Microsoft Technology Licensing, LLC

Gilad Golan

Robert M Fries

Jason Garms

Mark Vayman

Anthony Blumfield

Saud A Alshibani

Scott Field

Eric Joseph Winner

Scott A Field

A facility for applying a software patch is described. Using an automatic patching agent, the facility receives the software patch. In response to receiving the software patch, without user intervention, the facility performs the following acts: First, the facility identifies an instance of an executable module that is currently loaded, and to which the received software patch pertains. Second, the facility applies the received software patch to the identified loaded executable module instance to modify the behavior of the identified executable module instance.

Efficient patching

A facility for receiving an embedded policy is provided. The facility checks an application program image for the presence of an embedded policy. If an embedded policy is detected, the facility extracts the policy from within the application program image. The facility may then apply the extracted policy to the application program image before the application program image is loaded and/or executed. Moreover, the facility may check the application program image's integrity prior to extracting the embedded policy.

Access authorization having embedded policies

Each of a plurality of virtual machines (VMs) is stored in a halted form in a library for retrieval from the library and re-starting on a host. Each re-started VM includes a plurality of software constructs, each of which is at least potentially non-current and requires a software update. To update a non-current VM, such VM is retrieved and re-started on a maintenance host, and each non-current software construct is allowed to be updated by obtaining the required software update from a corresponding update source as a patch. Alternatively, the VM is mounted to a computing device, constituent components of the mounted VM are examined to determine whether each software construct thereof is current, and each non-current software construct is updated by obtaining the required software update from the corresponding update source as a patch and applying same to the mounted VM.

Updating virtual machine with patch on host that does not have network access

A facility for automatically processing software patches is described. The facility receives in a computing system a distinguished patch package for modifying the behavior of a programmatic entity. The facility automatically extracts from the distinguished patch package (1) patch application information that identifies a distinguished programmatic entity against which the patches to be applied, and (2) patch behavior information that specifies a manner in which to modify the behavior of the distinguished programmatic entity. The facility automatically adds to a patch table a distinguished entry containing the extracted patch application information and patch behavior information.

A facility for providing access authorization is provided. The facility initially enforces a first, less restrictive policy when making its access control decisions. Subsequent to detecting an anomaly, the facility enforces a second, more restrictive policy when making its access control decisions. The facility returns to enforcing the first, less restrictive policy when the anomaly no longer exists. In another embodiment, the facility enforces a policy after detecting an anomaly and until the anomaly has ended.

Access authorization with anomaly detection

A facility for augmenting software in a target computer system is described. The facility receives and augmentation specification in the target computer system. The augmentations specification specifies: (a) a function to be augmented, (b) a parameter of the function to be tested, (c) a test to apply to the specified parameter, and (d) and modification to perform to the behavior of the function if the specified test is not satisfied by the specified parameter. When the specified function is invoked on the target computer system, if the specified tested is not satisfied by the specified parameter, the facility performs the specified modification to the behavior of the specified function.

A facility for setting and revoking policies is provided. The facility receives a request from a controlling process a request to set a policy on a controlled process, and determines whether the controlling process has privilege to set the policy on the controlled process. If the facility determines that the controlling process has privilege to set the policy on the controlled process, the facility sets the policy on the controlled process, which causes the policy to be applied to the controlled process to determine whether the controlled process has authorization to access one or more resources.

Growing community of inventors

Redmond, WA, United States of America

Gilad Golan