Microsoft Technology Licensing, LLC

Charles Glenn Jeffries

Hari R Pulapaka

Benjamin M Schultz

Carl Melvin Ellison

Frederick Justus Smith

Giridhar Viswanathan

Vijay G Bharadwaj

Arindam Chatterjee

Nils Dussart

Cristian Marius Ilac

Octavian Tony Ureche

Rui Chen

Innokentiy Basmov

Randall Knight Winjum

Neelamadhaba Mahapatro

Ricardo Soares Stern

Nakul Garg

Michael J Grass

Matthew Charles Setzer

Gaurav Sinha

Michael Wilde

Barry Gerhardt

Doug Coburn

Ling Tony Chen

Stefan Thom

Niels Thomas Ferguson

Anders Samuelsson

Parul Manek

Nathan T Lewis

Roberto C Taboada

Lars Reuther

Ganesh Pandey

Gerardo Diaz Cuellar

Scott Daniel Anderson

David John Linsley

David Bradley Probert, Jr

Poornananda R Gaddehosur

Ivan Dimitrov Pashov

Magnus Bo Gustaf Nyström

Kameshwar Jayaraman

Kinshumann Kinshumann

Margarit Simeonov Chenchev

Michael A Halcrow

Ankit Srivastava

Michael Bishop Ebersol

Son VoBa

Kinshumann

Amit Raghunath Kulkarni

Steven Mark Silverberg

Navin Narayan Pai

JianMing M Zhou

Stuart Kwan

David Guy Weston

Kartik Tirunelveli Kanakasabesan

Daniel John Carroll, Jr

Shefali Gulati

Vikram Mangalore Rao

Jianming Zhou

Access to data and resources in a multi-tenant computing system is managed by tagging the data and resources with attributes, as well as by tagging users with attributes. Tenant-specific access policies are configured. When an access request is received from a workload, a policy decision engine processes the attributes that are tagged to the requesting workload (e.g., user, application, etc.) as well as those tagged to the requested data or resource, given a relevant tenant-specific policy. An access decision is provided in response to the access request, and the access decision can be enforced by a tenant-specific enforcement system.

Controlling access to cloud resources in data using cloud-enabled data tagging and a dynamic access control policy engine

A host operating system running on a computing device monitors resource access by an application running in a container that is isolated from the host operating system. In response to detecting resource access by the application, a security event is generated describing malicious activity that occurs from the accessing the resource. This security event is analyzed to determine a threat level of the malicious activity. If the threat level does not satisfy a threat level threshold, the host operating system allows the application to continue accessing resources and continues to monitor resource access. When the threat level satisfies the threat level threshold, the operating system takes corrective action to prevent the malicious activity from spreading beyond the isolated container. Through the use of security events, the host operating system is protected from even kernel-level attacks without using resources required to run anti-virus software in the isolated container.

Isolated container event monitoring

A host operating system running on a computing device monitors network communications for the computing device to identify network resources that are requested by the computing device. The host operating system compares requested network resources against security policies to determine if the requested network resources are trusted. When an untrusted network resource is identified, the host operating system accesses the untrusted network resource within a container that is isolated from the host operating system kernel using techniques discussed herein. By restricting access to untrusted network resources to isolated containers, the host operating system is protected from even kernel-level attacks or infections that may result from an untrusted network resource.

Hardware-based virtualized security isolation

Techniques for isolating a portion of an online computing service referred to as a deployment unit and configured with a complete build of the online computing service may include routing production traffic away from the deployment unit, applying one or more changes to the complete build, and after applying one or more changes to the complete build, using the deployment unit for testing these changes using end-to-end tests. In one embodiment, the deployment unit may be dedicated to a specific group of tenants that require at least some isolation from other tenants.

Isolating a portion of an online computing service for testing

Facilities are provided to secure guest runtime environments (GREs). Security policy specifications may be associated with GREs. A GRE's security policy may be specific to the GRE and may also include security policy inherited from higher levels such as a host operating environment. The security policy of a GRE specifies restrictions and/or permissions for activities that may be performed within the scope of execution of the GRE. A GRE's security policy may limit what the GRE's guest software may do within the GRE. Restrictions/permissions may be applied to objects such as files, configuration data, and the like. Security specifications may be applied to execution initiated within a GRE. A GRE's security specification may restrict/permit executable objects from loading and executing within the GRE. The executability or accessibility of objects may be conditioned on factors such as the health/integrity of the GRE, the host system, requested files, and others.

Securing virtual execution environments

Techniques to isolating a portion of an online computing service are described. The following description may refer to the isolated portion as a deployment unit configured with a complete build of the online computing service. In one embodiment, after applying one or more changes to the complete build, the deployment unit may be used for testing these changes using end-to-end tests. In another embodiment, the deployment unit may be dedicated to a specific group of tenants that require at least some isolation from other tenants. Other embodiments are described and claimed.

Techniques to isolating a portion of an online computing service

Data stored on a storage medium can be referenced by multiple independently addressable active symbolic links, with each active symbolic link representing the data through a different transformation. The active symbolic links can be in the form of file system objects, such as files or directories. A single active symbolic link can reference the data stored in multiple collections, or, conversely, a subset of data from a single collection. Active symbolic links can be automatically created for common data transformations. Searching across active symbolic links referencing encrypted data can be performed by multiple protection-specific search engines, or a single search engine that can generate a protection-level aware search index.

File system active symbolic link

Single-use authentication methods for accessing encrypted data stored on a protected volume of a computer are described, wherein access to the encrypted data involves decrypting a key protector stored on the computer that holds a volume-specific cryptographic key needed to decrypt the protected volume. Such single-use authentication methods rely on the provision of a key protector that can only be used once and/or that requires a new access credential for each use. In certain embodiments, a challenge-response process is also used as part of the authentication method to tie the issuance of a key protector and/or access credential to particular pieces of information that can uniquely identify a user.

Single-use authentication methods for accessing encrypted data

A portable secure data file includes an encrypted data portion and a metadata portion. When a request associated with a current user of a device to access a portable secure data file is received, one or more records in the metadata portion are accessed to determine whether the current user is permitted to access the file data in the encrypted data portion. If a record indicates the user is permitted to access the file data, a content encryption key in that record is used to decrypt the encrypted data portion.

Portable secure data files

A security system is provided for use with computer systems. In various embodiments, the security system can analyze the state of security of one or more computer systems to determine whether the computer systems comply with expressed security policies and to remediate the computer systems so that they conform with the expressed security policies. In various embodiments, the security system can receive compliance documents, determine whether one or more computer systems comply with portions of security policies specified in the compliance documents, and take actions specified in the compliance documents to cause the computer systems to comply with the specified security policies. The security system may provide a common, unified programming interface that applications or tools can employ to verify or enforce security policies.

Security system with compliance checking and remediation

An online key stored by a remote service is generated or otherwise obtained, and a storage media (as it applies to the storage of data on a physical or virtual storage media) master key for encrypting and decrypting a physical or virtual storage media or encrypting and decrypting one or more storage media encryption keys that are used to encrypt a physical or virtual storage media is encrypted based at least in part on the online key. A key protector for the storage media is stored, the key protector including the encrypted master key. The key protector can be subsequently accessed, and the online key obtained from the remote service. The master key is decrypted based on the online key, allowing the one or more storage media encryption keys that are used to decrypt the storage media to be decrypted.

Key protectors based on online keys

A security health reporting system provides an application program interface (API) for use by independent software vendors (ISVs) to extend the security health reporting capabilities of the security health reporting system. An ISV security solution can register with the security health reporting system, create a schema that describes a new security class, and use the API to publish an instance of the schema for the new security class with the security health reporting system. When an instance of a schema for a new security class is published, the security health reporting system creates the new security class, and recognizes the definition for the security class within the security health reporting system. Registered ISV security solutions can then use the published schema to report their health statuses for the new security class.

Extensible framework for system security state reporting and remediation

Growing community of inventors

Sammamish, WA, United States of America

Charles Glenn Jeffries