Microsoft Technology Licensing, LLC

Ashish Jain

Mordhai Gendelman

Yair Tor

Aastha Jain

Parag Agrawal

Mohit Kumar Garg

Or Moran

Sandeep Bansal

Liraz Barak

Omer Kattan

Ronen Shmuel Goldsmith

Abhishek Agarwal

Smriti R Ramakrishnan

Divya Venugopalan

Sinead C O'donovan

Buyu Chen

Ankur Hayatnagarkar

Aakash Valangaiman Radhakrishnan

Jeevan Singh Bisht

Avraham Carmon

Methods, systems and computer program products are provided for intelligent secure access to private resources. A security service (e.g., SASE ZTNA) may maintain the same or similar security posture for users who work remotely and/or locally by providing authentication, authorization, and/or ongoing conditional access via a security service (e.g., private or public SASE) while intelligently routing remote client traffic to private resources through the security service and routing local client traffic to private resources locally. A traffic routing determination may be made by a security client and/or security server. A traffic routing determination may be based on the location of a client computing device, such as a trusted network detection for a private/trusted network. Traffic routing determinations may be based on conditions alternative or in addition to location, such as the type of private resource or information being accessed by a client computing device.

Intelligent secure user access to private resources

A computing system is configured to perform zero-trust domain name resolution. The computing system includes applications coupled to a zero-trust client. The zero-trust client is configured to receive requests for IP addresses corresponding to endpoint identifiers for internet connected endpoints. The zero-trust client includes a synthetic DNS service configured to identify synthetic IP addresses for the endpoint identifiers. The zero-trust client provides the synthetic IP addresses for the endpoint identifiers to the applications. The zero-trust client sends data traffic from the applications to a zero-trust service with the synthetic IP addresses where corresponding synthetic IP addresses are correlated to the endpoint identifiers at the zero-trust service.

Zero-trust DNS and FQDN based traffic acquisition using synthetic IP

Techniques of remote computing resource access using sharable links are disclosed herein. One example technique includes receiving, at a security portal of a private network, an access request from a client device of a user for accessing a virtual machine ('VM') on the private network via a public network. The technique can then include retrieving a copy of a configuration file corresponding to the virtual machine according to the VM identifier in the access request and accessing the virtual machine according to operating parameters in the retrieved copy of the configuration file to generate an execution result. The technique can further include transmitting, from the security portal, the execution result to the client device of the user via the public network, thereby shielding, with the security portal, the virtual machine on the private network from actions initiated via the public network.

Sharable link for remote computing resource access

A computing system is configured to perform zero-trust domain name resolution. The computing system includes applications coupled to a zero-trust client. The zero-trust client is configured to receive requests for IP addresses corresponding to endpoint identifiers for internet connected endpoints. The zero-trust client includes a synthetic DNS service configured to identify synthetic IP addresses for the endpoint identifiers. The zero-trust client provides the synthetic IP addresses for the endpoint identifiers to the applications. The zero-trust client sends data traffic from the applications to a zero-trust service with the synthetic IP addresses and sends corresponding endpoint identifiers to the zero-trust service in a fashion that allows the synthetic IP addresses to be correlated to the endpoint identifiers at the zero-trust service.

Techniques for tackling delayed user response by modifying training data for machine-learned models are provided. In one technique, a first machine-learned model generates a score based on a set of feature values. A training instance is generated based on the set of feature values. An attribute of the training instance is modified based on the score to generate a modified training instance. The attribute may be an importance weight of the training instance or a label of the training instance. The modified training instance is added to a training data. One or more machine learning techniques are used to train a second machine-learned model based on the training data.

Tackling delayed user response by modifying training data for machine-learned models

Techniques for using machine learning to leverage deep segment embeddings are provided. In one technique, a set of training data is processed using one or more machine learning techniques to train a neural network and learn an embedding for each segment of multiple segments. In response to receiving a request, multiple elements are identified, such as a source entity that is associated with the request, a source embedding for the source entity, a particular segment with which the source entity is associated, a segment embedding for the particular segment, and multiple target entities. For each target entity, a target embedding is identified and the target embedding, the source embedding, and the segment embedding are input into the neural network to generate output that is associated with the target entity. Based on the output, data about a subset of the target entities is presented on a computing device.

Deep segment personalization

The present disclosure relates to systems, methods, and computer-readable media for managing routing of traffic between clients and resource instances when providing stateful services. For example, systems disclosed herein involve a load balancer that routes probe request(s) from clients to corresponding resource instances having access to stateful session data for a stateful session between the resource instance(s) and corresponding client(s). The resource instances may provide instance identifiers to the clients for use in generating subsequent session calls. In this way, systems described herein ensure that subsequent session calls are passed to the correct resource instances having access to relevant session information.

Growing community of inventors

Redwood, WA, United States of America

Ashish Jain