Microsoft Technology Licensing, LLC

Liqiang Zhu

Paul J Leach

Yi Zeng

Rajalakshmi Dani

Anand Madhava Menon

Cristian Marius Ilac

Tanmoy Dutta

Karthik Jaganathan

Jiahui Wang

Yu Huang

Scott Field

Siddhartha Mathur

Vikas Ahuja

Gennady Medvinsky

Neil Shipp

Christopher J Crall

Joel T Hendrickson

Nick Voicu

David Hetherington

Paul J Miller

Paul Howard Rich

Alexandru Hanganu

Guanghui He

Naveen Madan

Zhaoan Liu

Gavin Ackroyd

John Peter Shewchuk

Mark Fishel Novak

David Benson Cross

Peter T Brundrett

Kevin T Damour

Gopinathan Kannan

Ramesh Chinta

Tarek B Kamel

Dave M McPherson

Ryan James Fairfax

Andreas K Luther

Qi Cao

David McPherson

K Michiko Short

Siddharth Bhai

Jeremy Dominic Viegas

James J Simmons

Chang Chuen Kawaguchi

Umit Akkus

Jingjing Zhong

David Christiansen

Joshua Ball

Yu (Kyle) Huang

Paul H Rich

Christopher J c/o Microsoft Corporation Crall

The description relates to password reset security. One example can receive a login request and a password for a cloud-based user account. The example can also retrieve stored authenticated user information associated with the password. The example can further send a notification of the login request to a contact address associated with the cloud-based user account. The notification can contain at least some of the stored authenticated user information.

Password security

Tenant approval for operator access to tenant data is provided. In order to grant service personnel operators access to a tenant's data for performing a requested action, a lockbox determines a security group role to which an operator needs to be elevated to perform a requested action, computes a set of internal administrators and tenant administrators authorized to grant a temporary role elevation, and sends an access control request to the administrators. Upon receiving approval of the access control request from an internal administrator and a tenant administrator, the lockbox elevates the operator to the security group role, granting the operator a set of permissions needed in order to allow the operator to perform the requested action. Accordingly, tenants are enabled to control access to their data and scrutinize access requests per their company procedures and compliance needs.

Tenant lockbox

An input is received from a client device and is indicative of a desire to add a device for secure operations. Artifacts are generated and a quick response (QR) code is generated that represents the artifacts. The QR code is transmitted to the client device where it can be read by the device to be added, so the artifacts can be used in performing the secure operations.

Quick response (QR) code for secure provisioning

An approval request for a recurring workflow instance is received, that requests the execution of an instance of a recurring workflow. An authorization token is generated based upon the content of the particular workflow to be executed, the location where the workflow is to be executed, and a time period during which the workflow is to be executed. The authorization token is sent, along with a representation of a workflow to be executed, to a target machine for authorization and execution.

Authorization and authentication for recurring workflows

When a user inputs an action request, such as a requested command, to be performed on a target machine, a management system receives the request and verifies it with a separate authentication and permission system. The verified command request is sent to the target machine. An authentication worker on the target machine accesses a set of policies, local to the target machine, to identify a least privileged execution environment in which the requested command can be performed. The authentication worker on the target machine launches the requested command within the identified least privileged execution environment on the target machine.

Security and permission architecture

A data center operator is authenticated to obtain requested access to a data center by an approval mechanism on the data center that receives an access request that includes authentication information. The authentication information includes a smart card thumb print which comprises a value that uniquely identifies the smart card based on a private key generated within the smart card. The approval mechanism identifies access policies corresponding to the unique smart card identifier.

Smart card thumb print authentication

When a user inputs an action request, such as a requested command, to be performed on a target machine, a management system receives the request and verifies it with a separate authentication and permission system. The authentication and permission system verifies signatures on the request and signs it and generates an approved workflow package. The approved workflow package is sent to the target machine.

Permission architecture for remote management and capacity instances

This disclosure describes methods, systems, and application programming interfaces for creating a credential managed account. This disclosure describes creating a new password managed account, defining the password managed account, wherein the password managed account is to access a service on a managed computing device, identifying the password managed account for a lifecycle, and automatically managing the password managed account by updating and changing a password for the password managed account on a periodic basis.

Isolation of services or processes using credential managed accounts

A client can communicate with a middle tier, which can then, in turn, communicate with a back end tier to access information and resources on behalf of the client within the context of a system that can scale well. Each individual back end can establish a policy that defines which computing device can delegate to that back end. That policy can be enforced by a domain controller within the same administrative domain as the particular back end. When a middle tier requests to delegate to a back end, the domain controller to which that request was directed can either apply the policy, or, if the domain controller is in a different domain than the targeted back end, it can direct the middle tier to a domain controller in a different domain and can sign relevant information that the middle tier can utilize when communicating with that different domain controller.

Back-end constrained delegation model

This disclosure describes methods, systems and application programming interfaces for creating an advanced security negotiation package. This disclosure describes creating an advanced security negotiation protocol under a Simple and Protected Negotiation Mechanism (SPNEGO) protocol to negotiate an authentication scheme. The protocol describes defining a Windows Security Type (WST) Library message to protect negotiation data during the advanced security negotiation protocol. The protocol sends an initial message that carries multiple authentication messages to reduce redundant roundtrips and implements key exchanges by a mini Security Support Provider (SSP).

Advanced security negotiation protocol

Modern network communications often require a client application requesting data to authenticate itself to an application providing the data. Such authentication requests can be redundant, especially in the case of stateless network protocols. When a full authentication is performed, a conversation identifier and one or more encryption keys can be agreed upon. Subsequent authentication requests can be answered with a fast reconnect token comprising the conversation identifier and a cryptographically signed version of it using the one or more encryption keys. Should additional security be desirable, a sequence number can be established and incremented in a pre-determined or a random manner to enable detection of replayed fast reconnect tokens. If the recipient can verify the fast reconnect token, the provider can be considered to have been authenticated based on the prior authentication. If an aspect of the fast re-authentication should fail, recourse can be had to the original full authentication process.

Fast-reconnection of negotiable authentication network clients

Architecture for natively authenticating a client application to a web server via HTTP authentication. The Web Services Architecture, and more specifically, Web Services Security, is leveraged to enable legacy applications to access web services transparently to the existing legacy applications. A security support provider (SSP) is created that employs WS-* protocol to at least emulate ws-trust and ws-mex thereby enabling policy exchange via an HTTP protocol stack. Policy can be exchanged via a WWW-Authenticate header enabling legacy applications to use the WS-* family of protocols without modifying the client application. The WS-* protocols are abstracted into a generic programming interface for native client application use.

Native use of web service protocols and claims in server authentication

Growing community of inventors

Redmond, WA, United States of America

Liqiang Zhu