Microsoft Technology Licensing, LLC

Other

Mark Eugene Russinovich

James Ernest Johnson

Kahren Tevosyan

Thomas Moscibroda

Galen Clyde Hunt

Manuel Costa

Boris Markus Scholl

William Michael Zintel

Ajay Mani

George Joy

Brian Robert Crawford

Ravi Chandru Shahani

Mahmood Gulam Qadir

Vito J Sabella

Sylvan Wesley Clebsch

Ashok Chandrasekaran

Yunus Mohammed

Brian Scott Lounsberry

Pritesh Patwa

Chandan Rama Reddy

Matthew Kerner

Naga Govindaraju

Marcus Peinado

Yang Chen

Kapil Vaswani

Chuang Wang

Hervey O Wilson

Marcus Felipe Fontoura

Sriram Kottarakurichi Rajamani

Wesley G Miller

Chetan S Shankar

Manuel Silverio Da Silva Costa

Bryan William Tuttle

Ranveer Chandra

Tae Hyung Kim

Dharma Kiritkumar Shukla

Feng Zhao

David Allen Dion

George M Moore

Charles Lamanna

Avnish Kumar Chhabra

Melur K Raghuraman

Haishi Bai

Yaron Schneider

James O Todd

Amy M Lewis

Ken Ming-Kin Yip

Vitaliy Titov

Wojtek Kozaczynski

Christopher M Lang

Jonathan K Johnson

Brian P Ellis

Vyom P Munshi

Orion Tamlin Hodson

Cédric Alain Marie Christophe Fournet

Antoine Jean Denis Delignat-lavaud

Ravikiran Janardhan Reddy

Pavel Zakharov

Abhishek Pratap Singh Chauhan

Gregory Marvin Door

Sean David Zimmerman

Xiaoxiong Tian

Phani Soma Shekar Burela

Alejandro Matute Gonzalez

Huy Vu-Bao Hoang

Bryce Cogswell

Gopal Kakivaya

Corey M Sanders

Ian C Jirka

Zhengping Qian

Ronald John Kamiel Euphrasia Bjones

Milan Vukosavljevic

Jiaxing Zhang

Boris Baryshnikov

Mohit Srivastava

Ziv Rafalovich

Xiangyao Yu

Srinivas S Nidadavolu

Wei-Lun Tsai

Amaury Pierre Paul Chamayou

Prateesh Goyal

Ilias Marinos

David A Matson

Matthew M Kerner

The present disclosure relates to systems, methods, and computer-readable media for deploying cloud-native services across a plurality of cloud-computing platforms. For example, systems disclosed herein identify resource identifiers associated with cloud-computing services (e.g., types of services) to be deployed on one or more resources capable of executing or otherwise providing cloud-native services. The systems disclosed herein further generate resource bindings including deployment specifications that include data for deploying cloud-native services on corresponding platform resources (e.g., cloud resources, edge resources). Using the resource bindings, the systems disclosed herein can deploy cloud-native services across multiple platforms via control planes configured to manage operation of resources on the different platforms.

Deploying cloud-native services across control planes

Examples are disclosed that relate to fairly ordering financial market trades received from different market participant computers via a cloud computing network. In one example, a plurality of trades generated by a plurality of market participant computers are received. The trades are generated based at least on a financial market data point received by the plurality of market participant computers. Each trade is tagged with a delivery clock time stamp that tracks time in relation to financial market events that occur at a corresponding market participant computer. The trades are ordered based on the delivery clock time stamps and sent to a central exchange server computer. The central exchange server computer processes the trades.

Response-time-based ordering of financial market trades

The disclosed technology is generally directed to zero knowledge confidential computing. In one example of the technology, via a prover, in a trusted execution environment, a private input and a public input are provided to a statement. The prover and the statement each include processor-executable code. Via the prover, in the trusted execution environment, execution of the statement is caused in the trusted execution environment such that the statement generates a result from at least the private input and the public input. Via the trusted execution environment, a measurement of the prover is signed and a measurement of the statement is signed. Via the prover, in the trusted execution environment, an attestation report is output. The attestation report includes the result, a commitment of the private input, the signed measurement of the prover, and the signed measurement of the statement. The attestation report does not include secret information.

Zero-knowledge confidential computing

A computing system is provided, including non-volatile storage storing a reactive database including a plurality of database entities. The computing system may further include a processor configured to, via a reactive database application program interface (API), receive a first standing query registration input including a first standing query. The first standing query may include a first update condition and may be associated with a first database entity. The processor may be further configured to store the first standing query in the non-volatile storage. The processor may be further configured to write data to the reactive database and determine that the first update condition is satisfied by the written data. In response to determining that the first update condition is satisfied, the processor may be further configured to execute the first standing query to perform a first state change at the first database entity of the plurality of database entities.

Standing query to reactive database

The disclosed technology is generally directed to a distributed query-and-command system. In one example of the technology, in a trusted execution environment (TEE) of a first node, database code of the first node and distributed ledger code of the first node is executed, such that execution of the distributed ledger code of the first node instantiates a first instance of a distributed ledger of a consortium blockchain, and such that execution of the query-and-command code of the first node instantiates a first instance of a query-and-command system. The consortium blockchain is distributed among a plurality of nodes, and the query-and-command system is distributed among the plurality of nodes. A first transaction that is associated with modifying the query-and-command system is received. The first transaction is executed. Changes associated with the first transaction to the distributed ledger are persisted.

Confidential blockchain database with a distributed ledger

The disclosed technology is generally directed to code transparency. In one example of the technology, a claim associated with an application is received. The claim is a document that is signed with a claim signature and that includes evidence associated with a policy, and further includes an expected set of at least one binary measurement associated with the application. The evidence is cryptographically verifiable evidence associated with the application. A trusted execution environment (TEE) is used to provide a distributed ledger. The claim is verified. Verifying the claim includes verifying the expected set of at least one binary measurement associated with the application, verifying the claim signature, and, based at least on the evidence, verifying that the application meets the policy. Upon successful verification of the claim, the claim is appended to the distributed ledger. A ledger countersignature associated with the claim is generated.

Code transparency system operation

The disclosed technology is generally directed to code transparency. In one example of the technology, evidence associated with a policy is obtained. The evidence includes data that includes cryptographically verifiable evidence associated with initial source code in accordance with the policy. The initial source code is source code for a CTS. The initial binary is based on the initial source code is executed in a TEE such that a CTS instance begins operation. The CTS instance is configured to register guarantee(s) associated with code approved by the CTS instance. The TEE is used to provide a ledger. The evidence is stored on the ledger. Measurement(s) associated with the binary are provided. A service key associated with CTS instance is generated. TEE attestation of the measurement(s), the evidence, and the service key is provided.

Bootstrapping a code transparency system

The disclosed technology is generally directed to network security for processors. In one example of the technology, a computing device includes: a processor, a memory, and a network interface. The computing device executes a first binary within a first region of the memory, executes a separate second binary within a second region of the memory, and prevents the second binary from accessing the first region of the memory. The first binary implements a kernel configured to control the network interface, while the separate second binary implements a network stack that is restricted to communicate only with an identified set of trusted servers.

Processor with network stack domain and system domain using separate memory regions

Various methods and systems are provided for autonomous orchestration of secrets renewal and distribution. A secrets management service ('SMS') can be utilized to store, renew and distribute secrets in a distributed computing environment. The secrets are initially deployed, after which, SMS can automatically renew the secrets according to a specified rollover policy, and polling agents can fetch updates from SMS. In various embodiments, SMS can autonomously rollover client certificates for authentication of users who access a security critical service, autonomously rollover storage account keys, track delivery of updated secrets to secrets recipients, deliver secrets using a secure blob, and/or facilitate autonomous rollover using secrets staging. In some embodiments, a service is pinned to the path where the service's secrets are stored. In this manner, secrets can be automatically renewed without any manual orchestration and/or the need to redeploy services.

Autonomous secrets renewal and distribution

Methods, systems, apparatuses, and computer program products are described herein that enable a vendor to publish a template to a network-accessible marketplace and that enable a customer to selectively utilize the templates to deploy an appliance to a customer account associated with the customer within a cloud services platform. In an embodiment, deploying the appliance to the customer account comprises deploying resources specified by the template as part of an appliance resource group within the customer account, the specified resources including an appliance management resource that is configured to expose control features of the appliance to the customer. In further accordance with the techniques described herein, access to the appliance resource group is provided to the vendor via a vendor account associated with the vendor within the cloud services platform.

Self-serve appliances for cloud services platform

The disclosed technology is generally directed to network security for processors. In one example of the technology, a device includes: hardware, including a network interface; a memory; and a processor. The memory is adapted to store run-time data for the device. The memory includes at least a first memory region and a second memory region. The processor that is adapted to execute processor-executable code including a first binary in the first memory region and a second binary in the second memory region. The first binary includes at least one application and a kernel. The kernel is configured to control the hardware. The second binary is configured to operate, upon execution, as a network stack. The device is configured such that the first memory region is protected such that the first memory region is inaccessible to the second binary.

A method of operating a telemetry system includes automatically populating a base field of a schema in an event definition using a logging library of the telemetry system for an event of an instrumented application, and automatically populating a conditional field of the schema in the event definition using the logging library in response to a selected condition for the event.

Telemetry system extension

The disclosed technology is generally directed to network security for processors. In one example of the technology, a device includes: a memory that is adapted to store run-time data for the device, and a processor. The processor is adapted to execute processor-executable code including a first binary that includes at least one application and a kernel, and a second binary. The second binary is configured to perform networking functions exclusively, including networking functions of one more of layers three through seven of the Open Systems Interconnection (OSI) model.

Processor with network processing stack having separate binary

Growing community of inventors

Hunts Point, WA, United States of America

Mark Eugene Russinovich