Microsoft Technology Licensing, LLC

Michael James Zwilling

Cristian Diaconu

Per-Ake Larson

Robert P Fitzgerald

Hanumantha Rao Kodavalla

Craig Steven Freedman

William Jefferson Westerinen

Cenk Ergan

Michael Richard Fortin

Mark Joseph Zbikowski

Nathan Steven Obr

John M Parchem

Clark David Nicholson

Patrick L Stemen

Rajeev Y Nagar

Therron Powell

Dean L DeWhitt

Surenda Verma

Dan Teodosiu

Panagiotis Antonopoulos

Emily Nicole Hill

Kapil Vaswani

Srikumar Rangarajan

Artem A Oks

Rajeev Bashyam Rajan

Haohai Yu

Ajay S Manchepalli

Ramarathnam R Venkatesan

Jakub Kulesza

Jose A Blakeley

Gang He

Erik Ismert

Peter Byrne

Raul Garcia

Vishal Kathuria

Mark Wistrom

Marcel Van Der Holst

Gregory A Smith

Shashikant Brijmohan Khandelwal

Ryan L Stonecipher

David Bruce Lomet

Ajay Kalhan

Conor J Cunningham

Sameet Harishanker Agarwal

Emily Nicole Wilson

F Soner Terek

Martin J Sleeman

Nishanth Chandran

Ulrich Homann

Ruslan Pavlovich Ovechkin

Kangrong Yan

Jack Smith Richins

Srinath T V Setty

Steven R Schmidt

Lewis S Bruck

Alan David Fekete

Paul S Randal

Nagavamsi Ponnekanti

Daniel Teodosiu

Christoph Berlin

Dean L Dewhitt

Robert Patrick Fitzgerald

Cristian C Diaconu

Robert Patrick Fitgerald

An entity is enabled to access encrypted resources in response to verifying access criteria of a region-based security policy is met. For example, a resource request to access an encrypted resource is received from an entity. A determination that the encrypted resource is assigned to a first region and is protected by a region-based security policy is made. A proof of a region attribute indicating that the entity possesses the region attribute is received from the entity, the region attribute indicates the entity is associated with the first region. An encrypted version of the region attribute is obtained from a ledger database. The resource request is validated based at least on the encrypted attribute and the proof of the region attribute. A verification is made that an access criteria of the region-based security policy is met. The entity is provided access to the encrypted resource.

Region-based security policies for cloud resources

A decryption key is recovered that is utilized to decrypt an encrypted resource. For example, a determination is made as to whether a user and/or the user's computing device attempting to access an encrypted resource has the necessary attributes to access the resource and/or is in a valid location in which the user is required to be to access the resource. The attributes and/or location are defined by a policy assigned to the resource. To verify that the user has the required attributes, a proof is requested from the user that proves that the user has the required attributes. Upon validating the proof, the decryption key is generated and/or retrieved.

Zero-trust distributed data sharing

An in-memory database system stores an entirety of a database within main memory of the computer system. The database includes a table comprising a plurality of rows including a particular row. A first transaction updating the particular row is executed to create a first version of the particular row. A second transaction updating the particular row is executed to create a second version of the particular row. The first version is visible only to the first transaction, and the second version is visible only to the second transaction. The in-memory database system may associate an index with the database table, the index referencing the plurality of rows, including referencing the first version of the particular row and the second version of the particular row. The in-memory database system may initiate garbage collection of the first version of the particular row and/or the second version of the particular row.

In-memory database system

The subject disclosure relates to a distributed transaction management technique that ensures synchronization between participating nodes in a global or distributed database transaction. The technique leverages a commit protocol that uses local clocks at the respective participating nodes. Participants in a global transaction are configured to utilize the same commit timestamp and logical read time and can advance their respective local clocks to establish this synchronization. In one embodiment, distributed commit utilizes a modified version of two-phase commit that includes an extra phase to collect commit timestamp votes from participants. Additionally, a heartbeat mechanism can be used to establish loose synchronization between nodes. In another embodiment, a node can respond to a remote transaction request by returning a list of nodes involved in generating the result of the transaction and the types of access used by such nodes in addition to the transaction result itself.

Distributed transaction management

A log manager causing events to be written to the primary and the secondary computing systems for high availability, and returning threads quickly. Rather than cause every event write to be immediately written to the secondary computing system, the log management component is triggered to write to the secondary computing system upon detecting event write requests of event writes of a particular event type. In response to detecting such an event write, the log management component gathers a group of event writes corresponding to that particular event write, and dispatches the event writes as a group. The particular thread that initiated the particular event write of the particular event type is returned after dispatching the event write group, but before or without confirmation of the particular event write group has been written to the secondary computing system.

Early thread return with secondary event writes

The recovery of one or more transactions in a computing system in which one or more persistent systems are coupled via a bus to one or more processors. As an example, the persistent system may serve as at least part of the main memory of the computing system. The transaction might implement multi-versioning in which a record is not updated in place. Rather, each record is represented as a sequence of one or more record versions, each version having a valid interval during which the record version is considered to properly represent the record.

Recovery processing for database in persistent system

Methods, systems, and computer-readable media of columnar storage of a database index are disclosed. A particular columnar index includes a column store that stores rows of the columnar index in a column-wise fashion and a delta store that stores rows of the columnar index in a row-wise fashion. The column store also includes an absence flag array. The absence flag array includes entries that indicate whether certain rows have been logically deleted from the column store.

Columnar storage of a database index

Methods, systems, apparatuses, and computer program products are provided for processing queries. A data server includes a query processor configured to receive a query from a database application, which was received by the database application from a requestor. The query is directed to data stored at the data server. The query processor includes a deferred evaluation determiner and deferred expression determiner. The deferred evaluation determiner is configured to analyze the query, and to designate the query for deferred evaluation by the database application if a predetermined factor is met, such as the query including an operation on encrypted data that is not supported at the data server. The deferred expression determiner is configured to determine expression evaluation information for evaluating at least a portion of the query at the database application. The query processor provides the encrypted data and the expression evaluation information to the database application for evaluation.

Computing on encrypted data using deferred evaluation

Running a transaction against a database that allows the transaction to be automatically retried when the transaction fails such that certain transaction failures that cause the transaction to be automatically retried are not visible to an entity that receives data as a result of the execution of the transaction. A first set of statements of a transaction is identified by identifying statements that will cause a change in the database state. A second set of statements is identified, that result in data being generated to be sent to the entity. The method further includes executing the first set of statements to change the database. The method further includes running the second set of statements separately from the first set of statements to generate data to be sent to the entity.

Automatically retrying transactions with split procedure execution

A system and method of enabling row level security through security policies is disclosed herein. In this system and method, a computing device may be communicatively coupled to a storage device. The computing device may further be activated and maintain data that comprises a plurality of rows. When executed by the computing device, the system and method may process a data definition language statement comprising a security policy definition. Further, the system and method may receive a query language statement comprising a request to access a first column of a row from the plurality of rows. The system and method may process the request and determine if access may be granted to a user based on the security policy definition in the system.

Row level security

A system that uses a persistent main memory to preserve events that await logging in a persistent store. Each event is written into the persistent main memory so as to be loggable in case of recovery. For instance, the event may be written into a log cache structure, along with other state which identifies that the event is in the particular log cache structure, the location of the event within the particular log cache structure, and the order of the event. To recover, the log in the persistent store is evaluated to identify the end of the stored log. The tail of the log is identified in the persistent main memory by identifying any log cache structures that are after the end of the stored log and which are validly recoverable. The log cache structure contents are then serialized one log cache at a time, earliest first.

Tail of logs in persistent main memory

The present invention extends to methods, systems, and computer program products for main-memory database checkpointing. Embodiments of the invention use a transaction log as an interface between online threads and a checkpoint subsystem. Using the transaction log as an interface reduces synchronization overhead between threads and the checkpoint subsystem. Transactions can be assigned to files and storage space can be reserved in a lock free manner to reduce overhead of checkpointing online transactions. Meta-data independent data files and delta files can be collapsed and merged to reduce storage overhead. Checkpoints can be updated incrementally such that changes made since the last checkpoint (and not all data) are flushed to disk. Checkpoint I/O is sequential, helping ensure higher performance of physical I/O layers. During recovery checkpoint files can be loaded into memory in parallel for multiple devices.

Main-memory database checkpointing

An in-memory database system stores the entirety of a database that is being operated on by a database system within main memory. The database includes a table that comprises a plurality of rows including a particular row. The database table comprises a first version of the particular row having a first valid time, and a second version having a second valid time. Index(es) are associated with the database table. Each index references the plurality of rows, including referencing the first and second versions of the particular row. A transaction acting on the first version of the particular row is executed. The first version of the particular row is visible to the transaction based on the first valid time and the second version of the particular row being not visible to the transaction based on the second valid time.

Performing a transaction in the context of a computing system that has one or more persistent systems coupled to one or more processors over a bus. As an example, the persistent system may serve as at least part of the main memory of the computing system. The transaction might implement multi-versioning in which a record is not updated in place. Rather, each record is represented as a sequence of one or more record versions, each version having a valid interval during which the record version is considered to properly represent the record. The transaction processing uses torn write detection so that recovery processes may use such guards to verify that there are no torn writes. For instance, torn write guards may be used to verify the integrity of record versions as well as the log buffers that refer to the record versions.

Transaction processing using torn write detection

In order to provide a more efficient persistent storage device, one or more long-term storage media are included along with a non-volatile memory. In one embodiment, one portion of the non-volatile memory is used as a write buffer and a read cache for writes and reads to the long-term storage media. Interfaces are provided for controlling the use of the non-volatile memory as a write buffer and a read cache. Additionally, a portion of the non-volatile memory is used to provide a direct mapping for specified sectors of the long-term storage media. Descriptive data regarding the persistent storage device is stored in another portion of the non-volatile memory.

Non-volatile memory cache performance improvement

Growing community of inventors

Bellevue, WA, United States of America

Michael James Zwilling