Microsoft patents stricter rules for how computers store login keys
This filing describes a method for handling digital login credentials, known as security tickets, on a computer. It restricts these credentials to specific types of memory and limits how many times they can be used before they expire. The system also prevents the credentials from being saved to permanent storage or reused after they have been invalidated.
In the filing’s own words
Some embodiments provide or utilize technology which increases the security of network authentication operations, such as Kerberos operations, New Technology LAN Manager operations, or other network authentication operations which utilize security tickets or security tokens or both. In some embodiments, a user machine (also known as a client machine) receives an authentication data structure (ADS) which includes one or more security tickets or security tokens or both. Embodiments constrain the ADS according to at least one security requirement, such as a volatile-memory-only constraint, a secured-memory-only constraint, or a multilayer encryption constraint. Embodiments also transmit the ADS from the machine as a part of performing the network authentication service. Some embodiments inhibit virtual memory, or memory dumping, or both. Some embodiments bind the ADS to the user machine, and some embodiments limit ADS usage counts.
What exactly they claim (claim 1)
1. A computing system comprising: a machine comprising a digital memory including volatile storage and non-volatile storage; and at least one processor in operable communication with the digital memory, wherein the at least one processor is configured to: receive an authentication data structure (ADS) at the machine, the ADS comprising at least one of a security ticket or a security token; constrain the ADS according to a security requirement by: preventing storage of the ADS in the non-volatile storage of the machine while the ADS resides on the machine; and restricting use of the ADS to a limited number of authentication operations; enforce a lifecycle constraint for the ADS by limiting availability of the ADS on the machine to a period during which the ADS resides on the machine subject to the security requirement and rendering the ADS unusable after at least one of: (i) completion of an authentication operation using the ADS; or (ii) satisfaction of the limited number of authentication operations; prevent reuse of the ADS after the ADS has been rendered unusable; and transmit the ADS from the machine as part of performing a network authentication service.
Facts
- Company
- Microsoft (Microsoft Technology Licensing, LLC)
- Official title
- NETWORK AUTHENTICATION SERVICE SECURITY
- Publication number
- US20260281097A1
- Application number
- 19682122
- Filed
- May 19, 2026
- Published
- Sep 17, 2026
- Inventors
- 7
- Claims
- 20
Classified under
H04L 63/0807 Electricity & electronicsMore from Microsoft in Security & privacy
- Microsoft patents system to call 911 for others during video calls Sep 22, 2026
- Microsoft patents system to block fake code suggested by AI Sep 15, 2026
- Microsoft patents one-way data flow to block network attacks Sep 10, 2026
- Microsoft patents voice coding that hides speaker identity for secure calls Sep 17, 2026
- Microsoft patents security checks for AI chats using user and model profiles Oct 1, 2026
Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.