Microsoft Technology Licensing, LLC

Amazon Technologies, Inc.

Gopinathan Kannan

Saurav Sinha

Nathan Jeffrey Ide

Vijay G Bharadwaj

Christopher R Macaulay

Paul J Leach

Mark Fishel Novak

Eric Fleischman

Kun Liu

Yi Zeng

Ruslan Pavlovich Ovechkin

Matthew Z Tamayo-Rios

K Michiko Short

Arun Upadhyaya Kishan

Scott Field

Octavian Tony Ureche

Nelly L Porter

Innokentiy Basmov

Liqiang Zhu

Himanshu Soni

Vishal Agarwal

Preston Derek Adam

Peter Novotney

Narendra Shripati Acharya

Kinshuman Kinshumann

Michael J Grass

Giridharan Sridharan

Ramesh Chinta

Arthur Baker

Dave M McPherson

Vijay Bharadwaj

Ryan James Fairfax

Sunil P Gottumukkala

Salahuddin Khan

Tony Ureche

Qi Cao

Siddharth Bhai

Thomas Yves Paul Helleboid

Paul J Miller

Jonathan M Andes

James J Simmons

Ryan Segeberg

Umit Akkus

Alexandru Hanganu

Adam Damiano

Ruipeng Huang

Akshay Malik

Aniket V Oak

Shawn Corey

Arthur H Baker

Techniques for secure data synchronization are described. In one or more implementations, a determination is made as to whether enterprise data is stored locally on a first device corresponding to an enterprise device. Based on a determination that the second device is a non-enterprise device, a determination is made as to whether a permission associated with the first device indicates that the first device is permitted to propagate the enterprise data to non-enterprise devices. If the first device lacks permission to propagate the enterprise data to non-enterprise devices, the enterprise data is prevented from being propagated to the second device.

Secure data synchronization

Features related to systems and methods for opportunistic packet network flow controller with implicit bias correction are disclosed. Features are described for generating short term forecasts based on external inputs such as historical flow data and future events, in a large scale network flow carrying heterogeneous packets with limited bandwidth along its connections. The bias in forecast is continuously corrected based on current flow telemetry and new external inputs leading to automatically adjusting the flow control at every connection based on current and anticipated volume, in real time.

Opportunistic packet network flow controller with implicit bias correction

In one embodiment, a client devicemay use an attestation serviceto verify a secure serverThe secure servermay receive a signed trusted credentialfrom an attestation servicevalidating the secure serveras trustworthy to a client deviceseeking access. The secure servermay protect the signed trusted credentialin a server secure module

Verifying the security of a remote server

In one embodiment, a user login device may create a user identifier templatefor identifying a user by implicitly capturing one or more biometric identifier readings. A user login device may capture an enrollment biometric identifier reading of a user during an operational user action. The user login device may apply the enrollment biometric identifier reading in creating a user identifier template

Informed implicit enrollment and identification

The techniques and systems described herein present various implementations of a model for authenticating processes for execution and specifying and enforcing permission restrictions on system resources for processes and users. In some implementations, a binary file for an application, program, or process may be augmented to include a digital signature encrypted with a key such that an operating system may subsequently authenticate the digital signature. Once the binary file has been authenticated, the operating system may create a process and tag the process with metadata indicating the type of permissions that are allowed for the process. The metadata may correspond to a particular access level for specifying resource permissions.

Process authentication and resource permissions

This disclosure describes methods, systems, and application programming interfaces for creating a credential managed account. This disclosure describes creating a new password managed account, defining the password managed account, wherein the password managed account is to access a service on a managed computing device, identifying the password managed account for a lifecycle, and automatically managing the password managed account by updating and changing a password for the password managed account on a periodic basis.

Isolation of services or processes using credential managed accounts

An application on a device can communicate with organization services. The application accesses a protection system on the device, which encrypts data obtained by the application from an organization service using an encryption key, and includes with the data an indication of a decryption key usable to decrypt the encrypted data. The protection system maintains a record of the encryption and decryption keys associated with the organization. The data can be stored in various locations on at least the device, and can be read by various applications on at least the device. If the organization determines that data of the organization stored on a device is to no longer be accessible on the device (e.g., is to be revoked from the device), a command is communicated to the device to revoke data associated with the organization. In response to this command, the protection system deletes the decryption key.

Data protection for organizations on computing devices

Techniques for secure data synchronization are described. In one or more implementations, techniques may be employed to conserve high cost data storage by storing larger portions of encrypted data in low cost storage, while storing relatively smaller encryption keys in higher cost storage. A device that is granted access to the encryption keys can retrieve the encrypted data from the low cost storage and use the encryption keys to decrypt the encrypted data.

A distributed system in which time-dependent credentials are supplied by controllers that operate according to different local times. Errors that might arise from the controllers generating inconsistent credentials because of time skew are avoided by identifying credentials generated during transition intervals in which different ones of the controllers may generate different credentials at the same absolute time. During a transition interval, controllers and other devices may use credentials differentially based on the nature of the authentication function. Each controller may periodically renew its credentials based on self-scheduled renewals or based on requests from other devices, such that renewal times are offset by random delays to avoid excessive network traffic. Controllers may determine which credential is valid for any given time, based on a cryptographically secure key associated with that time and information identifying the entity that is associated with that credential.

Distributed computer systems with time-dependent credentials

Growing community of inventors

Redmond, WA, United States of America

Gopinathan Kannan