Microsoft Technology Licensing, LLC

John Peter Shewchuk

Christopher G Kaler

Stephen James Millet

Giovanni Moises Della-Libera

Steven E Lucco

Bradford H Lovering

Arun K Nanda

Luis Felipe Cabrera

David E Langworthy

Gregory Scott Lindhorst

Erik B Christensen

Kim Cameron

Robert Meyer

Patrick James Ferrel

Walter W Smith

Paul J Leach

Richard F Rashid

Butler W Lampson

David Wortendyke

Henrik Frystyk Nielsen

Andrew Layman

Hervey O Wilson

Scott A Konersmann

David Edwin Levin

Donald F Box

John M Buehler

Satoshi Nakajima

Daniel Ron Simon

Anders Hejlsberg

Michael Joseph Toutonghi

Patrick James Helland

William L Portnoy

Scott David Guthrie

Gary Steven Burd

Robert S Wahbe

Dmitry Robsman

Mark T Anders

Manu Vasandani

Patrick Dengler

Stuart L S Kwan

Douglas A Walter

Xiao Xie

Christian F Huitema

Josh D Benaloh

Robert George Atkinson

Cristian Marius Ilac

Christopher Lee Mullins

Praerit Garg

Satish Ramchandra Thatte

Tanmoy Dutta

James M Lyon

Jeffrey C Schlimmer

Umesh Madan

Liqiang Zhu

David L Johnson

Craig Andrew Critchley

Alfred Lee

Erik B Olson

Geary L Eppley

Caleb Geoffrey Baker

Gennady Medvinsky

Andy Harjanto

Kevin Michael Schofield

Brendan W Dixon

Andreas K Luther

Charles R Reeves

Shiung-Vei Yong

Khushru M Irani

Matthew Wayne Gertz

Qian Wang

Charles Edgar Passmore

Mark H Lukovsky

Andrew Bortz

Steven E Luocco

Bill Barnes

Eric B Olsen

Christopher J Kaler

William Lawrence Portnoy

David A Wortendyke

David E Levin

Khushru Irani

A method implemented in a computing system includes receiving communications from a client device to a first web server via the Internet. The communications are associated with a plurality of operations requested by the client device and to be performed by a web service implemented by both the first web server and a second web server. The method further includes, responsive to the received communications, arriving at a consensus between the first and second web servers regarding an agreed-upon order of operations to be performed in response to the requested operations and, upon arriving at the consensus, generating a response by performing the requested operations in the agreed-upon order at both the first and second web servers. The web service has the same state subsequent to performing the requested operations at the first and second web servers. The generated response is returned to the client device via the Internet.

Binding CRUD-type protocols in distributed agreement protocols

Technologies are described herein for extending a federated graph with third-party data or metadata. A federated facet provider service registers with a federated graph provider service as a provider of a facet for a resource in a graph. For example, the federated facet provider service can provide a callback uniform resource locator ('URL') or a uniform resource identifier ('URI') template for resolving the callback URL. When the federated graph provider service receives a request for a facet from a service client, the federated graph provider service determines a callback network address for the federated facet provider service and obtains an authentication token for the federated facet provider service. A response is provided to the service client that causes the service client to redirect to the federated facet provider service to obtain the requested facet utilizing the authentication token. The federated facet provider service provides the requested facet directly to the service client.

Extending a federated graph with third-party data and metadata

A system and method for controlling distribution and use of digital identity representations ('DIRs') increases security, usability, and oversight of DIR use. A DIR stored on a first device may be obtained by a second device for use in satisfying the security policy of a relying party. Release of the DIR to the second device requires permission from a device or entity that may be different from the device or entity attempting to access the relying party. Further, the use of the DIR to obtain an identity token may separately require permission of even a different person or entity and may be conditioned upon receiving satisfactory information relating to the intended use of the DIR (e.g., the name of the relying party, type of operation being attempted, etc.). By controlling the distribution and use of DIRs, security of the principal's identity and supervisory control over a principal's activities are enhanced.

Remote access of digital identities

Various embodiments enable redundant or replica services, such as 'cloud' services, to be run at geographically distributed locations. Each replica is capable of performing operations that are generally, identically performed across all replicas. In the event of an interruption at one location, services in other locations can quickly and automatically take over operations. In one or more embodiments, a Distributed Agreement Protocol is utilized to bind a CRUD-type protocol as a state machine. Binding takes place through the use of a reverse proxy that is located at each of the locations at which the service is distributed. In at least some embodiments, the Distributed Agreement Protocol is implemented as the Paxos protocol or a variant thereof, and/or the CRUD-type protocol comprises the HTTP protocol.

Binding crud-type protocols in distributed agreement protocols

The subject disclosure relates to authorization based on a determination of permissions that can be granted for an action(s) to be performed on a resource. The determination of the permission is based on a set of rules that represent a theory including a notion of trust that has been divided into different sized tables. The tables are utilized to evaluate two or more input claims and to facilitate a determination of whether access to at least one system resource is to be granted. The evaluation can include matching the two or more input claims to rows in the table, wherein access is allowed if a match is found.

Access control management

Architecture for natively authenticating a client application to a web server via HTTP authentication. The Web Services Architecture, and more specifically, Web Services Security, is leveraged to enable legacy applications to access web services transparently to the existing legacy applications. A security support provider (SSP) is created that employs WS-* protocol to at least emulate ws-trust and ws-mex thereby enabling policy exchange via an HTTP protocol stack. Policy can be exchanged via a WWW-Authenticate header enabling legacy applications to use the WS-* family of protocols without modifying the client application. The WS-* protocols are abstracted into a generic programming interface for native client application use.

Native use of web service protocols and claims in server authentication

A distributed security system is provided. The distributed security system uses a security policy that is written in a policy language that is transport and security protocol independent as well as independent of cryptographic technologies. This security policy can be expressed using the language to create different security components allowing for greater scalability and flexibility. By abstracting underlying protocols and technologies, multiple environments and platforms can be supported.

Virtual distributed security system

A method and system are provided for delivering event messages in a secure scalable manner. A network includes an event distribution device serving as an event generation device for generating and disseminating an event message through the network to event distribution devices serving as edge event delivery devices having recipient devices connected thereto. Event messages may be encrypted at the event generation device for each of the destination recipient devices or event messages may be encrypted at each of the edge event delivery devices for delivery to respective recipient devices connected thereto. A signing key may also be included with the encrypted message such that the respective recipient devices may authenticate a sender of the encrypted message based on the signing key. Encryption keys may be established based on policies of the network of event distribution devices or based on policies of the respective recipient devices.

Secure internet-scale eventing

A cryptographic session key is utilized to maintain security of a digital identity. The session key is valid only for a limited period of time. Additional security is provided via a bimodal credential allowing different levels of access to the digital identify. An identity token contains pertinent information associated with the digital identity. The identity token is encrypted utilizing public-key cryptography. An identifier utilized to verify the validity of the digital identity is encrypted with the cryptographic session key. The encrypted identity token and the encrypted identifier are provided to a service for example. The service decrypts the encrypted identity token utilizing public key cryptography, and decrypts, with the cryptographic session key obtained from the identity token, the encrypted identifier. If the identifier is determined to be valid, the transaction proceeds normally. If the identifier is determined to be invalid, the transaction is halted.

Securely roaming digital identities

A routing protocol is provided for exchanging messages between an initial sender and an ultimate receiver, potentially via a set of intermediaries. The routing protocol provides an optional reverse message path that enables two-way message exchange patterns. The routing protocol can be expressed as a header entry within a message envelope, is independent of the underlying protocol, and can be generated at the application layer of a protocol stack. The routing protocol may allow each intermediary to process the message and dynamically alter the message path en route to the intended recipient.

Routing of network messages

Systems and methods for open content model Web service messaging in a networked computing environment are described. In one aspect, a transport neutral message is generated that includes message recipient, endpoint addressing information, and one or more reference properties. The reference properties include selectively opaque message context. The transport neutral message is bound to a transport protocol for communication to the message recipient. At least a portion of the selectively opaque message context is not directed to the message recipient.

Open content model Web service messaging

Methods and systems for providing a virtual network are disclosed. At least one layer of abstraction is created between network service applications and conventional network protocols by inserting an adaptive dispatcher between applications and network transport services on each machine in a network. The message protocol in the virtual network is extensible, allowing application programs to create new headers within any message as needed. The adaptive dispatcher contains handlers that route and dispatch messages within the virtual network based on arbitrary content within each message, including any combination of headers and/or data content. Each device on the virtual network has a virtual address to which messages are directed, allowing devices to move within the network without reconfiguring routing tables. Handlers may be automatically created when an event meeting predefined criteria occurs, including the non-occurrence of a condition, making the virtual network self-healing and adaptive to reconfiguration.

Virtual network with adaptive dispatcher

A method of securing communications between an application that includes a macro and a Web Service. The method includes an act of, at the macro, generating a request for data. The request for data comprises generating commands for retrieving data, generating security information, and embedding the commands for retrieving data and the security information in a request. The request for data is sent to the Web Service. The requested data is received from the Web Service if the security information provides appropriate authorization to receive the requested data.

Securely calling web services from macros

A message processor accesses an electronic message. The accessing message processor identifies, from within the electronic message, any communication session information associated with the accessing message processor. This can include identifying expressive XML instructions or XML data structures representing communication sessions or message sequences. The accessing message processor determines if any session information within the electronic message is to be modified. This can include inserting session information for new sessions or message sequences, updating existing session information, or removing session information for terminated or expired communication sessions or message sequences. The accessing message processor then routes the electronic message to another message processor. In some embodiments, an initiating message processor identifies cached session information that is used to initially establish a communication session. The identified session information is included in a session element that is routed to one or more receiving message processors.

Using expressive session information to represent communication sessions in a distributed system

Growing community of inventors

Redmond, WA, United States of America

John Peter Shewchuk