Microsoft Technology Licensing, LLC

Michael Richard Yagley

Elio Damaggio

Samuel John George

Cameron William Skinner

Chipalo Street

Affan Arshad Dar

Eustace Ngwa Asanghanwa

Damon Luke Barry

Varun Puranik

Arjmand Samuel

Juan J Perez

Angelo Roncalli De Novaes Pires Ribeiro

Anca Mihaela Antochi

Murli D Satagopan

William Alexander Stevenson

Jeroen Vanturennout

David Michael Sauntry

Kevin T Damour

Mahesh Sham Rohera

Peter Gregg Miller

Olivier Bloch

Angelo Roncalli Ribeiro

Rajasekharan Vengalil

Juan Perez

Methods, systems, apparatuses, and computer-readable storage mediums are described for authorizing publishing of a message and/or a subscription from an Internet of Things (IoT) device. In an example system, a message broker receives a list of attributes from a claims provider. The message broker determines whether publishing of the message is authorized based at least on the list of attributes, and publishes the message if it is determined that the publishing is authorized. The message broker may also receive a subscription specifying a topic filter. The message broker determines whether the subscription is authorized for the IoT device based at least on the list of attributes, and transmits a subscription message to the IoT device if it is determined that the subscription is authorized.

Efficient attribute-based access control authorization for a message broker

The disclosed technology is generally directed to communications in an IoT environment. In one example of the technology, a plurality of module twins that respectively correspond to a plurality of modules of edge applications on a plurality of edge devices are stored. The plurality of module twins individually include metadata associated with the corresponding module of the plurality of modules. At least one module of the plurality of modules to be modified by adding a declarative rule is determined, such that the declarative rule causes determining whether an event has been triggered based on a particular event having been determined to have occurred, and, in response to the triggering of the event, communicating the triggering of the event to at least one declarative target. The determined at least one module of the plurality of modules is caused to be modified by adding the declarative rule.

Distribution of events in edge devices

The disclosed technology is generally directed to communications in an IoT environment. In one example of the technology, a plurality of module twins that respectively correspond to a plurality of modules of edge applications on a plurality of edge devices are stored. The plurality of module twins individually include metadata associated with the corresponding module of the plurality of modules. A plurality of services is executed, such that the services of the plurality of services are configured to communicate with the modules of the plurality of modules. At least one service to be executed as a further module on at least one edge device of the plurality of edge devices is determined. The further module is caused to be deployed to the at least one edge device of the plurality of edge devices. Execution of the determined at least one service is ceased.

Hierarchical split of application between cloud and edge

The disclosed technology is generally directed to IoT technology. In one example of the technology, the following actions are performed for each module of a plurality of modules on a first edge device. An identification message that includes information associated with identification of the module is received. The validity of the module is then verified. After the module is verified, based at least in part on the identification message, an IoT support service is selected from a plurality of IoT support services. The module is then caused to be registered with the selected IoT support service. The plurality of modules are compositable together into an application for the first edge device. The modules of the plurality of modules are capable of being used interoperably with other modules without altering the other modules.

Recombining modules for applications using a common provisioning service

A plurality of module twins that respectively correspond to a plurality of modules of edge applications on a plurality of edge devices are stored. The plurality of module twins individually include metadata associated with the corresponding module of the plurality of modules. At least one further module to be deployed is determined. Edge devices of the plurality of edge devices to receive the determined at least one module are identified. The determined at least one further module is caused to be deployed to the identified edge devices. In response to deploying the determined at least one further module, the plurality of module twins is updated by adding, to the plurality of modules twins, modules twins corresponding to the deployed modules.

Deployment of modular applications from the cloud to local devices

The disclosed technology is generally directed to communications in an IoT environment. In one example of the technology, a virtual IoT device is maintained and controlled to act as a representation of a connected device. Communications are received from an IoT support service. The received communications from the IoT support service are acted in response to, including sending communications to the IoT support service in response to the received communications, and changing the virtual IoT device as if the virtual IoT device were the connected device. The connected device is communicated with based on changes in the virtual IoT device.

Cloud management of low-resource devices via an intermediary device

A root of trust is established between a cloud and an edge device that communicates with the cloud. The root of trust may be embodied as a secret device key securely stored by the edge device and the cloud. The edge device receives arbitrary cloud modules (workloads) that include guest/tenant code that may communicate with the cloud and possibly local/leaf devices connected to or included with the edge device. The edge device extends or diversifies the root of trust to the cloud modules based on the device key. New keys are derived from the device key. The new keys are used to sign credentials (e.g. tokens or certificates) for the respective cloud modules. This provides each cloud module with its own trusted unique cloud identity that can be verified by the cloud using the cloud's copy of the device key.

Trusted key diversity on cloud edge devices

Modular applications using a common provisioning service

Growing community of inventors

Kirkland, WA, United States of America

Michael Richard Yagley