Microsoft Technology Licensing, LLC

Keith R Vogel

Rudolph Balaz

Xiaohong Su

Victor W Heller

Philip Joseph Hallin

Nathan P Myhrvold

Gideon Andreas Yuval

Richard M Shupak

Charlie D Chase

Robert I Davidson

Norman Eugene Apperson

Louis K Thomas

Paul J Leach

Kirt A Debique

Kelvin Shek Yiu

Richard P Draves

Kelvin Sjek Yiu

A virtual private network (VPN) enrollment protocol gateway is described herein. The protocol gateway is implemented as a registration authority that operates as an intermediary between routers and a certificate authority, allowing routers operating in accordance with one protocol to obtain and maintain certificates for a VPN from a certificate authority operating in accordance with another protocol. In accordance with one aspect, the gateway protocol supports various requests from the router, including router enrollment requests, get certificate revocation list request, get certificate requests, get certificate authority certificate requests, and password requests.

VPN enrollment protocol gateway

An update process is used to update root certificates in a root certificate store of a client computer, maintaining the integrity of the existing root certificates as well as any new root certificates. In accordance with certain aspects, the integrity of a certificate trust list identifying one or more root certificates is verified. The root certificate store of the client computer is modified in accordance with the certificate trust list if the integrity of the certificate trust list is verified.

Updating trusted root certificates on a client computer

An update process is used to update root certificates in a root certificate store of a client computer, maintaining the integrity of the existing root certificates as well as any new root certificates. In one embodiment, the root certificate store is updated by adding root certificates to the store, removing root certificates from the store, or modifying usage restrictions of root certificates in the store. A cryptographically signed message including a certificate trust list, as well as any new root certificates to be added to the root certificate store, is accessed by an update root control to update the root certificates in the root certificate store. The update root control verifies the integrity of the message, and thus the integrity of the certificate trust list contained therein. Once such integrity is verified, the update root control proceeds to update the root certificate store in accordance with the information in the certificate trust list. In another embodiment, root certificates in the root certificate store are updated when a World Wide Web web page is accessed by the client. A check is made during the access as to whether the client's root certificate store should be updated (e.g., a new root certificate is needed in order to access the web page). If the store should be updated, then the client is redirected to another web page that hosts the update root control. The update root control executes to update the client's certificate store, and then redirects the client back to the originally requested web page.

Hierarchical storage systems for holding objects used for evidentiary purposes, and methods of manipulating such systems are described. A logical store is provided and one or more physical stores are associated with and accessible through the logical store. Access to the physical stores can take place through the logical store with a single call to an appropriate application programming interface. Associations within and amongst stores can be define. One particular type of association is a context link which enables one evidentiary object in one physical store to get its context from another evidentiary object in another physical store.

Hierarchical storage systems for holding evidentiary objects and methods of creating and operating upon hierarchical storage systems

A computer system includes a plurality of client processes executing in respective address spaces and at least one server process executing in a different address space than the client processes. The server process has one or more available server objects for potential use by the client processes. The server objects are accessible by the client processes through a plurality of server object interfaces dynamically created in response to demand for said interfaces by the client processes. The server object interfaces are destroyed when there is no further demand for them. Each object interface can be simultaneously held for use during at least a portion of its lifetime by more than one of the client processes. The computer system further includes one or more client-side ping managers and at least one server-side ping manager. Each client process registers interfaces it is holding for use with an associated client-side ping manager. The server-side ping manager is associated with the server process and stores one or more interface lists indicating server object interfaces held for use by client processes. The server-side ping manager has a ping manager object interface available to the client-side ping managers. Each client-side ping manager accesses the server-side ping manager through the ping manager object interface to maintain an interface list with the server-side ping manager indicating server object interfaces which are registered with the client-side ping manager. Each client-side ping manager monitors whether any of its registered client processes have terminated, and automatically unregisters the interfaces of any such client processes which have terminated. The server-side ping manager notifies the server process of any server object interfaces which are no longer included in the interface lists of the server-side ping manager so that those interfaces can be destroyed.

Efficient inter-process object and interface pinging

The present invention provides a method and system for determining an optimal placement order for basic blocks within a computer program to improve locality of reference and reduce the working set of the computer program. By reducing the working set, the computer program requires less memory than it normally would require to execute on a computer system. The optimal placement order for basic blocks within a computer program reflects the concurrency of usage for basic blocks during execution of the computer program. The method for determining an optimal placement order includes analyzing the computer program to identify all of the basic blocks, determining how many times each basic block is executed, assigning a placement order to each basic block depending upon how many times each basic block was executed, and reordering the basic blocks according to their assigned placement orders to produce an optimized computer program. The method used to identify all of the basic blocks includes disassembling known instruction addresses to identify the beginning and end of basic blocks and processing jump tables to identify more instruction addresses. Processing jump tables includes processing the first entry of every jump table before processing the second entry of any jump table. The present invention further optimizes a computer program by replacing rarely executed instructions with other instructions that require a smaller amount of storage space.

Method and system for improving the locality of memory references during execution of a computer program

The present invention provides a method in a computer system for selecting instrumentation points in a computer program. Instrumentation points are locations within the computer program at which instrumentation code is inserted. The method includes identifying code portions such as basic blocks in the computer program code, creating a control flow graph out of the code portions, generating a spanning tree for the control flow graph, and then selecting those edges of the control flow graph which are not a part of the spanning tree as instrumentation points. After instrumentation points are selected, instrumentation code may be added at those locations. When the computer program is executed, the added instrumentation code records execution information such as how many times an instrumentation point is accessed during execution of the computer program. Using the recorded execution information and direction specified in the control flow graph, execution information for the non-instrumented blocks may then be calculated.

Growing community of inventors

Duvall, WA, United States of America

Keith R Vogel