Microsoft Technology Licensing, LLC

Cristian Stefan Salvan

Peter David Waxman

Girish Mittur Venkataramanappa

Igor Sedukhin

Himanshu Soni

Prabu Raju

Sumit Mohanty

Christopher Edward Fenner

Leo S Vannelli, Iii

Anubhav Dhoot

Kam Kouladjie

Rama Rao Raghavendra Rao

Gabriel Fortunato Stocco

Kahren Tevosyan

Giridhar Viswanathan

Brian Scott Lounsberry

Kamran Riaz Khan

Gridhar Viswanathan

Various methods and systems are provided for autonomous secrets management for a key distribution service ('KDS'). A KDS server performs centralized management and distribution of keys for client devices in a distributed computing system, which obviates key management and distribution at the client devices. In operation, a key request is received at a KDS server from a KDS client device. The key request is generated using a data protector and a KDS client component of the KDS client device. The key request is associated with a caller and a security token of the caller. The caller is authenticated at a security token service (STS) based on a security token. An encryption key or decryption key associated with the key request is generated. The encryption key or the decryption key is generated based on an interval-based key derivation scheme. The encryption key or the decryption key is communicated to KDS client.

Autonomous secrets management for a key distribution service

The present invention provides for streamlined issuance of certificates and other tokens that are contingent on key attestation of keys from a trusted platform module within a computing platform. Various methods are described for wrapping the requested token in a secret, such as an AES key, that is encrypted to a TPM based key in a key challenge. If the requesting platform fails the key challenge, the encrypted certificate or token cannot be decrypted. If requesting platform passes the challenge, the encrypted certificate or token can be decrypted using the AES key recovered from the key challenge.

Key-attestation-contingent certificate issuance

The present invention extends to methods, systems, and computer program products for translating declarative models. Embodiments of the present invention facilitate processing declarative models to perform various operations on applications, such as, for example, application deployment, application updates, application control such as start and stop, application monitoring by instrumenting the applications to emit events, and so on. Declarative models of applications are processed and realized onto a target environment, after which they can be executed, controlled, and monitored.

Translating declarative models

Growing community of inventors

Redmond, WA, United States of America

Cristian Stefan Salvan