Microsoft Technology Licensing, LLC

Brian Kress

Matthias Adam Leibmann

Bradford R Clark

Ayla Kol

James Charles Kleewein

Dmitri Gavrilov

Frank Byrum

Mayank Mehta

Chandresh Kumar Jain

Michael Nelte

Ladislau Conceicao

Chris Barnes

Greg Gourevitch

Vadim Eydelman

Jason Todd Henderson

Andrew Salamatov

Gregory Irving Thiel

John Hillary Zybura

Lei Yu

Geeman Yip

Neil K Koorland

Jing Wu

Herman John Man

Moustafa Noureddine

Haibo Luo

An email security system is described that allows users within different organizations to securely send email to one another. The email security system provides a federation server on the Internet or other unsecured network accessible by each of the organizations. Each organization provides identity information to the federation server. When a sender in one organization sends a message to a recipient in another organization, the federation server provides the sender's email server with a secure token for encrypting the message to provide secure delivery over the unsecured network.

Secure message delivery using a trust broker

A web extension authenticates a user using a token based authentication scheme. A token is retrieved from a client application to authenticate the user. The web extension transmits the token to a server component to have the server component authenticate the user. The server component validates the token using a validation library. The user is mapped to the token and authenticated upon validating the token.

Authenticating user through web extension using token based authentication scheme

Online and on-premise applications identify trusted authentication providers. The applications are configured with a list of trusted issuers of authentication credentials. When an application receives a request requiring authentication, the application returns a 401 response that includes the trusted issuer list. The requesting application compares the trusted issuer list from the 401 response to its own list of authentication providers. If there is a match between the two lists, then the requesting application creates a self-issued token for the authentication provider. The authentication provider uses the self-issued token to generate an authentication token for the requesting application. The requesting application may also directly create a token for a target partner application, without an authentication provider, if there is a direct trust between the two applications.

Integrating server applications with multiple authentication providers

A data replication mechanism is proposed that relies on existing federation infrastructure enabling distributed authentication instead of storing and using explicit credentials for a remote forest. The data replication mechanism requests a federation token with data replication capabilities targeted to the remote forest and passes this token to the remote forest in lieu of explicit credentials.

Federated authentication for mailbox replication

Optimizations for data transmission may be provided. A portion of a data block may be read into a batch by a read thread on a first server. The batch may be passed to a transmission thread. The transmission thread may then transmit the first batch to a second server while the read thread asynchronously reads a second portion of the data block into another batch.

Massive structured data transfer optimizations for high-latency, low-reliability networks

A data resiliency layer provides manageable data resiliency policy options for email related applications. Through one or more APIs such applications are enabled to query whether a data resiliency policy is satisfied for a given mailbox or database at a given point in time. Email related applications may consume this information to modify their behavior such as to wait, repeat, or fail the actions at hand to the point where data committal is guaranteed to a degree specified by the data resiliency policy.

Policy driven distributed data resiliency

A method and system for managing and applying entitlements is described herein. An identity integration server centrally manages data associated with entitlements for a plurality of identities. The integration server may select one of a plurality of workflows. One or more of a plurality of entitlements to be used in the workflow are selected, and a set of identities for which the workflow is applicable is selected. A determination is made as to whether the workflow should be run on the identities. If so, then the workflow is initiated. The one or more entitlements are then added to a granted entitlements list. Then, a separate process may be initiated to apply the one or more entitlements to the one or more identities.

Management and application of entitlements

Growing community of inventors

Woodinville, WA, United States of America

Brian Kress