Microsoft Technology Licensing, LLC

Other

Chandan Rama Reddy

Kahren Tevosyan

Ashok Chandrasekaran

Mark Eugene Russinovich

Peter Alexi Gurevich

Brian Scott Lounsberry

Alaa H Abdelhalim

Manoj Krishna Ghosh

Richard Thomas Russo

Roger Duncan Seielstad

Aaron Matthew Tyler

Vyom P Munshi

Chuang Wang

Chetan S Shankar

Pavel Zakharov

Abhishek Pratap Singh Chauhan

Abhinav Bose

Hieu Trung Nguyen

Srinivas S Nidadavolu

Various methods and systems are provided for autonomous orchestration of secrets renewal and distribution. A secrets management service ('SMS') can be utilized to store, renew and distribute secrets in a distributed computing environment. The secrets are initially deployed, after which, SMS can automatically renew the secrets according to a specified rollover policy, and polling agents can fetch updates from SMS. In various embodiments, SMS can autonomously rollover client certificates for authentication of users who access a security critical service, autonomously rollover storage account keys, track delivery of updated secrets to secrets recipients, deliver secrets using a secure blob, and/or facilitate autonomous rollover using secrets staging. In some embodiments, a service is pinned to the path where the service's secrets are stored. In this manner, secrets can be automatically renewed without any manual orchestration and/or the need to redeploy services.

Autonomous secrets renewal and distribution

Various methods and systems are provided for autonomous orchestration of secrets renewal and distribution across scope boundaries. A cross-scope secrets management service ('SMS') can be utilized to store, renew and distribute secrets across boundaries in a distributed computing environment such as regional boundaries. In some embodiments, locally scoped secrets management services subscribe to receive updates from the cross-scope secrets management service. As secrets are renewed, they are automatically propagated to a subscribing local scope and distributed by the local secrets management service. In various embodiments, SMS can autonomously rollover storage account keys, track delivery of updated secrets to secrets recipients, deliver secrets using a secure blob, and/or facilitate autonomous rollover using secrets staging. In some embodiments, a service is pinned to the path where the service's secrets are stored. In this manner, secrets can be automatically renewed without any manual orchestration and/or the need to redeploy services.

Autonomous cross-scope secrets management

Aspects of the technology described herein enable a client device to access a web service in a claims-based identity environment thorough an Internet Protocol (IP) address, rather than the web service's domain name service (DNS). In a claims-based identity environment, a client device will authenticate a relying party's server SSL certificate before providing the token to the relying party by following an authentication process. Current authentication processes include a name-chaining operation, which compares a subject field of a token provided with the Uniform Resource Identifier (URI) used to request the resource (e.g., RP application). When the IP address is used as the URI, then the URI in the certificate will not match the URI in the request and the authentication will fail. Accordingly, aspects of the technology use an alternative authentication method that allows access to a web service through an IP address, when the default client-side token validation is DNS-name based.

Relying party certificate validation when client uses relying party's IP address

Various methods and systems are provided for autonomous management for a managed service identity. A first token request, for a secret, is generated at a managed service. The secret supports authenticating the managed service for performing operations in a distributed computing environment. The first token request includes an identity identifier of the managed service. The first token request is communicated to a credentials manager which is associated with a secrets management service ('SMS') that can be utilized to store, renew and distribute secrets in the distributed computing environment. Based on communicating the first token request to credentials manager, the token is received, via the credentials manager, from the secret token service. The token is received based in part on the credentials manager generating a second token request for the token and communicating the second token request and a secret associated with the managed service to the secret token service.

Autonomous secrets management for a managed service identity

Described herein are various principles for operating transfer protocols using adaptive flow control techniques. In accordance with some of these principles, a client may adaptively negotiate with a server regarding a window size to use when communicating datagrams using a connectionless content unit transfer protocol like the Trivial File Transfer Protocol (TFTP). In some implementations, a client may inform a server whether to increase or decrease a window size. In these implementations, the client may increase the window size upon determining that a previous window size has led to successful transfer of content without any loss of datagrams and the client may decrease the window size upon detecting a loss of a datagram. Because of the limited resources available in some environments in which these techniques may be used, in some implementations a window size may be increased by small amounts but may be decreased drastically upon detecting a loss.

Client-adjustable window size for connectionless transfer protocols

Described herein are various principles for operating a connectionless content unit transfer protocol to transmit content of a content unit to multiple clients using a shared buffer. A server may transfer content of one or more content units to each of multiple clients upon request from the client using individual buffers. For each content unit being transferred, the server may maintain a count of the aggregate size of buffers for transferring content of that content unit. If the server determines that the aggregate size of the buffers transmitting a particular content unit is larger than the content unit itself, the server may establish a shared buffer for transferring that content unit to clients. A server using a shared buffer in this manner may transfer content of the content unit to clients using the shared buffer until all requesting clients have received the content unit.

Shared buffer for connectionless transfer protocols

Growing community of inventors

Redmond, WA, United States of America

Chandan Rama Reddy