Microsoft Technology Licensing, LLC

Eran Yariv

David Abzarian

Gerardo Diaz Cuellar

Blaise Aguera Y Arcas

Hen Fitoussi

Benny Schlesinger

Brian C Beckman

John Daniell Hebert

Fadi Haik

Gur Kimchi

Deepak Bansal

Avi Bar-Zeev

Murari Sridharan

Lokesh Srinivas Koppolu

Scott M Isaacs

Gerardo Diaz-Cuellar

Roy Varshavsky

Maxim V Stepin

Salahuddin Khan

Ronen Barenboim

Ian M Carbaugh

Meir Ben-Itay

Pradeep Bahl

Mark Vayman

Emanuel Paleologu

Daniel Sitton

Charles D Bassett

Gilad Oren

Adi Ben-Dayan

Maksim Noy

Sarah A Wahlert

Alexander Malvsh

Or Kaplan

Yoram Yaacovi

Art Shelest

Kfir Karmon

Ron Jack Karidi

Amit A Sehgal

Alexander Malysh

Oded Elyada

Michael R Surkan

Salahuddin C J Khan

Limor Lahiani

Vadim Kuper

Fabien J Royer

Keren Master

Yair E Geva

Yair E Gheva

Elad Ben-Israel

Inbal Ort

Barak Shein

Noga Amit

Philippe A Joubert

In server/client architectures, the server application and client applications are often developed in different languages and execute in different environments specialized for the different contexts of each application (e.g., low-level, performant, platform-specialized, and stateless instructions on the server, and high-level, flexible, platform-agnostic, and stateful languages on the client) and are often executed on different devices. Convergence of these environments (e.g., server-side JavaScript using Node.js) enables the provision of a server that services client applications executing on the same device. The local server may monitor local events occurring on the device, and may execute one or more server scripts associated with particular local events on behalf of local clients subscribing to the local event (e.g., via a subscription model). These techniques may enable development of local event services in the same language and environment as client applications, and the use of server-side code in the provision of local event service.

Event service for local client applications through local server

In the field of computing, many scenarios involve the execution of an application within a virtual environment of a device (e.g., web applications executing within a web browser). Interactions between applications and device components are often enabled through hardware abstractions or component application programming interfaces (API), but such interactions may provide more limited and/or inconsistent access to component capabilities for virtually executing applications than for native applications. Instead, the device may provide hardware interaction as a service to the virtual environment utilizing a callback model, wherein applications within the virtual environment initiate component request specifying a callback, and the device initiates the component requests with the components and invokes associated callbacks upon completion of a component request. This model may enable the applications to interact with the full capability set of the components, and may reduce blocked execution of the application within the virtual application in furtherance of application performance.

Inversion-of-control component service models for virtual environments

Architecture that facilitates power conservation in mobile devices such as cell phones using prediction. The architecture is an algorithmic-based solution that transforms infrequently-captured geolocation data of an entity into a continuous probable location approximation. Given the location history and additional data about the recent location of the mobile device, the current location of the device can be estimated with some probability. Additionally, given the location history and additional data about the recent location of the device, the probability of the device actually being at a given point on a map is computed.

Prediction for power conservation in a mobile device

Architecture that enables alerts and notifications to have priorities and time/space durations. Non-critical alerts can be displayed in a non-obtrusive manner and alert/notifications coalesced. Alerts/notifications can be assigned priorities, thereby enabling the alerts/notifications to be non-intrusive to the user. Methods include detecting when the user is using a mobile phone (or other suitable device) and then sending the alert/notification in response to the detected use based on threshold criteria relative to an accumulated sum of alerts/notifications, and an importance level (e.g., of each). Additionally, alert/notification priority can be changed (e.g. elevated, lowered) according to time (when) and space (where), thereby enabling the user to be intrusively notified based on the level, even if not previously signaled. Time and space bounds (criteria) can be assigned to alerts/notifications for merger/grouping and/or set to be auto-dismissed if no longer applicable.

Delayed and time-space bound notifications

In the field of computing, many scenarios involve the execution of an application within a virtual environment (e.g., web applications executing within a web browser). In order to perform background processing, such applications may invoke worker processes within the virtual environment; however, this configuration couples the life cycle of worker processes to the life cycle of the application and/or virtual environment. Presented herein are techniques for executing worker processes outside of the virtual environment and independently of the life cycle of the application, such that background computation may persist after the application and/or virtual environment are terminated and even after a computing environment restart, and for notifying the application upon the worker process achieving an execution event (e.g., detecting device events even while the application is not executing). Such techniques may heighten the resiliency and persistence of worker processes and expand the capabilities of applications executing within virtual environments.

Persistent and resilient worker processes

Some embodiments of the invention are directed to techniques for determining whether a process on a computer system that is sending or receiving data, or is attempting to send or receive data, with another computer system is executing in kernel mode or user mode and providing an indicator of this determination to a security engine. In some embodiments, such an indication is provided to a security engine (e.g., a firewall) that implements a security policy based at least in part on whether the sending or receiving process is in kernel mode or user mode, and filter communications based on a process' operating mode. This enables a security engine to maintain security policies of greater specificity and thus improve security of a computer system.

Filtering kernel-mode network communications

Architecture that provides location broker services which share the user location with other parties (e.g., based on user consent). Stationary computing devices can also determine the location of the user operator and interact accordingly. In one embodiment, the user location is retrieved from the user mobile device (e.g., smart phone) and is transmitted to other mobile or non-mobile devices with which the user interacts. Moreover, existing infrastructure and systems can be employed using a device driver that emulates the user location so that any software that uses the location services does not need modification.

Use of user location information for remote actions

A proximity matching system may use broadcast wireless identifiers transmitted by users' devices to match users with other nearby users. The identifiers may be collected by a plurality of agents, then the identifiers may be matched with pre-defined profiles to generate physically proximate users by a remote service. The group of proximate users may be provided to various applications and consumed with summarized properties or individual properties, depending on the approved privacy settings as selected by the users. In some embodiments, the broadcast wireless identifiers may be personal area network identifiers, local area network identifiers, cellular network identifiers, or other broadcast identifier. In some embodiments, the agents may not establish a peer to peer or other connection with the broadcasting device. The agents may be fixed or mobile agents, and the proximity of users may be generated through links between nearby agents in a meshed fashion.

Wireless identifiers for proximity applications

Embodiments of the present invention are directed to establishing and/or implementing firewall rules that may employ parameters based on connection security levels for a connection between devices. A firewall may thus provide greater granularity of security and integrate more closely with other security methods to provide better overall security with fewer conflicts.

Incorporating network connection security levels into firewall rules

Growing community of inventors

Zichron Yaakov, Israel

Eran Yariv