Microsoft Technology Licensing, LLC

Amazon Technologies, Inc.

Colin Harrison Brace

Deepak Suryanarayanan

Nathan Daniel Muggli

William S Jack

Arun K Nanda

Murli D Satagopan

Gaurang Pankaj Mehta

Shon Kiran Shah

Vivek Lakshmanan

Sameer Palande

Guruprakash Bangalore Rao

Krithi Rai

Malcolm Russell Ah Kun

Ajit Nagendra Padukone

Kim Cameron

David Everard Brown

Vijay Gajjala

Chirag Pravin Pandya

William James Whalen

Donald J Hacherl

Stuart L S Kwan

Vijayavani Nori

Derek T Del Conte

Rashmi Raj

Supreeth Koushik Sheshadri

Eric Jason Brandwine

Danny Wei

James T Pinkerton

James Michael Thompson

Melissa Wood Dunn

Jeffrey Bruce Parham

Hervey O Wilson

William Birkin Lees

Mark Robbin Brown

Eugene Michael Farrell

Tariq Sharif

Walter R Smith

Nakul Garg

Erik Jonathon Tellvik

Dave D Straube

Jean-Paul Bauer

Thomas Christopher Rizzo

Osman Surkatty

Qi Cao

Don Hacherl

Valentin Gabriel Priescu

Khushru M Irani

Stuart Kwan

Gokay Hurmali

Umit Akkus

Dragos Diaconescu

Greg Johnson

Anandh Mahalingam

Malcolm Ah Kun

Chris L Mayhall

Erik Jonathan Telvik

Stuart LS Kwan

Vijay K Gajjala

Techniques for are described which enable users of a service provider network to manage local storage devices connected to computer systems of the service provider network as a service. A service provider network provides an application programming interface (API) that enables users to manage local storage devices in association with compute instances created by users using a hardware virtualization service of the service provider network. The API can be used to attach local storage devices to compute instances (that is, make local storage devices available for use as a block storage device), detach local storage devices from compute instances (that is, make local storage devices unavailable for use by a compute instance and possibly available for use by other compute instances on the same computer system), among other possible operations.

Managing local storage devices as a service

A remote computing session management process is directed to the execution and management of aspects of virtual instances executed on data center computers at a program execution service (PES) platform. A computing session may be established between the PES platform and a computing device connected to the PES platform over a communications network. The data created by the user of the client computing device interacting with the virtual instance may be stored, and following an interruption of the remote computing session, the data may be used when re-establishing the remote computing session.

Management of computing sessions

Systems and methods for an incast mitigation approach that first modifies network responses for content requests above a threshold size to be delayed according a response latency selected from an established latency range. Additionally, as incast characteristics are analyzed from network traffic, the volumes can selectively modify the individual established latency range to increase the latency range during periods of higher incast characteristics and to decrease the latency range when incast characteristics appear to be decreasing.

Adaptive recovery based on incast

Changes to virtual workspaces, such as virtual desktops, can be managed for various users by retaining a copy of a machine image for a current workspace in addition to a new machine image for a new workspace with the changes. If compliance issues are detected, or if a user indicates an issue or desire to return to the previous workspace, a new machine instance can be launched that utilizes the previous machine image, simplifying the rollback process and enabling the user to quickly return to the previous workplace state. In some embodiments, a snapshot of the user data can be taken at the time of a workspace change, such that if the workspace is rolled back to a previous version, the data from that point in time can be attached in order to prevent loss or damage to that data as a result of the change.

Version management for hosted computing workspaces

Techniques for connecting computer system entities to local computer system resources are described herein. A computer system entity that requests access to a local computer system resource has that request fulfilled by a managed directory service, which receives the request and connects the computer system entity to the local computer system resource. While connected, the managed directory service receives commands to perform operations on the local computer system resource and, if the computer system entity is authorized to perform the operations on the local computer system resource, the managed directory service performs the operations on the local computer system resource.

Managed directory service connection

A computing system that provides virtual computing services may generate and manage remote computing sessions between client computing devices and virtual desktop instances hosted on the service provider's network. Each virtual desktop instance may include a network interface for communication between the virtual desktop instance and client computing devices, and a second interface that connects the virtual desktop instance to entities on other networks (e.g., Internet destinations, or shared resources on an internal network). An administrative component or client application may detect a condition indicating that the second interface should be disconnected or its operation modified in order to prevent or curtail malicious use of the virtual desktop instance, such as inactivity, server type activity or other suspicious activity, suspension or closing of a remote computing session, or a timeout condition, or may proactively disconnect the interface or modify its operation based on observed or expected usage patterns.

Securing workspaces in a cloud computing environment

A virtual computing environment service may receive a request from a customer to provision a virtual computing environment and join the virtual computing environment to a managed directory. The virtual computing environment service may provision the virtual computing environment and uses a set of administrator credentials from the customer and a set of credentials corresponding to the environment to access the managed directory and request joining of the environment to the managed directory. In response, the managed directory may create a computer account corresponding to the environment and which enables the environment to be used to access the managed directory. The virtual computing environment service may then enable the customer to specify one or more users that may utilize the virtual computing environment to access the managed directory.

Domain join and managed directory support for virtual computing environments

A certificate management system provides automated management of certificate lifecycles and certificate distribution. Rather than depend upon an administrator to manually distribute and manage certificates, the system self-generates certificates, distributes the certificates to appropriate servers or other parties, and transitions from old certificates to new certificates in a well-defined manner that avoids breaking functionality. After generating one or more certificates, the system securely shares certificates in a way that parties that use them can find the new certificates without an administrator manually distributing the certificates. When it is time to update certificates, the system generates new certificates and shares the new certificates in a similar way. During a transition period, the system provides a protocol by which both old and new certificates can be used to perform authenticated access to resources, so that the transition from an old to a new certificate does not break services.

Automated certificate management

A domain controller hierarchy in accordance with implementations of the present invention involves one or more local domain controllers, such as one or more read-only local domain controllers in communication with one or more writable hub domain controllers. The local domain controllers include a resource manager, such as a Security Account Manager ('SAM'), that manages resources and/or other accounts information received from the writable hub domain controller. When a local user attempts to change the resource at the local domain controller, however, the resource manager chains the request, along with any appropriate identifiers for the request, to the writable hub domain controller, where the request is processed. If appropriate, the hub domain controller sends a response that the resource has been updated as requested and also sends a copy of the updated resource to be cached at the local domain controller.

Transparent resource administration using a read-only domain controller

A system and method for provisioning digital identity representations ('DIRs') uses various techniques and structures to ease administration, increase accuracy, and decrease inconsistencies of a digital-identity provisioning system. Various methods are provided for creating new DIRs, requesting DIRs, notifying principals of available DIRs, and approving issuance of new DIRs.

Provisioning of digital identity representations

Dynamically associating an attribute and an associated value to an object includes dynamically associating attribute-value sets to an object, but is not so limited. An exemplary system includes a directory component that can be configured to dynamically assign different values, for a set attributes, to an object. An exemplary directory application can be configured to select an attribute-value set for an object based in part on a group membership determination, and a precedence parameter associated with an attribute-value, set, or other grouping. Other embodiments are available.

Dynamically associating attribute values with objects

A system and method for provisioning digital identity representations ('DIRs') uses various techniques and structures to ease administration, increase accuracy, and decrease inconsistencies of a digital-identity provisioning system. A system is provided using a common identity data store for both DIR issuance and identity token issuance, decreasing synchronization issues. Various methods are provided for creating new DIRs, notifying principals of available DIRs, and approving issuance of new DIRs.

Accessing a data set with secret and non-secret data. A method includes accessing a data set image. The data set image comprises secret data. The data set image is derived from an authorized data set associated with a master key that authorizes access to the secret data. The master key is not provided with the data set image. The method further comprises restoring the data set image to a computing system to create a degraded data set. Data in the degraded data set other than the secret data is accessed without restoring the master key.

Securing data set images

Growing community of inventors

Mercer Island, WA, United States of America

Colin Harrison Brace