Microsoft Technology Licensing, LLC

Other

Empire Technology Development LLC

Alexander Frank

William Jefferson Westerinen

Thomas G Phillips

Zhangwei Xu

Curt Andrew Steeb

James Duffus

Martin D Hall

Mark Curtis Light

Todd L Carpenter

Neta Amit

Eric J Horvitz

Aidan T Hughes

Scott C Forbes

Johannes Klein

Mark L Kenworthy

Paul C Sutton

Christopher Allen Schoppa

Ruston John David Panabaker

Shon Schmidt

Isaac P Ahdout

Stephen Richard Drake

Oliver Szimmetat

Nicholas Temple

Alexander V Baxter

Paul England

Michael Jack Sinclair

Shai Guday

Adrian Mark Chandley

Miller Thomas Abel

Jeffrey Alan Herold

David Jay Foster

Gregory P Baribault

Bohdan W Raciborski

Zeyong Xu

Martin Holladay

Jack Creasey

Rajagopal Venkatachalam

Meir Shmouely

Robert Ian Oliver

Egor Nikitin

Tse-Ching Yu

George V Reilly

Yifat Peled

Thomas C Phillips

Rahul Shah

Richard B Thompson

Wiliam Jefferson Westerinen

Thomas G Phillps

Yannis Dosios

A method for validation and prediction of cloud readiness is described. Method includes identifying a sample of components from a cloud infrastructure, wherein an update is applied to the sample to generate a treated sample and the treated sample is of a statistically sufficient scale and a relevant cloud-level diversity and identifying a control sample of components from the cloud infrastructure, wherein the control sample is statistically comparable to the treated sample. The method also includes executing a set of workloads on the treated sample and the control sample. Further, the method includes predicting an impact of the update on a user experience based on a comparison of telemetry captured during execution of the set of workloads on the treated sample and the control sample.

Validation and prediction of cloud readiness

Techniques are described for generating a license for software installed on a device. An entitlement certificate is generated including one or more entitlements describing license characteristics of the software. The one or more entitlements are determined in accordance with first information about the software. The first information includes at least one of a purchase token and package information. A binding certificate in accordance with a binding type for the software is generated. A license in accordance with said binding certificate and said entitlement certificate is generated. The binding certificate identifies an entity to which the license is bound.

Activation system architecture

Technologies are generally described for a system for migrating an application between cloud environments such as datacenters. In some examples, an application hosted at a source cloud may be moved from the source cloud to the destination cloud by migrating one or more objects at a time from the source to the destination cloud while maintaining the application up and running by intercepting and redirecting requests to a source or destination depending on where related objects reside. Example objects may be data structures, attributes and associated behaviors that encapsulate the application. Migration of the objects may be facilitated by enumerating and serializing the objects, and loading subsets of one or more serialized objects at the destination datacenter. An object migration module may keep track of objects in transit, and may direct requests for transferred objects to the destination cloud for maintaining continued access to the application.

Object migration between cloud environments

The present invention includes entity tracking, privacy assurance, and zone policy administration technologies allowing for the creation of zone policies, including the definition of zones and managed entities, the zone policies including rules that apply to the managed entities within or in relation to the zones, and privacy policies assuring privacy of sensitive data. The technologies also provide for the definition of sensors, rule event objects, and default event objects, and for the establishment of associations between rules and managed entities, sensors, and rule event objects so as to create zone policies. Event objects may generate zone policy events or actions upon compliance with or violation of various rules of zone policy. Managed entities are defined as entities associated with mobile devices capable of location tracking and communication with zone policy servers. Entities may be persons, vehicles, animals, or any other object for which tracking and zone policy administration is of value. Zone policy may include privacy policy that may restrict access to or set access conditions for data or information. Privacy policies may be used to ensure individual managed entities and their data remain anonymous to a desired degree and that sensitive data is appropriately protected.

Zone policy administration for entity tracking and privacy assurance

A virtual machine monitor provides a trusted operating environment for a software usage metering application when a qualified virtual machine monitor is loaded as part of trusted boot and when all other programs and operating systems run in containers managed by the virtual machine monitor. The virtual machine monitor may also host a locking application for limiting the functionality of the computer if contractual terms of use are not met. Both the metering and locking applications run at a higher privilege level than ring 0, at the same level as the virtual machine monitor.

Virtual machine support for metered computer usage

A computer is adapted for pay-for-use operation by adding a isolated computing environment to a standard computer. The isolated computing environment may include a trusted non-volatile memory, a digital signature verification capability, a clock or timer and a logic circuit for triggering execution of a validation program responsive to the clock or timer. The isolated computing environment may be protected from tampering by physical or cryptographic mechanisms, or both. The validation program measures or monitors for non-compliant states of the computer and may enforce sanctions when non-compliant states of the computer are detected.

Isolated computing environment anchored into CPU and motherboard

A method and apparatus provide for performing language translation by obtaining a selection of a language preference for presentation of text and/or speech on an electronic device. When data is received that includes content in a language other than the preferred language, a decision whether translation is required may be reached by analyzing the context of the language or metadata associated with the language, such as. HTML tags, or language data included in a particular protocol, e.g. HTTP headers. A selection may be made of billing level, determined at least in part by the languages involved, desired accuracy, latency and volume of translation. If necessary, the data may be routed to a translation host or service before final presentation.

Integrated native language translation

An electronic device, such as, a computer, may be adapted for self-monitoring for compliance to an operating policy. The operating policy may specify a pay-per-use or subscription business model and measurements associated with compliant usage. A secure execution environment may measure usage in accordance with the business model as well as monitor and enforce compliance to the operating policy. To increase the difficulty of attacking or otherwise disabling the secure execution environment, elements of the secure execution environment may be distributed. The distribution points may include other functional elements of the computer, such as interface circuits, or may even be remotely located over a network. An implementation method for disaggregating the secure execution environment is also disclosed.

Disaggregated secure execution environment

A system and method for monitoring a computer, particularly a pay-per-use computer, uses an isolated computing environment or supervisor. The isolated computing environment boots prior to any boot device associated with an operating system, runs concurrently with the operating system and monitors and measures the computer in operation. Once the isolated computing environment determines the computer is not in compliance with the required policies, the isolated computing environment may either impose an impediment to use such as slowing clock speed or completely disable the operating system. The user may have to return the computer to a service provider to restore it from the offending condition and reset the computer to an operational state.

Special PC mode entered upon detection of undesired state

A computer network firewall or network filter functions normally to pass data on open ports to a respective service or data source associated with an open port. In addition, traffic arriving on closed ports may be directed to a handler for analysis and response. The handler may analyze and catalog the source and type of traffic arriving on the closed ports. The handler may then send a response with either a fixed response or data tailored to the type and nature of the traffic. The handler may respond slowly to cause the source of the traffic to wait for the response, thereby slowing the speed at which a potential attacker can identify valid targets and proceed past non-valid targets.

Leveraging active firewalls for network intrusion detection and retardation of attack

Described is an independent computation environment that is built into one or more hardware components of a computer system, wherein the independent computation environment hosts a logic that measures the health of other software code that executes in memory. Examples of ways to measure health include performing a mathematical computation such as a computing a hash/digital signature on the software code in the memory, and/or evaluating statistical information related to the execution of the code and/or the code's being loaded into memory. By executing the logic in an independent computation environment, the health of software code may be measured against policy/metadata in a tamper-proof or tamper-resistant environment. When the software code measurement does not comply with the policy, some action may be taken action to penalize the computer system.

Hardware-aided software code measurement

A pay-per-use or pay-as-you-go computer uses a secure memory to store individual unique program identifiers. Each unique program identifier is associated with a particular hardware or software component, or service, or the entire computer available to a user. By combining the unique program identifier with a computer hardware identifier uniquely identified transactions may be tracked for both billing and reconciliation. Certificates associated with each unique program identifier, and coupled to the hardware identifier, provide a cryptographic basis for mutual verification of messages, requests, configuration instructions, and provisioning.

Binding a device to a provider

A pay-per-use computer, or other electronic device that uses local security, may use a security module or other circuit for monitoring and enforcement of a usage policy. To help prevent physical attacks on the security module, or the circuit board near the security module, a second circuit may be mounted over the security module to help prevent access to the security module. Both circuits may be mounted on a interposer and the interposer mounted to the circuit board, creating a stack including the first circuit, the interposer, the security module, and a main PC board. When the PC board includes dense signal traces under the security module a three dimensional envelope is created around the security module. When the first circuit is a high value circuit, such as a Northbridge, the risk/reward of attacking the security module is increased substantially and may deter all but the most determined hackers.

Enhanced packaging for PC security

A security module for a pay-per-use computer supplies an appropriate BIOS for a given mode of operation. A power manager in the security module powers only essential circuits until the BIOS is operational to help prevent substitution of a non-authorized BIOS. The security module also includes a capability to monitor and restrict data lines on a bus between a main computer processor and computer system memory. When the computer is operating in a restricted use mode, data lines may be restricted to allow only minimal access to the computer system memory. Bus transactions may be monitored to ensure that only valid transactions are occurring and are within the designated memory space.

Computer compliance enforcement

Growing community of inventors

Bellevue, WA, United States of America

Alexander Frank