Microsoft Technology Licensing, LLC

Dean A Wells

Nir Ben-Zvi

Ravi Rao

Richard Douglas Hill

Girish Chander

Uday Sooryakant Hegde

Vladimir Yarmolenko

Clifford Didcock

Gregory C Johnson

Alan Thomas Gavin Jowett

Gregory M Cusanza

Ross Peter Adams

Elisa W Zhang

Ikrima Elhassan

Satheesh S Dabbiru

Gregoire Guetat

Ryan A Sizemore

Veneta I Tashev

Ryan P Puffer

Matthew F Steele

Ravi T Rao

Clifford N Didcock

Ross Adams

Embodiments relate to a host encrypting network communications of virtual machines (VMs) in ways that minimize exposure of the network communications in cleartext form. The host captures and registers a measure of a secure state of the host. The measure is registered with a guardian service communicable via a network. The guardian service also securely stores keys of the VMs. Each VM's key is associated with authorization information indicating which machines are authorized to obtain the corresponding VM's key. The host obtains access to a VM's key based on a confirmation that its state matches the registered measured state and based on the authorization information of the VM indicating that the host is authorized to access the key. The VM's key is then used to transparently encrypt/decrypt network communications of the VM as they pass through a virtualization layer on the host that executes the VMs.

Shielded networks for virtual machines

A device runs a hypervisor and a virtual machine. The virtual machine includes a virtual security module, which can be a virtual trusted platform module (TPM). The virtual security module for the virtual machine is encrypted, and in order for the hypervisor to run the virtual machine the virtual security module is decrypted using a security module key. If a host guardian service is accessible, then the hypervisor obtains the key to decrypt the virtual security module from the host guardian service. However, if the host guardian service is inaccessible, then the hypervisor uses a key securely stored in a key cache of the device to decrypt the virtual security module. In one or more embodiments, the hypervisor can obtain the key from the key cache only if a health certificate indicating that the host guardian service trusts the device has been previously obtained from the host guardian service.

Enabling offline restart of shielded virtual machines using key caching

Embodiments of the invention are disclosed for establishing single identity/single-sign on (SSO) on a cloud computing platform. In an embodiment, a user is validated to the cloud computing platform, and identifies a domain. After establishing that the user has control of the domain, the cloud computing platform configures a directory service for the domain. The user may then use the directory service on the cloud computing platform to log in to his or her computer, as well as software services hosted on the cloud computing platform.

Identity services for organizations transparently hosted in the cloud

Embodiments are directed to dynamically transforming user interface actions into executable script commands and to storing groups of executable script commands related to specific tasks. In an embodiment, a computer system tracks user interface actions at a software program user interface. The computer system transforms the user interface actions into an executable script command. The script command is configured to perform the tracked user interface action when executed. The computer system also dynamically displays the resulting executable script commands in a script command window as the user interface actions are entered by the computer user. The computer system may further determine that multiple user interface actions correspond to a specified task and store the resulting executable script commands related to the specified task as a combined group of executable script commands.

Transforming user interface actions to script commands

The present invention extends to methods, systems, and computer program products for domain controller safety-features and cloning. Embodiments include cloning virtual domain controllers. Cloning permits virtual domain controllers to be rapidly deployed by copying/cloning the entire operating system state of an existing virtual domain controller. Other embodiments provide safety features protecting domain controllers running within virtual machines from introducing distributed corruption into a directory services data system. Protection is facilitated by detecting when a hypervisor or Virtual Machine Manager ('VMM') uses features that cause a virtual machine to be rolled back in time outside of an operating system's awareness. In response to detecting a feature that causes rollback, safeties can be implemented to compensate for otherwise divergent state and prevent the introduction of duplicate unique identifiers.

Domain controller safety-features and cloning

Growing community of inventors

Snohomish, WA, United States of America

Dean A Wells