Microsoft Technology Licensing, LLC

Brian J Guarraci

Johnson T Apacible

Christopher M White

Sean P Nolan

Jeffrey Dick Jones

Vijay Varadan

Pasquale DeMaio

Tanmoy Dutta

Andrew J Ritz

Niels Thomas Ferguson

John D Vert

Gennady Medvinsky

Arthur Baker

Geoffrey John Elliott

Aarthi Natarajan

Edward H Wayt

Christopher Cameron White

Andrew Stewart Tucker

Arthur H Baker

A computer related security mechanism requires that a human participate in an access verification sequence. Upon a request to access secure data, a puzzle is provided to the requester. Proper solution of the puzzle requires human participation. The puzzle is chosen such that its solution is within the capabilities of a human, but beyond the current state of the art for computer systems. The puzzled can be visually and/or audibly rendered to the user. In one configuration, the puzzle is obtained via a library of pluggable puzzle generators. Puzzle generators in the library can be replaced as the state of the art of computing technology improves.

Secure data storage and retrieval incorporating human participation

Systems and methodologies that facilitate delegation of keyset management to a platform presenting a centralized health-related data repository are provided. Effectively, a central keyset manager is provided that generates, manages and distributes key material to client applications and servers deploying the platform. Thus, communications with the platform storing sensitive health-related data can be secured without incurring the costs associated with implementing and enforcing policies associated with key generation and expiration among a plurality of servers and client applications. Additionally, the innovation can scale keyset management to meet short term demand needs.

Health keyset management

An authorization framework is provided that protects data records in a platform, such as a service-based platform, by requiring multiple level entities to be authorized with respect to the data records. For example, the data records can have an associated owner user that can grant access to other users with respect to the data. Additionally, however, the user can also grant access to certain applications that access the platform such that the data records can be initially closed for a user requiring the user to explicitly grant desired access to applications and/or users. In this regard, applications can be forbidden from accessing the data, even on behalf of the user, unless expressly authorized to do so by the user. Thus, the user can make informed decisions regarding who is to have access to its data.

Multiple entity authorization model

Systems and methods are provided for instrumenting compiled software to include diagnostic information such that an origin of a call to one or more routines may be more easily identified. For example, a system is provided which unassembles or uncompiles software into a more readily identifiable instructional form, which is then searched to identify various calls to various routines of interest. Portions of the identified calls are then modified with diagnostic information that will identify the call. This diagnostic information and the call are then recorded so that the call may be subsequently traced back to its origin when, for example, an error occurs.

Instrumenting software for enhanced diagnosability

An authentication mechanism is provided for a web method platform that allows homogeneous access for different types of clients according to a bootstrapping procedure utilized to establish the session. Different clients can be assigned different levels of trust based in part on the bootstrapping procedure and/or information provided during the procedure. The bootstrapping procedure can produce a token that is used by the clients in subsequent requests to provide previous authentication or state information to the platform. The token can comprise a shared secret used to ensure integrity of communications in some cases, and the token can be opaque to the client. Tokens can expire and require a client to re-bootstrap to provide higher levels of authentication protection, and tokens can be shared among a plurality of application servers to facilitate effective handling of requests in a farmed environment.

Unified authentication for web method platforms

Ordered list management is described. An item's position within an ordered list is represented by a path value. A globally unique identifier (GUID) is appended to the path value to enable simultaneous or near-simultaneous modifications to the ordered list without conflict. Furthermore, an ordered list-specific seed value may be prepended to each item's path value to ensure clustering of ordered list items when two or more ordered lists are merged.

Ordered list management

Methods, systems, and computer program products for remotely monitoring diverse computer systems in a similar manner over an out-of-band communication channel. Remote monitoring ordinarily is performed over an in-band communication channel. However, hardware and/or software problems may make the in-band communication channel unavailable for a time. While the in-band communication channel is unavailable, the management computer receives status information over the out-of-band communication channel. Based on received status information, the management computer identifies actions to take, such as controlling processes or otherwise configuring the remote computer system, and communicates the actions to the remote computer system over the out-of-band communication channel. The management computer is capable of communicating with any of several diverse computers and exchanges data in a format that is independent of any particular computer system. The format also separates status information from placement information used to display the status information, and may conform to an XML schema.

Growing community of inventors

Redmond, WA, United States of America

Brian J Guarraci