Microsoft Technology Licensing, LLC

Angelo Renato Vals

Scott Randall Shell

Yadhu Nandh Gopalan

Upender Sandadi

Neil Laurence Coles

Matthew G Lyons

Christopher Ross Jordan

Andrew Michael Rogers

Loren Kohnfelder

Bor-Ming Hsieh

Andrew D Rogers

Sharath Viswanathan

Chetley T Laughlin

Zoheb Vacheri

Managing threads for executing on a computing device based on a power state of the computing device. A power priority value corresponding to each of the threads is compared to a threshold value associated with the power state. The threads having an assigned power priority value that violates the threshold value are suspended from executing, while the remaining threads are scheduled for execution. When the power state of the computing device changes, the threads are re-evaluated for suspension or execution. In an embodiment, the threads on a mobile computing device are managed to maintain the processor in a low power state to reduce power consumption.

Thread management based on device power state

Embodiments provide a security infrastructure that may be configured to run on top of an existing operating system to control what resources can be accessed by an applications and what APIs an application can call. Security decisions are made by taking into account both the current thread's identity and the current thread's call chain context to enable minimal privilege by default. The current thread context is captured and a copy of it is created to be used to perform security checks asynchronously. Every thread in the system has an associated identity. To obtain access to a particular resource, all the callers on the current thread are analyzed to make sure that each caller and thread has access to that resource. Only when each caller and thread has access to that resource is the caller given access to that resource.

Granting least privilege access for computing processes

This disclosure describes techniques of using a centralized rule database to control the abilities of software processes to perform actions with regard to resources provided by a computer. As described herein, each software process executing in a computer executes within a chamber and each resource provided by the computer is associated with a canonical name that uniquely identifies the resource. Furthermore, the computer stores a set of security rules in a centralized rule database. In addition, this disclosure describes techniques of enforcing the rules stored in the centralized rule database.

Centralized enforcement of name-based computer system security rules

Growing community of inventors

Redmond, WA, United States of America

Angelo Renato Vals