Microsoft Technology Licensing, LLC

Brian Don Zill

Jitendra Dattatraya Padhye

Ranveer Chandra

Alastair Wolman

Paramvir Bahl

Jacob Rubin Lorch

Richard Powell Draves, Jr

Jonathan Ryan Howell

Shachar Raindel

Bryan Jeffrey Parno

Behnaz Arzani

Chris Hawblitzel

Avi William Levy

Xinchen Guo

Alireza Khosgoftar Monafared

Mahmoud S El Haddad

David G Thaler

Art Shelest

Michael Roe

Gregory O'Shea

Galen Clyde Hunt

Sharad Agarwal

Yongguang Zhang

Parveen Kumar Patel

James R Larus

Ratul Mahajan

Lenin Ravindranath Sivalingam

Bjarne Steensgaard

David Garfield Thaler, Iii

Rebecca Isaacs

David R Tarditi

Rohan Narayana Murty

Manuel A Fähndrich

Wenbiao Xing

Manpreet Singh

Li Chen

Wei Wan

Bryan Parno

Techniques are disclosed for identifying faulty links in a virtualized computing environment. Network path latency information is received for one or more network paths in the networked computing environment. Based on the network path latency information, a probable presence of a faulty component is determined. In response to the determination, physical links for a network path associated with the probable faulty component are identified. Information indicative of likely sources of the probable faulty component is received from multiple hosts of the networked computing environment. Based on the identified physical links and information, a faulty component is determined.

Link fault isolation using latencies

A verified software system may be executable on secure hardware. Prior to being executed, the software system may be verified as conforming to a software specification. First credentials attesting to an identity of the software system may be sent to an external application. Second credentials signed by a provider of the secure hardware may be sent to the external application. The second credentials may attest to an identity of the secure hardware. The external application may securely exchange one or more messages with a software application of the software system. For example, the one or more messages may be decryptable only by the external application and the software application to provide confidentiality for each message. As another example, an attestation may vouch for an identity of a sender of each of the one or more messages to attest to an integrity of each message.

End-to-end security for hardware running verified software

Software code of a software system (e.g., a software stack) may be verified as conforming to a specification. A high-level language implementation of the software system may be compiled using a compiler to create an assembly language implementation. A high-level specification corresponding to the software system may be translated to a low-level specification. A verifier may verify that the assembly language implementation functionally conforms to properties described in the low-level specification. In this way, the software system (e.g., a complete software system that includes an operating system, device driver(s), a software library, and one or more applications) may be verified at a low level (e.g., assembly language level).

Automated verification of a software system

The claimed subject matter provides a method for operating a sleep management service. The method include identifying a set of guardians based on a local state for each of a plurality of compute nodes. The method also includes sending a wake request to all sleeping compute nodes in the identified set. The method further includes sending a request to become a guardian to all compute nodes in the identified set. Additionally, the method includes stopping a current guardian from being a guardian if the current guardian is less suitable than a threshold number of current guardians.

Operating a sleep management service

Systems and methods that facilitate inter-process networking are described that can provide inter-process communication, firewall restrictions, process and host mobility, as well as parallelization of task performance. In various embodiments, a computer process can be provided with its own internet protocol address and network stack to facilitate inter-process networking. In further embodiments, a gateway process can facilitate process mobility, host mobility, and parallelization of task performance, as well as management of a host area network by facilitating inter-process communication between suitably configured processes.

Inter-process networking for many-core operating systems

Disclosed is an authentication mechanism that enables an information recipient to ascertain that the information comes from the sender it purports to be from. This mechanism integrates a private/public key pair with selection by the sender of a portion of its address. The sender derives its address from its public key, for example, by using a hash of the key. The recipient verifies the association between the address and the sender's private key. The recipient may retrieve the key from an insecure resource and know that it has the correct key because only that key can produce the sender's address in the message. The hash may be made larger than the sender-selectable portion of the address. The recipient may cache public key/address pairs and use the cache to detect brute force attacks and to survive denial of service attacks. The mechanism may be used to optimize security negotiation algorithms.

Methods and systems for unilateral authentication of messages

Wireless adapters are installed on one or more general purpose computing devices and are connected via a network in an enterprise environment. The adapters are densely deployed at known locations throughout the environment and are configured as air monitors. The air monitors monitor signals transmitted by one or more transceiver devices and records information about these signals. One or more analysis or inference engines may be deployed to obtain the recorded signal information and the air monitor locations to determine a location of the one or more wireless transceivers devices deployed in the environment.

Self-configuring wireless network location system

Described herein are one or more implementations that separate kernel interfaces functions into those that act on kernel objects owned by a process and accessed exclusively by that process&#x2014;described herein as local kernel objects&#x2014;from access to kernel objects owned by a process and accessible by other active processes.

Kernel interface with categorized kernel objects

A method of detecting rogue devices that are coupled to a wired network without generating false negative or false positive alerts is provided. When a wireless monitor detects an observed SSID and/or BSSID, various tests are run to determine whether the observed device is actually coupled to the wired network. To guard against the suspect device spoofing an authorized SSID and/or BSSID, location information is gathered so that the network administrator can pinpoint the location of the rogue device. If the device is not recognized, various other tests are run to determine whether the unrecognized device is actually connected to the wired network. These tests include an association test, a MAC address test, an ARP test, a packet replay test, a correlation test, and/or a DHCP fingerprint test. Once it is determined that the suspect device is a rogue connected to the wired network, an appropriate alert is generated.

Detection and management of rogue wireless network connections

Systems and methods for routing packets by nodes in an ad hoc network in accordance with a link quality source routing protocol are disclosed. Route discovery, route maintenance, and metric maintenance are designed to propagate and keep current link quality measurements. Metric maintenance includes a reactive approach for links that a node is currently using to route packets, and a proactive mechanism for all links. Nodes are configured to include a send buffer, a maintenance buffer, a request table, link quality metric modules, and preferably a neighbor cache and a link cache. The invention allows for asymmetric links in the network. The invention may be implemented within a virtual protocol interlayer between the link and network layers. The invention may employ any particular link quality metrics, including metrics based on probing techniques as well as metrics based on knowledge gained in other ways.

System and method for link quality source routing

Techniques for enhancing the throughput capacity available to client devices connected to a wireless local area network (WLAN) are described. Specifically, existing WLAN resources are converted into wireless access points (APs) to create a dense infrastructure of wireless APs. To leverage this dense AP infrastructure, central management techniques are employed. With client-to-AP mapping, these techniques are used to prevent the discovery of multiple APs in a WLAN by a client device and to select a single AP (using certain policies) to associate with the client device and provide it with an enhanced wireless connection to the WLAN. Additionally, techniques are employed to centrally determine, using central policies, when the AP should disassociate from the client device and when another centrally selected AP should respond to, and associate with, the client device to provide it with an enhanced wireless connection to the WLAN&#x2014;without interrupting/disrupting the client device's access.

Managing dense wireless access point infrastructures in wireless local area networks

Systems and methods are provided that enable high-performance Internet access on board moving vehicles. In an illustrative implementation, an exemplary wireless data communications environment comprises a PluriBus module, an instruction set comprising at least one instruction set to process data for wireless communication between a cooperating component onboard a moving vehicle and other cooperating wireless components, and one or more multiple wide-area wireless communications links. In an illustrative operation, the PluriBus module can perform one more wireless communications techniques comprising opportunistic erasure coding such that coded packets can be sent in the event that there are openings in the one or more wireless communication links' capacity and transmitting the data packets along the one or more wireless communications links that is estimated (e.g., in real time) to offer efficient delivery of data packets.

Inverse multiplexing heterogeneous wireless links for high-performance vehicular connectivity

Growing community of inventors

Redmond, WA, United States of America

Brian Don Zill