Microsoft Technology Licensing, LLC

Docusign, Inc.

Eric Fleischman

Donald Grant Peterson

Yordan Ivanov Rouskov

David Steeves

Dharma Kiritkumar Shukla

Abolade Gbadegesin

Krishna C Vitaldevara

David Richard Reed

Thomas A Galvin

Prabu Raju

Ramesh Manne

Nikolay Smolyanskiy

Luke Abrams

Winfred Wong

Hersh Dangayach

Niyantha Shekar

Payoj Baral

Meenakshi Ramaswamy

Roman Batoukov

Kun Liu

Nathan Jeffrey Ide

Vijay G Bharadwaj

Saurav Sinha

Gopinathan Kannan

Matthew Robert Ayers

Duane Robert Wald

Duane E Wald

Ruslan Pavlovich Ovechkin

Gaurav S Anand

Eliot Carleton Gillum

Oludare Victor Obasanjo

Kevin Michael Woley

Hakki Tunc Bostanci

Dmitri Gavrilov

Sarah Faulkner

Christopher Geiger Parker

Christopher R Macaulay

Matthew Z Tamayo-Rios

Rajeev Dutt

Tarek B Kamel

Keiji Kanazawa

Robert Edgar Fanfant

Techniques for providing data security services with respect to cloud-based services are described. Examples include a security service provider ('SSP') configured to perform or provide one or more security-related services or functions with respect to or on behalf of some other system or service. The other system or service may be, for example, a cloud-based system that provides network-accessible services. The SSP allows a user of the cloud-based service to provide and manage one or more security-related services, such as data storage, encryption, decryption, key management, and the like. By using and controlling the SSP, the user can be confident that his or her data is being securely represented and stored, even though it is being operated upon by a cloud-based service that is not under the user's control.

Systems and methods for cloud data security

Systems, and methods are provided to provide cloud-based coordination of customer premise service appliances. A system can include a cloud-based service platform, which includes a coordination server and a cloud-based service appliance, and an on-premise service appliance. The coordination server is configured to establish a service session, select a service appliance, and control a sequence of operations on the selected service appliance. Establishing the service session can include establishing a service session with a first client in response to a service request received from the first client, the first client associated with an account including a service policy. Selecting the service appliance can include selecting the cloud-based service appliance or the on-premise service appliance, based on the service policy, to handle the service request. Upon selection of the on-premise service appliance, the coordination server controls a sequence of operations performed by the on-premise service appliance to satisfy the service request.

Cloud-based coordination of remote service appliances

Techniques for protecting an online service against network-based attacks are described. In some cases, protection is performed by way of a scalable protection service including a dynamically scalable set of virtual machines hosted by a cloud service that is distinct from a data center that hosts the online service. The protection service is coupled to the online service via a private link. When an attack is detected by the online service, network traffic bound for the online service is redirected from the public network to the protection service. The protection service then processes the network traffic, such as by dropping network traffic associated with the attack and forwarding legitimate network traffic to the online service via the private link.

Systems and methods for protecting an online service against a network-based attack

Techniques for secure data synchronization are described. In one or more implementations, a determination is made as to whether enterprise data is stored locally on a first device corresponding to an enterprise device. Based on a determination that the second device is a non-enterprise device, a determination is made as to whether a permission associated with the first device indicates that the first device is permitted to propagate the enterprise data to non-enterprise devices. If the first device lacks permission to propagate the enterprise data to non-enterprise devices, the enterprise data is prevented from being propagated to the second device.

Secure data synchronization

In one embodiment, a user authentication server may use geo-location tracking to determine whether to present an enhanced identity challenge. A communication interfacemay receive a user login attempt by a user and a current location of the user login attempt. A data storagemay store a user location profile of the user. A processormay execute a comparison of the current location to the user location profile. The communication interfacemay present the user with an enhanced identity challenge before allowing user access based on the comparison.

Protection from unfamiliar login locations

Devices, systems, and methods are provided to provide cloud-based coordination of customer premise service appliances. A system can include a computing device comprising a communication module, a policy module, an appliance selection module, and a coordination module. The communication module receives a document request from a first client over a network connection, establishes a session with the first client in response to the document request, and receives metadata representing collected signatures at after completion of the electronic signature operation portion of the document request. The policy module manages a policy associate with a first account corresponding to the document request. The appliance selection module selects one of a plurality of document appliances. The coordination module controls a sequence of operations performed on the on-premise document appliance to service the document request, and instructs the on-premise document appliance to communicate results at the completion of the document request.

Cloud-based coordination of customer premise service appliances

A device operated by a user may store an object to which access is to be regulated, which may be achieved by encrypting the object with an encryption key and sending the key to a server having a key store. When a user of the device requests access to the object, the server may authenticate the user (e.g., according to a credential submitted by the user) and verify a trust identifier of the device (e.g., authorization to access the object through the device, and/or the integrity of the device), before sending to the device a ticket granting access to the key. The device may send the ticket to the server, receive the key from the server, decrypt the stored encrypted object, and provide the object to the user. This mechanism promotes rapid access upon request and efficient use of the server, and enables remote revocation of access.

Controlling access to protected objects

Growing community of inventors

Redmond, WA, United States of America

Eric Fleischman