

permit communication by the software component after expiration of the validity time period.

14 . The hardware storage device of claim 13 , wherein the remedial action also comprises suspending one or more processes corresponding to the software component.

15 . The hardware storage device of claim 14 , wherein the computer executable instructions are also executable by the processor to cause the computer system to resume the one or more processes after expiration of the validity time period.

16 . The hardware storage device of claim 13 , wherein the remedial action also comprises terminating one or more processes corresponding to the software component.

17 . The hardware storage device of claim 13 , wherein the remedial action also comprises initiating obtaining a new attestation report.

18 . The hardware storage device of claim 13 , wherein the remedial action also comprises notifying the relying party computer system.

Assignments (1)

Priority Claims (1)

Continuity (1)

References Cited (24)