Microsoft Technology Licensing, LLC

Mayank Mehta

Dharma Kiritkumar Shukla

Akash Jeevan Sagar

Frank Byrum

Kumarswamy P Valegerepura

Aditya G Bhandarkar

Chandresh Kumar Jain

Robert Brian Schmidt

Jeffrey B Kay

Abhay Vinayak Parasnis

Christopher Barnes

Michael Nelte

Mayerber Carvalho Neto

Mark Nathan Wain

Ayse Yesim Koman

Mihai Costea

Karthik Raman

Nathan Christopher Talbert

Trevor William Freeman

Jeremy De Souza

Edward Thomas Banti

Gregory Kostal

Vladimir Yarmolenko

Ladislau Conceicao

Charlie Ricafort Chung

Yuhui Zhong

David T Fong

Brian Kress

Mayerber Loureiro De Carvalho Neto

Victor William Habib Boctor

Tejas Patel

Pankaj Mohan Kamat

Wilson Li

Chris Barnes

Charles R Salada

Greg Gourevitch

Dennis Pilarinos

Jonathan LeCroy

Israel Hilerio

Victor Boctor

Scott C Cottrille

Hao Zhang

Amit Fulay

Krassimir Emilov Karamfilov

Balinder Malhi

Jesse M Dougherty

Eddie Fusaro

Sergey Chub

Yao Lu

James R Knibb

Mayerber L Carvalho Neto

Bob Schmidt

Muralidhara Varma Chiluvuri

Ravi S Vedula

Eli Hisdai

Jain Chandresh

Sunitha Samuel

Abhay c/o Microsoft Corp Parasnis

A method for confidential electronic communication between a sender workstation and a receiver workstation is provided, whereby privacy is guaranteed for the electronic communications transmitted over the public Internet. The method of confidential communication is equipped with message tracking and message receipt verification. The system for implementing the method includes a sender server that creates a session content encryption key along with a message envelope that includes a content encryption key encrypted message and a confidential mail token. The content encryption key is stored securely inside the sender organization's system which transmits the message envelope to an intended recipient. The intended recipient processes the message envelope in order to generate a message receipt verification, which is transmitted to the sender. The message receipt verification is processed by the sender server to verify that the message envelope reached the intended recipient. The message receipt verification, which is comprised of the confidential mail token and unique verification data generated by the intended recipient allows the sender server to verify that the message envelope reached the intended receiver and that the message envelope identified as received is authentic. Following verification that the message transmitted by the sender reached the intended receiver and is authorized, the sender transmits the content encryption key to the intended receiver.

Confidential mail with tracking and authentication

An email security system is described that allows users within different organizations to securely send email to one another. The email security system provides a federation server on the Internet or other unsecured network accessible by each of the organizations. Each organization provides identity information to the federation server. When a sender in one organization sends a message to a recipient in another organization, the federation server provides the sender's email server with a secure token for encrypting the message to provide secure delivery over the unsecured network.

Secure message delivery using a trust broker

Architecture for generating a temporary account (e.g., an email address) with a user-supplied friendly name and a secret used to the sign the temporary account. For example, when a user wishes to create a temporary email address to use with an online organization, a friendly name is provided and the system generates a temporary email address including the friendly name. A signing component signs the temporary email address with a secret. One or more of these secrets can be provisioned prior to the user's creation of a friendly name, which eliminates propagation delay. During use, only incoming email messages having the temporary email address signed with the secret are validated. When the user revokes the temporary email address, the secret is revoked and the revocation is propagated to network gateways, rejecting any email sent to that address.

Signed ephemeral email addresses

A hosting provider operates a server system that provides a service to one or more tenants. The server system receives configuration data from the tenants. As part of providing the service to a given tenant, the server system attempts to access an external service due to the configuration data received from the given tenant identifying the external service. Service access errors can occur when attempting to access the external service. In response to determining that an error has occurred when attempting to access the external service, the server system sends a service access alert to a recipient associated with the given tenant. The service access alert notifies the recipient that the error has occurred.

Alerting recipients to errors occurring when accessing external services

A perimeter network may be utilized to filter electronic mail messages destined for an internal network. A computer may be utilized to monitor an electronic mail mailbox for changes to a safe recipients list and/or a blocked senders list. The computer may further be utilized to automatically copy the safe recipients list and/or the blocked senders list to a network directory in the internal network. The computer may further be utilized to automatically send the safe recipients list and/or the blocked senders list to a network directory in the perimeter network for utilization by one or more agents executing on a computer in the perimeter network. The one or more agents may be configured to utilize the safe recipients list and/or the blocked senders list to filter electronic mail messages received by the perimeter network which are destined for delivery to the internal network.

Filtering of electronic mail messages destined for an internal network

Business to business secure mail may be provided. Consistent with embodiments of the invention, a protected message may be received. The recipient may request a token from a trust broker, submit the token to an authorization server associated with the sender, receive a user license from the authorization server; and decrypt the protected message using the user license. The protected message may restrict actions that may be taken by the recipient, such as forwarding to other users.

Business to business secure mail

The present invention extends to methods, systems, and computer program products for separating authorization identity from policy enforcement identity. Embodiments of the invention extend the consumption phase for protected information. Two identities, an authorization identity and a policy enforcement identity, are used for acquiring, issuing and enforcing usage license instead of one identity certificate. The authorization identity is used to evaluate against usage policy. The authorization identity is similar to identification information in an identity certificate. The policy enforcement identity is used to ensure the confidentiality of granted permissions and content key. The policy enforcement identity enforces a usage license on an authorization principal's (e.g., recipient's) machine. The policy enforcement identity's enforcement of a usage license is similar use of a cryptographic key in an identity certificate.

Separating authorization identity from policy enforcement identity

A user interface for building a componentized workflow model. Each step of the workflow is modeled as an activity that has metadata to describe design time aspects, compile time aspects, and runtime aspects of the workflow step. A user selects and arranges the activities to create the workflow via the user interface. The metadata associated with each of the activities in the workflow is collected to create a persistent representation of the workflow. Users extend the workflow model by authoring custom activities.

Extensible framework for designing workflows

Enabling creation of control flow patterns in a workflow via continuations. Each continuation represents an activity execution context for an activity executing in the workflow by a workflow engine virtualizing a managed execution environment. Responsive to a request, the activity execution context is recreated via the continuation and the activity is executed within the recreated context.

Framework for modeling continuations in workflows

Systems for providing sign-up email addresses are disclosed herein. A user may set up a sign-up email address for receiving emails from a trusted, Internet-based enterprise. The user may set up a dedicated mailbox folder associated with the sign-up email address or enterprise. The email server may automatically direct emails coming from that enterprise into that folder. To 'unsubscribe,' the user needs only to delete the folder or the sign-up address. Emails from the enterprise to the sign-up address may be highlighted in the user's main inbox. Thus, the user may be assured that any such email is truly from the enterprise, and not a phishing expedition or spam. Such systems also provide the user with effective tools to recognize phish or spam emails that appear to be from the trusted enterprise and not to act on them.

Secure transactional communication

Asynchronous fault handling for a workflow. A state automaton for an activity in the workflow is defined. The state automaton includes at least an executing state, a faulting state, and a closed state and classifies an execution lifetime of the activity. The activity is defined to include work items and includes an execution hierarchy for the work items. Each work item includes an operation for executing a portion of the activity. Each work item is transitioned to the executing state. The included operation of transitioned work items is executed in the executing state. One or more of the transitioned work items are identified in response to the faulting event as a function of the execution hierarchy and the included operation. The faulting event is asynchronously handled by transitioning the one or more identified work items to the faulting state while executing the included operation of the remaining transitioned work items.

Asynchronous fault handling in process-centric programs

Growing community of inventors

Redmond, WA, United States of America

Mayank Mehta