Microsoft Technology Licensing, LLC

Neil Shipp

Liqiang Zhu

Yi Zeng

Rajalakshmi Dani

Nick Voicu

David Hetherington

Anand Madhava Menon

Jiahui Wang

Victor Erwin Romano

Zhaoan Liu

Gavin Ackroyd

Guanghui He

Michael V Sliger

Paul A McDaniel

Yu Huang

Qi Xu

Yu (Kyle) Huang

When a user inputs an action request, such as a requested command, to be performed on a target machine, a management system receives the request and verifies it with a separate authentication and permission system. The verified command request is sent to the target machine. An authentication worker on the target machine accesses a set of policies, local to the target machine, to identify a least privileged execution environment in which the requested command can be performed. The authentication worker on the target machine launches the requested command within the identified least privileged execution environment on the target machine.

Security and permission architecture

Techniques disclosed herein describe methods for achieving resource affinity and scalability in dynamic environments by calculating the modulus of a numeric request identifier against a fixed selection of numbers. Using the proposed techniques yields a numeric request identifier and resource identifier combination that ensures a given resource possesses the unique state applicable to that user's request. Using a fixed selection of numbers thus maintains resource affinity while achieving scalability as resources are added to or subtracted from a pool of resources.

Resource affinity in a dynamic resource pool

Techniques to perform federated authentication are described. An apparatus may comprise a resource server may have an authentication proxy component to perform authentication operations on behalf of a client. The authentication proxy component comprises an authentication handling module operative to receive an authentication request to authenticate the client using a basic authentication protocol. The authentication proxy component also comprises an authentication discovery module communicatively coupled to the authentication handling module, the authentication discovery module operative to discover an identity server for the client. The authentication proxy component further comprises an authentication manager module communicatively coupled to the authentication discovery module, the authentication manager module operative to retrieve authentication information from the identity server using an enhanced authentication protocol, and authenticate the client to access resource services using the authentication information. Other embodiments are described and claimed.

Techniques to perform federated authentication

Mechanisms for updating an address book. A first computing system generates an address book update file format and provides the file to a second computing system. The file format contains several data fields. One of the data fields consists of a configurable list of attribute property identifications. These property identifications represent address book information such as e-mail address, phone number, first name, surname, and the like. A second data field comprises contact data that includes at least some of the properties identified by the configurable list. Changes to the information contained in the address book update may be made by simply adding or deleting attribute property identifications. This has the effect of allowing modifications to the address book file format without having to generate a new file format.

Flexible file format for updating an address book

A method of building an offline address book (OAB). An OAB data file and a table of attributes are generated at a server. The data file and table are transferred from the server to a client. The transferred data file and table are indexed by the client.

Client side indexing of offline address book files

Growing community of inventors

Bellevue, WA, United States of America

Neil Shipp