Microsoft Technology Licensing, LLC

Alain Franck Gefflaut

Hari R Pulapaka

Arun Upadhyaya Kishan

Todd R Manion

Chen Zhao

Sandeep Singhal

David Bradley Probert, Jr

Richard K Neves

Emily Nicole Wilson

James A Schwartz, Jr

Alex Bendetov

Andrey Shedel

Jeroen Vanturennout

Jon Robert Berry

Arsalan Ahmad

Ranjib Singh Badh

Pedro Miguel Sequeira De Justo Teixeira

Eyal Axelrod

Yuanquan Zhang

Jason Randall Wadsworth

Qian Liu

William Dunlap

Innokentiy Basmov

Scott Daniel Anderson

David John Linsley

Alex Mark Semenko

Richard Allen Pletcher

James Anthony Schwartz, Jr

Gregory John Colombo

Malcolm James Smith

Kinshuman Kinshumann

Michael J Grass

Wolfgang Manousek

Alexandre De Baynast

James Aaron Holmes

Andreas Steinmetzler

Zhou Wang

Satnam Singh

Andrew W Harper

Thomas Santen

Aaron M Farmer

Mark Livschitz

Troy E Shaw

James A Schwartz Jr

John Robert Berry

Arsalan Ahmad Aachen

Laurent Bussard

Systems, methods, and apparatus for separately loading and managing foreground work and background work of an application. In some embodiments, a method is provided for use by an operating system executing on at least one computer. The operating system may identify at least one foreground component and at least one background component of an application, and may load the at least one foreground component for execution separately from the at least one background component. For example, the operating system may execute the at least one foreground component without executing the at least one background component. In some further embodiments, the operating system may use a specification associated with the application to identify at least one piece of computer executable code implementing the at least one background component.

Decoupling background work and foreground work

A service control manager manages one or more services on a computing device, such as creating processes that host the services, stopping the processes that host the services, and so forth. The service control manager also provides a request to a resource manager to reserve, monitor, and/or place limitations on resources for each of the one or more services. For example, the service control manager can request to be notified when resource usage by a service exceeds a resource usage threshold value. These resources are various resources of the computing device, such as a processor (CPU), memory, storage device input/output (I/O), network usage, and so forth. If the usage of a resource by a service satisfies the resource usage threshold value for that resource for that service, then the resource manager notifies the service control manager so the service control manager can take an appropriate remedial action.

Resource management for services

In one embodiment, an application modulemay adjust a synchronization schemebased on the operational state of a computing deviceAn operating systemmay determine an operational state for a computing deviceThe operating systemmay assign a synchronization allotmentto the application modulebased on the operational state. A synchronization engineof the application modulemay implement a synchronization schemebased on the synchronization allotment

Adaptive data synchronization

Various embodiments provide techniques and devices for implementing a self-described security model for sharing secure resources between secure applications. In some examples, a trustlet can include a self-described policy defining capabilities of the trustlet and/or membership in a scenario group managed by a signing authority. Further, the trustlet can include a code signature signed by the signing authority. Additionally, a proxy kernel can allow the trustlet to share application data with other trustlets in the scenario group based on the policy and the code signature without exposing the application data to compromised system software and/or unauthorized applications.

Self-described security model for resource access

Protecting secured boot secrets while starting an operating system. Embodiments include identifying that a second operating system is to be started to replace a first operating system, and loading code of the second operating system in a protected portion of the system memory. The protected portion of the system memory is then unprotected, and processor state is set to initiate execution of the code of the second operating system, while using one or more secured boot secrets that were stored in the protected portion of the system memory by the first operation system to attest a security status of the second operating system. The portion of the system the memory is re-protected, including preventing access to the portion of the system memory by the second operating system.

Protection of secured boot secrets for operating system reboot

Controlling background activity in a computing device or system during a low-power mode is described. In some example techniques, when a computing device or system is in a low power mode, a determination is made whether to block one or more trigger events from causing an activation of one or more respective background task operations. Based at least in part on the determination, at least one trigger event may be allowed to cause an activation of a respective background task operation during the low power mode.

Selective blocking of background activity

Among other things, one or more techniques and/or systems are provided for controlling resource access for background tasks. For example, a background task created by an application may utilize a resource (e.g., CPU cycles, bandwidth usage, etc.) by consuming resource allotment units from an application resource pool. Once the application resource pool is exhausted, the background task is generally restricted from utilizing the resource. However, the background task may also utilize global resource allotment units from a global resource pool shared by a plurality of applications to access the resource. Once the global resource pool is exhausted, unless the background task is a guaranteed background task which can consume resources regardless of resource allotment states of resource pools, the background task may be restricted from utilizing the resource until global resource allotment units within the global resource pool and/or resource allotment units within the application resource pool are replenished.

Background task resource control

Protecting secured boot secrets while starting an operating system. Embodiments include starting a first operating system using a trusted computing base, protecting a portion of the system memory to prevent access to the portion of the system memory by the first operating system, and storing secured boot secrets in the protected portion of the system memory. Based at least on identifying that a second operating system is to be started to replace the first operating system, embodiments include configuring one or more memory data structures, including code of the second operating system, in the protected portion of the system memory. The protected portion of the system memory is unprotected, while mitigating attacks on the portion of system memory, and processor state is set to execute the code of the second operating system. The second operating system starts using the secured boot secrets stored in the portion of the system memory.

Embodiments of the disclosure provide access to data in a compressed container through dynamic redirection, without storing decompressed data in persistent memory. The compressed container is stored in a first portion of memory. User data and reference files, with redirect pointers, for accessing corresponding files in the compressed container are stored in a second portion of memory. A command to access data is detected by a computing device. The redirect pointer in the reference file associated with the command redirects access to the corresponding compressed version of data stored in the compressed container. The corresponding accessed compressed version of data is decompressed on the fly and provided in response to the command without storing the decompressed data in persistent memory. Some embodiments provide integrity protection to validate the data coming from the compressed container.

Accessing data in a compressed container through dynamic redirection

In one embodiment, an application modulemay adjust a synchronization schemebased on the operational state of a computing device. An operating systemmay determine an operational state for a computing device. The operating systemmay assign a synchronization allotmentto the application modulebased on the operational state. A synchronization engineof the application modulemay implement a synchronization schemebased on the synchronization allotment

Embodiments related to automatically adjusting wireless network settings based upon utilization of a wireless network link by applications are disclosed. For example, one disclosed embodiment provides a method of adjusting a wireless networking setting for a wireless network link. The method includes monitoring data flow through a network interface controller to collect, for each of one or more applications running on the computing device and communicating over the wireless network link, flow performance data comprising information regarding an amount of data flow arising from the application. The method also includes monitoring link data comprising information regarding data being sent and received over the wireless network link, and based upon the flow performance data and the link data, controlling a network interface controller to adjust the wireless networking parameter to change a configuration of the network link.

Application-driven control of wireless networking settings

Systems, methods, and apparatus for separately managing foreground work and background work. In some embodiments, an operating system may identify at least one foreground component and at least one background component of a same application or different applications, and may manage the execution of the components differently. For example, the operating system may receive a request that at least one background component of an application be executed in response to at least one event. In response to detecting an occurrence of the at least one event, the operating system may determine whether at least one first condition set by the application is satisfied and whether at least one second condition set by the operating system is satisfied, and may execute the at least one background component when it is determined that the at least one first and second conditions are satisfied following the occurrence of the at least one event.

Event aggregation for background work execution

Growing community of inventors

Kirkland, WA, United States of America

Alain Franck Gefflaut