Microsoft Technology Licensing, LLC

Kevin T Damour

Neil Scott Fishman

Leszek Mazur

Lihua Yuan

Thekkthalackal Varugis Kurien

David Michael Sauntry

Lingan Satkunanathan

Peter Gregg Miller

Albert Gordon Greenberg

Sharad Agarwal

Michael Todd Kramer

Scott Manchester

Donald J Kadyk

Randall Kern

Dean P Paron

Theodore H Roberts, Iii

Bhawandeep Singh Panesar

Paul J Leach

Tanmoy Dutta

Murli D Satagopan

William Alexander Stevenson

Liqiang Zhu

Jeroen Vanturennout

Dmitri A Klementiev

Saurabh Mahajan

Tara Sanathanan Prakriya

Michael Richard Yagley

Adam C DePue

David McPherson

Huseyin Gokmen Gok

Vladimir A Shubin

Lawrence Brozak Sullivan, Jr

Sindhura Tokala

Methods, systems, apparatuses, and computer-readable storage mediums are described for authorizing publishing of a message and/or a subscription from an Internet of Things (IoT) device. In an example system, a message broker receives a list of attributes from a claims provider. The message broker determines whether publishing of the message is authorized based at least on the list of attributes, and publishes the message if it is determined that the publishing is authorized. The message broker may also receive a subscription specifying a topic filter. The message broker determines whether the subscription is authorized for the IoT device based at least on the list of attributes, and transmits a subscription message to the IoT device if it is determined that the subscription is authorized.

Efficient attribute-based access control authorization for a message broker

Methods, systems, apparatuses, and computer-readable storage mediums are described for bridging brokers of messages from Internet of Things (IoT) devices. In an example system, a first message broker receives a message and an associated topic from an IoT device. A bridging coordinator accesses a topic-to-broker map that indicates, for a second broker, a list of topic filters for which the second message broker has at least one subscriber. The bridging coordinator determines whether the list of topics includes the associated topic. In response to a determination that the list of topic filters in the topic-to-broker map includes the associated topic, the bridging coordinator forward the message to the second message broker. In response to a determination that the list of topic filters does not include the associated topic, the bridging coordinator prevents forwarding of the message to the second message broker.

Efficient forwarding of messages through brokers by topic

Systems and methods for controlling an edge computing device. The method includes, receiving a user input requesting access to a resource of the edge computing device, determining whether the user has privileges to access the resource by: formulating a claims request which requests claims based on the determined identity of the user, sending the claims request to a local claims provider agent executed by a processor of the edge computing device, determining, based on claim request handling factors, whether the local claims provider agent can generate a token including the requested claims, and if so, generating the token with the requested claims; if not, a request may be sent to a cloud service-side claims provider to receive the token. The method includes authorizing access to the resource based on a predetermined policy that specifies the presence of a predefined resource parameter in the requested claims is sufficient.

Controlling access to resources of edge devices

This document relates to a distributed network coordinate system. One implementation provides computer-readable storage media including instructions that may cause a processor to perform certain acts. For example, the acts may include storing an initial network location of a first device in a network. The network may include the first device and a second device. The acts may also include monitoring one or more network performance metrics related to existing application communications with the second device, and determining an updated network location of the first device, based on the initial network location and the network performance metrics. Aspects of network health can be derived from monitoring changes in the network locations of various devices within the coordinate system.

Identifying problems in a network by detecting movement of devices between coordinates based on performances metrics

Distributed network coordinate system based on network performance

Modern network communications often require a client application requesting data to authenticate itself to an application providing the data. Such authentication requests can be redundant, especially in the case of stateless network protocols. When a full authentication is performed, a conversation identifier and one or more encryption keys can be agreed upon. Subsequent authentication requests can be answered with a fast reconnect token comprising the conversation identifier and a cryptographically signed version of it using the one or more encryption keys. Should additional security be desirable, a sequence number can be established and incremented in a pre-determined or a random manner to enable detection of replayed fast reconnect tokens. If the recipient can verify the fast reconnect token, the provider can be considered to have been authenticated based on the prior authentication. If an aspect of the fast re-authentication should fail, recourse can be had to the original full authentication process.

Fast-reconnection of negotiable authentication network clients

Today, data networks are ever increasing in size and complexity. For example, a datacenter may comprise hundreds of thousands of service endpoints configured to perform work. To reduce network wide degradation, a load balancer may send work requests to healthy service endpoints, as opposed to unhealthy and/or inoperative service endpoints. Accordingly, among other things, one or more systems and/or techniques for monitoring service endpoints, which may be scalable for large scale networks, are provided. In particular, a consistent hash function may be performed to generate a monitoring scheme comprising assignments of service endpoints to monitoring groups. In this way, multiple monitoring components may monitor a subset of endpoints to ascertain health status. Additionally, the monitoring components may communicate between one another so that a monitoring component may know heath statuses of service endpoints both assigned and not assigned to the monitoring component.

Monitoring service endpoints

Systems and methodologies that facilitate hosting of a domain name and access of users to the Internet, by using a well defined protocol to interact with a plurality of Dynamic Domain Name Service (DDNS) providers, via employing; a purchasing component and a status verifying component. Once a user has selected a domain name, the purchasing component can automatically query the provider(s) for terms of the service plan to host such domain name associated with dynamic IP addresses. The status verifying component can verify the IP address of the end user machine and supply it to the DDNS, to manage in-bound traffic to the user's domain name.

Message based network configuration of dynamic domain name services

A computer communicates with a referral server according to a web service definition to select and audit performance of an internet service. The computer sends and receives messages requesting internet services available in a geographic region and the message includes an identifier where the computer is located. Other received messages indicating available services including, top-level-domains, currency, and languages available in the geographic region. For example, for domain name services, messages include top-level domains, and for other services, messages include currency, languages, etc. Messages include a list of providers available in the geographic region, and for each provider in the list, a provider name, a description of provider services, or a provider URL. The computer sends other messages that audited selected provider performance including, a provider selected to provide an internet service, an indication of successful transaction, an indication of successful configuration, or an indication of failure.

Message based network transmission for selection and auditing of internet services

A computer performs a method of communicating with a referral server to identify configurables available to the computer based on the computer's location and at least one other factor. The computer receives a list of provider servers selected by the referral server for referring to the computer because the provider servers on the list auto-configure configurables in the computer's location and according to the at least one other factor. The method communicates with a provider server selected from the list to purchase a selected configurable and to auto-configure the computer's computing environment to operate the selected configurable. The method communicates with the referral server to provide a metric about the provider server's performance during purchase and auto-configure.

Automated acquisition and configuration of goods and services via a network

Systems and methodologies that facilitate purchase and/or transfer of a domain name and access of users to the internet by using a well defined protocol to interact with a plurality of domain name registrars via employing a purchasing component and a mapping component. Once a user has identified a domain name, the purchasing component can automatically query the provider(s) for terms of the service plan to obtain such domain name. The mapping component can then point to a DNS provider designated to host such domain name, to manage in-bound traffic. The subject invention can also be implemented in web services based hosted solutions directory, for example by designation of a trusted on-line registry that registers a plurality of service providers to supply services to clients, with a secure communication between the clients and the trusted on-line registry for selection of a service provider.

Message based network configuration of domain name purchase

Methods, systems, computer program products and data structures are described which allow a client to communicate with a server even though multiple proxies that require different authentication data must be traversed to allow such communication. In operation, the client first authenticates to a first proxy using authentication data appropriate for the first proxy. The client then authenticates to a second proxy using different authentication data that is appropriate for the second proxy. This proxy authentication continues through as many proxies as necessary until the client is in communication with the server.

Authentication through multiple proxy servers

Methods and systems for authentication through multiple proxy servers that require different authentication data

Growing community of inventors

Bellevue, WA, United States of America

Kevin T Damour