Microsoft Technology Licensing, LLC

Ivan Dimitrov Pashov

Jonathan A Silvera

Matthew R Cox

Benjamin M Schultz

Hari R Pulapaka

Gerardo Diaz Cuellar

Giridhar Viswanathan

Navin Narayan Pai

Billy Anders

Paul Trunley

Ziyan Zhou

Israel Hilerio

Frederick Justus Smith

Lars Reuther

Gerardo Diaz-Cuellar

Poornananda R Gaddehosur

David Joel Sheldon

Peter Alan Carlin

Charles Glenn Jeffries

Michael Bishop Ebersol

Kedar Hirve

Katerina V Sedova

Karen Elizabeth Parker Anderson

Paul Sliwowicz

Daniel C Stevenson

Aditya Sharma

David Vaughn Winkler

Eric Neal Loewenthal

Martin Andras Chisholm

Srikanth Subramanian

Kiran Kumar Venkata Purna Chenna Kesava Vemula

Arpan Kumar Gupta

Vinothkumar Prabhakaran

Vikram Mangalore Rao

Alexandru Jercaianu

Milan Crowley Justel

Aditi Pravin Patange

Dany Joly

Victor Ngo

Adam U Herchenroether

Chiasen Chung

Charles G Jeffries

Methods and apparatuses for handling raw DNS queries or DNS queries that generate responsive DNS records from a DNS server that are not recognized or decodable by a DNS client are described. The DNS client may receive a DNS query from an application and provide a numerical IP address and one or more DNS records for a given domain name to the application. In some cases, a DNS client provides an interface that enables the application to send and receive DNS queries and responses to DNS queries that use DNS functionalities and customizations that are not recognized by the DNS client. This capability allows the application to craft its own DNS queries to send and receive resulting response bytes or packets through the DNS client, while allowing the DNS queries to pass through the DNS client to make use of host system cache, policies, and settings.

Handling raw DNS queries in DNS client

A front-end computing system provides cross machine message forwarding through a kernel mode component. The message is received in a kernel mode queue of the front-end computing system. The message includes one or more headers and an entity body including one or more data blocks. A user mode router in the front-end computing system designates a computing system to process the message based at least in part on the one or more headers. The one or more data blocks are passed through the kernel mode queue in the front-end computing system to the designated computing system without passing the one or more data blocks to the user mode router in the front-end computing system.

Cross machine request forwarding

Techniques for implementing a last known good (LKG) client-side cache for DNS resiliency are disclosed. A first DNS request is submitted to a DNS server. A first DNS resolution that resolves an IP address for a domain name is received. A service stores the first DNS resolution in an LKG cache residing on the local host. A second DNS request is sent, where the second DNS request again requests to resolve the same domain name. In response to determining that a second DNS resolution for the second DNS request has not been received, the service obtains the IP address for the domain name from the LKG cache.

LKG client cache for DNS resiliency

A computing system delegates a request between a first container in user mode of an operating system on a webserver system and a second container in the user mode of the operating system. The operating system includes a kernel. A service in the second container creates a delegation queue in the kernel of the operating system. The service adds an identifier as a property of the delegation queue in the kernel, wherein the identifier is unique across the first container and the second container. A router executing in the first container opens the delegation queue in the kernel using the identifier, responsive to the adding operation. The request is delegated to the service executing in the second container via the delegation queue in the kernel, responsive to the opening operation.

Cross-container delegation

A host operating system running on a computing device monitors network communications for the computing device to identify network resources that are requested by the computing device. The host operating system compares requested network resources against security policies to determine if the requested network resources are trusted. When an untrusted network resource is identified, the host operating system accesses the untrusted network resource within a container that is isolated from the host operating system kernel using techniques discussed herein. By restricting access to untrusted network resources to isolated containers, the host operating system is protected from even kernel-level attacks or infections that may result from an untrusted network resource.

Hardware-based virtualized security isolation

Providing access control by a first operating system. A method includes receiving at the first operating system, from the second operating system, a request for a bounding reference to a set having at least one resource. A bounding reference for the set is obtained. The bounding reference comprises a reference created from a first operating system resolvable reference to the set. The method further includes providing the obtained bounding reference for the obtained provided bounding reference to the second operating system. A request, including the obtained bounding reference and an identifier identifying the second operating system for the set, is received from the second operating system. The obtained bounding reference and the identifier identifying the second operating system are evaluated. As a result of evaluating the obtained bounding reference and the identifier identifying the second operating system, a resource control action is performed.

Securing shared components

The techniques and systems described herein improve security and improve connection reliability by providing a framework for an application to communicate its intent to an authority service so that the authority service can enforce networking security requirements. In various examples, an intent to access a resource over a network is received and queries are sent to resolve a network connection that enables access to the resource. Information for the resource is then collected and stored together in a trusted and secure environment. For instance, the information can include proxy data or can include hostname data. A ticket can be created based on the information. The ticket can be used to establish and maintain a secure network connection to the resource.

Secure resource-based policy

A second operating system accessing resources from an external service. A method includes sending an anonymized request, for an anonymized user corresponding to an authorized user, for resources, through a broker. A request for proof indicating that the anonymized user is authorized to obtain the resources is received from the broker. As a result, a request is send to a first operating system for the proof that the anonymized user is authorized to obtain the resources. Proof is received from the first operating system, based on the anonymized user being associated with the authorized user, that the anonymized user is authorized to obtain the resources. The proof is provided to the broker. As a result, the resources are obtained by the second operating system from the service.

Cross container user model

Examples of the present disclosure relate to systems and methods for fast and secure request forwarding. A server application may receive an indication that there is a request in a queue available for processing. The server application may peek at the request, thereby accessing at least a portion of the request without removing the request from the queue. Based on the portion of the request, a determination may be made about whether the server application should process the request directly or transfer the request to a different module. If it is determined that the request should be processed directly, the entire request may be received from the queue and processed accordingly. However, if it is determined that the request should be forwarded, the request may be transferred to a secondary queue. A different module may then receive the request from the secondary queue and process the request accordingly.

Fast and secure request forwarding

Techniques described herein enable a client to store information indicating whether various hosts (e.g., servers, web domains) support a preferred security protocol, such as a False Start-modified TLS or SSL protocol. The client may then use this information to dynamically determine whether to use the preferred protocol when connecting to a particular host. When the client attempts a handshake to establish a secure connection with a host for the first time, the client does so using the preferred protocol. If the handshake fails, the client locally stores domain or other identifying information for the host so that the client may employ a non-preferred protocol in subsequent connection attempts. Thus, a client may avoid performance degradation caused by attempting a preferred-protocol connection with a host that does not support the preferred protocol. Stored information may include a time stamp enable periodic checks for host capability updates.

Dynamic selection of security protocol

Browser storage management techniques are described. In one or more implementations, inputs are received at a computing device that specify maximum aggregate sizes of application and database caches, respectively, of browser storage to be used to locally store data at the computing device. For example, the inputs may be provided using a policy, by an administrator of the computing device, and so on. The maximum aggregate sizes are set of application and database caches, respectively, of browser storage at the computing device to the sizes specified by the inputs.

Browser storage management

A computer can be configured to provide seamless access to a proxy server by, upon connection to a computer network, determining whether a proxy server using authentication is connected to the computer network, and then prompting a user of the computer to enter authentication information for that proxy server. This authentication information for the proxy server then can be stored in a manner accessible by applications on the computer to use the authentication information to connection with requests by the applications to access the second computer network. For example, the operating system can store the authentication information. It also can include a module that processes all requests from applications that access the proxy server, and then includes in such requests the stored authentication information.

Seamless authentication with proxy servers

Various embodiments enable on-demand scaling of a timer wheel. Some embodiments dynamically start and stop a timer wheel based, at least in part, on whether the timer wheel has any associated active timers. In some cases, the timer wheel is suspended when all associated active timers have been serviced. Alternately or additionally, the timer wheel is re-activated upon associating one or more active timers in need of service to the timer wheel. Various embodiments enable addition and removal of timer(s) to the timer wheel and/or various time slots associated with the timer wheel without using a global lock associated with the timer wheel.

On-demand scalable timer wheel

Various embodiments initialize a communication link associated with data transfer to a connected state between participants in the communication link. In some cases, the communication link is paired with a first Input/Output (I/O) completion port effective to enable the data transfer. Some embodiments disassociate the communication link with the first I/O completion port and re-initialize the communication link while retaining the connected state. Alternately or additionally, the communication link is paired with at least a second I/O completion port. In some cases, the second I/O completion port utilizes an I/O model that differs from an I/O model associated with the first I/O completion port. Alternately or additionally, the communication link can be reconfigured to follow a IO model that does not utilize an IO completion port at all.

Reliable socket transfer based on initializing and re-initializing a communication link and retaining a connected state

Growing community of inventors

Woodinville, WA, United States of America

Ivan Dimitrov Pashov