Microsoft Technology Licensing, LLC

Christopher G Kaler

John Peter Shewchuk

Giovanni Moises Della-Libera

Steven E Lucco

Martyn S Lovell

Luis Felipe Cabrera

Erik B Christensen

Steven J Kruy

Stephen James Millet

Bradford H Lovering

David E Langworthy

Oliver J Sharp

Robert S Wahbe

Michael Grier

Donald F Box

David Wortendyke

David Edwin Levin

William J Ferguson

Richard L Hasha

Hervey O Wilson

Bradley Bartz

Elliot Lee Waingold

Paul J Leach

Robert George Atkinson

Richard F Rashid

Butler W Lampson

Arun K Nanda

Scott A Konersmann

Kenneth D Hardy

Gopala Krishna R Kakivaya

Henrik Frystyk Nielsen

Patrick James Helland

Allen L Brown, Jr

Alfred Lee

Saurab Nog

Douglas A Walter

Kenneth David Wolf

James Ernest Johnson

Max Glenn Morris

Jeffrey C Schlimmer

Craig Andrew Critchley

Geary L Eppley

Tomasz Janczuk

Michael Steven Vernal

Martin James Gudgin

Jomo Fisher

Max A Feingold

Siddhartha Puri

Ashish Munjal

Marvin Michael Theimer

Christian F Huitema

Stefan Thom

Daniel Ron Simon

Melissa Wood Dunn

Praerit Garg

Shaun Douglas Pierce

Satish Ramchandra Thatte

Tirunelveli R Vishwanath

Lance Olson

Richard Douglas Hill

Andrew Donald Gordon

Xin Zhang

Andrew Layman

James M Lyon

Stefan R Batres

Umesh Madan

Michael James Coulson

Stefan Harrington Pharies

Tariq Sharif

John David Doty

Michael Marucheck

Vijay Gajjala

Ferhan Elvanoglu

Uday Sooryakant Hegde

Matthew Thomas Tavis

Cedric Fournet

David Erb

Stephen T Swartz

Krishnan Srinivasan

Shy Cohen

Torsten Stein

David Garfield Thaler, Iii

Richard Dievendorff

Brian Clifford Telfer

Ning Sun

Natasha Harish Jethanandani

Douglas M Purdy

David Owen Driver

Aaron Stern

Jesus Ruiz-Scougall

Anastasios Kasiolas

Kapil Gupta

Ryan Thomas Sturgell

Brendan W Dixon

Yevgeniy Eugene Rozenfeld

Vipul A Modi

Evgeny Osovetsky

Alexander Martin DeJarnatt

Sowmyanarayanan K Srinivasan

Scott Christopher Seely

Systems and methods for creating and deploying packages to devices in a fleet based on operations derived from a machine learning model or other automated feedback models are provided. As an example, a method for creating a package, including a payload, for deployment to a set of devices is provided. The method includes receiving a payload, where the payload has an associated set of payload parameters concerning a deployment of the payload to the set of devices. The method further includes using a processor, automatically creating the package for the deployment to the set of devices, where the package comprises instructions for deploying the payload to the set of devices, and where the instructions specify at least one of a plurality of operations derived from a machine learning model based at least on a subset of the associated set of payload parameters.

Creating and deploying packages to devices in a fleet based on operations derived from a machine learning model

Systems and methods for deploying packages to devices in a fleet in stages are provided. A method includes first scanning hardware configured to handle functions unrelated to the customer workloads in a first stage to determine whether a selected diversity target for deploying the package is met. The method further includes, if the selected diversity target for deploying the package is not met, then scanning hardware configured to handle at least a subset of the customer workloads in a second stage to determine whether the selected diversity target for deploying the package is met. The method further includes, if the selected diversity target for deploying the package is met after the scanning, then using the processor, deploying the package to the first subset of the set of devices in the first stage and to a second subset of the set of devices in the second stage.

Deploying packages to devices in a fleet in stages

A secure terminal configured to support a trusted execution environment that utilizes policy enforcement to filter and authorize transmissions received from a host device and destined for a remote device. Upon receiving a transmission from the host device, the secure terminal verifies that the instruction, message, or request contained within the transmission satisfy parameters set by a policy. If the transmission satisfies the parameters, then the secure terminal signs the transmission with a key unique to the trusted platform module associated with the secure terminal and forwards the signed transmission to the remote device. If the transmission fails one or more parameters within the policy, a message that details the instruction or operation contained within the transmission is exposed to a user at an output device, in which the user can authorize or reject the transmission using an input device.

Trusted cyber physical system

Descriptions of communication interactions can be used to create a simulation of actual systems that send and receive communications including but not limited to messages complying with a protocol, events and so on. The communication interaction, event, state and state transitions of protocol or software components can be modeled to determine outcome and to validate the format and semantics of events, interaction values, etc. to identify variances against established policies or architectural guidelines.

Simulation of interactions between network endpoints

Annotation information associated with entities of a computing system can be added to a forest generated from the entities where the structure of the forest reflects relationships between the entities. Annotations associated with a child node can be propagated to all parent nodes of the child node all the way up to one or more root nodes of the annotated forest. Annotations associated with a child node can be propagated to a specified depth or place or at nodes with one or more particular characteristics or annotations. The propagation can be performed on-demand to all or some subset of nodes. The annotated forest can be analyzed to determine nodes to which a set of conditions apply.

Analysis of propagated information using annotated forests

The claims based identity model provides a model which associates security identities with claims. The model represents information contained in the claims, as well as, captures relationships between the security identities described in the claims. Finally, the data model can be easily translated to the existing .NET environment without breaking the backward compatibility for existing .NET applications.

Representing security identities using claims

A mechanism for sending structured data using a corresponding byte stream. Upon accessing structured data such as a Simple Object Access Protocol (SOAP) envelope, a byte stream is generated. The byte stream includes bytes that represent the structured data, as well as a collection of bytes that represents properties about the byte stream such as, for example, a mode of communication. The byte stream may then be passed to a communication module (e.g., a TCP or Named Pipes module) capable of receiving and transmitting the byte stream.

Mechanism for binding a structured data protocol to a protocol offering up byte streams

A generic application server is capable of simultaneously receiving requests, processing requested work, and returning results using multiple, conceptual thread pools. In addition, functions are programmable as state machines. While executing such a function, when a worker thread encounters a potentially blocking condition, the thread issues an asynchronous request for data, a state transition is performed, and the thread is released to do other work. After the blocking condition is relieved, another worker thread is scheduled to advance to the next function state and continue the function. Multiple priority work queues are used to facilitate completion of functions already in progress. In addition, lower-priority complex logic threads can be invoked to process computationally intense logic that may be necessitated by a request. Throttling functions are also implemented, which control the quantity of work accepted into the server and server response time.

Generic application server and method of operation therefor

A distributed security system is provided. The distributed security system uses a security policy that is written in a policy language that is transport and security protocol independent as well as independent of cryptographic technologies. This security policy can be expressed using the language to create different security components allowing for greater scalability and flexibility. By abstracting underlying protocols and technologies, multiple environments and platforms can be supported.

Virtual distributed security system

Implementations of the present invention relate in part to optimizations to peer-to-peer communication systems. For example, one implementation relates to use of a smart transceiver that creates, caches, and manages communication channels dynamically between peers. Another implementation relates to use of a central tracking object that can be used to efficiently register and distribute peer messages among the various peers. In one implementation, the central tracking object is shared amongst peers in the group. Still another implementation relates to associating peer groups with namespaces, and for including peer groups of one namespace within still other peer groups of different namespaces. These and other aspects of the invention can also be used to ensure delivery intent of a given peer message is preserved, and to ensure that optimal numbers of messages are communicated to any given peer at any given time.

Optimizing communication using scalable peer groups

A method and system are provided for delivering event messages in a secure scalable manner. A network includes an event distribution device serving as an event generation device for generating and disseminating an event message through the network to event distribution devices serving as edge event delivery devices having recipient devices connected thereto. Event messages may be encrypted at the event generation device for each of the destination recipient devices or event messages may be encrypted at each of the edge event delivery devices for delivery to respective recipient devices connected thereto. A signing key may also be included with the encrypted message such that the respective recipient devices may authenticate a sender of the encrypted message based on the signing key. Encryption keys may be established based on policies of the network of event distribution devices or based on policies of the respective recipient devices.

Secure internet-scale eventing

Methods, systems, and data structures for communicating object metadata are provided. A generic metadata container is presented that allows object metadata to be described in an extensible manner using protocol-neutral and platform-independent methodologies. A metadata scope refers to a dynamic universe of targets to which the included metadata statements correspond. Metadata properties provide a mechanism to describe the metadata itself, and metadata security can be used to ensure authentic metadata is sent and received. Mechanisms are also provided to allow refinement and replacement of metadata statements. The generic metadata container can be adapted to dynamically define access control rights to a range of objects by a range of users, including granted and denied access rights.

Scoped access control metadata element

A routing protocol is provided for exchanging messages between an initial sender and an ultimate receiver, potentially via a set of intermediaries. The routing protocol provides an optional reverse message path that enables two-way message exchange patterns. The routing protocol can be expressed as a header entry within a message envelope, is independent of the underlying protocol, and can be generated at the application layer of a protocol stack. The routing protocol may allow each intermediary to process the message and dynamically alter the message path en route to the intended recipient.

Routing of network messages

An initiating application layer and at an initiating message processor identifies offer information for negotiating an application layer agreement such as, for example, the communication properties of a communication channel, with one or more other message processors. The initiating message processor sends a schema-based offer including the offer information to the one or more other message processors. A receiving application layer at a receiving message processor receives the schema-based offer. In response, a receiving application layer at the receiving message processor identifies response information, such as, for example, indicating an acceptance, a rejection or a counter offer to the schema-based offer, for negotiating the application layer agreement. The receiving message processor sends a schema-based response including the response information to the initiating message processor. Negotiations continue until an application layer agreement is reached or until one of the application layers rejects further negotiations.

Electronically negotiating application layer properties

Systems and methods for open content model Web service messaging in a networked computing environment are described. In one aspect, a transport neutral message is generated that includes message recipient, endpoint addressing information, and one or more reference properties. The reference properties include selectively opaque message context. The transport neutral message is bound to a transport protocol for communication to the message recipient. At least a portion of the selectively opaque message context is not directed to the message recipient.

Open content model Web service messaging

Growing community of inventors

Sammamish, WA, United States of America

Christopher G Kaler