Microsoft Technology Licensing, LLC

Jack Smith Richins

Raul Garcia

Michael James Zwilling

Octavian Tony Ureche

Craig Steven Freedman

Panagiotis Antonopoulos

Conor J Cunningham

Asad Yaqoob

Preston Derek Adam

Erik Ismert

Jason Todd Hunter

Srinivasmurthy P Acharya

Sameer Tejani

Dayi Zhou

Ruslan Pavlovich Ovechkin

Mahesh K Sreenivas

Fabricio Voznika

Haitao Wang

Robert E Walters

Jasraj Dange

Craig Alan Gick

Akil M Merchant

Salil Bhagurkar

Jerome Raymond Halmans

Soumya D Pani

Piyush Joshi

Zubair Ahmed Mughal

Sung Soo Kang

Liying Jiang

Benjamin Leon Grol-Prokopczyk

Methods and systems are disclosed for activating data encryption at rest in a storage device server in a cloud storage. In particular, an encryption orchestrator orchestrates activation processes through encryption controllers that controls policies and privileges to access data in storage device servers. To reduce a risk of a data loss and time loss in activations, the encryption controller pre-checks a storage device server for anomalies in configurations in network connectivity, encryption keys, and security certificates before starting the activation. Furthermore, the encryption controller performs a health-check of the storage device servers to detect anomalies that require restarting the storage device servers. The health-check reduces a risk of data loss when the storage device servers become unable restart itself. User interface tools may be provided to visually identify and manage encryption statuses and policies of the encryption controllers, the storage device servers, and data storage devices.

Reliable datacenter protection at scale

A system and method of enabling row level security through security policies is disclosed herein. In this system and method, a computing device may be communicatively coupled to a storage device. The computing device may further be activated and maintain data that comprises a plurality of rows. When executed by the computing device, the system and method may process a data definition language statement comprising a security policy definition. Further, the system and method may receive a query language statement comprising a request to access a first column of a row from the plurality of rows. The system and method may process the request and determine if access may be granted to a user based on the security policy definition in the system.

Row level security

Resource use is recorded with a partitioned reference counter. The sum of all resource counter partitions is equivalent to the total references to a resource. When one resource counter partition reaches zero, it is possible that the resource should be destroyed. To determine if this is the case, all other partitions can be checked for a value of zero. If all the partitions are zero, the resource can be destroyed. Coarse grained partitioning and add/release on all partitions can be employed to avoid extra work associated with a local partition reaching zero. Further, destroying or deleting a resource can be accomplished in a manner that avoids a race condition.

Partitioned reference counter

Aspects of the subject matter described herein relate to auditing operations. In aspects, operations may be audited synchronously and/or asynchronously to one or more audit targets. When auditing synchronously, audit records may be written synchronously to an audit target. When auditing asynchronously, a buffer may be used to store audit records until the audit records are flushed to an audit target. If an error occurs in auditing, a policy may be evaluated to determine how to respond. One exemplary response includes failing an operation that triggered a subsequent audit record. Furthermore, if a buffer was unable to be copied to an audit target, the contents of the buffer may be preserved and one or more retries may be attempted to copy the buffer to the audit target.

Preventing audit loss for asynchronous target

Various technologies and techniques are disclosed for improving configuration of database audits. Multiple audits can be created for a database. Any one of the audits can be turned off without impacting an operation of any remaining audits. Database audits can be ported from one database server instance to another. Database audit metadata is stored in a database separately from a database server instance to which the database is attached. The database can be detached from the database server instance and attached to a second database server instance, with the database audit metadata moving along with the database automatically. Any audits associated with the database audit metadata are automatically activated for the second database server instance. Database audits can be configured using a hierarchical model.

Configuration of multiple database audits

When rich data is tunneled, its associated link identified by a primary data reference is changed by swapping primary references of original data with changed data. Thus, without duplicating the rich data, it is now associated with the changed data, preserving it in constant time. The primary references can include, but are not limited to, names and/or other item identifications. This technique allows preservation of rich data to occur without burdening processing and/or time constraints based on the size and/or number of rich data elements. The technique also allows disparate applications and/or systems to maintain data integrity even when rich data is not expected for a given application and/or system. Since the rich data follows a primary reference, awareness of the rich data is not required for it to be properly handled, ensuring its integrity.

Rich data tunneling

The subject invention provides a system and/or a method that facilitates adapting at least two disparate file systems. A file system adapter can provide uniformity and/or seamless integration between a first file system and a second file system. The file system adapter can employ a file-backed item that is enriched by a file to provide at least one of a property to an item and a file stream associated with the item. The file-backed item can allow a manipulation by at least one of an API for the first file system and an API for the second file system.

File system represented inside a database

Growing community of inventors

Bothell, WA, United States of America

Jack Smith Richins