Microsoft Technology Licensing, LLC

Neta Amit

Alexander Frank

Abraham Nathan

Nevet Basker

Eran Harel

Richard Bruce Ward

Michael M Swift

Yifat Peled

Two-phase filtering for a firewall is disclosed. In the first, general phase, a request is filtered to verify one or more of: that the request is pursuant to a supported protocol, that a command of the request is allowed, that the length of the request does not exceed the allowed maximum for the command, and that characters of the request are of an allowable type. Upon first-phase verification, a second phase is invoked that is particular to the protocol of the request. In the second, specialized phase, the request is filtered to verify one or more of the source, the destination, and the content of the request. Upon second-phase verification, the request is allowed to pass. If either first- or second-phase verification fails, then the request is denied.

Firewall with two-phase filtering

A method of controlling access to network services enables an authorized proxy client to access a service on behalf of a user. To permit the client to function as a proxy, the user registers proxy authorization information with a trusted security server. The proxy authorization information identifies the proxy client and specifies the extent of proxy authority granted to the proxy client. When the proxy client wants to access a target service on behalf of the user, it sends a proxy request to the trusted security server. The trusted security server checks the proxy authorization information of the user to verify whether the request is within the proxy authority granted to the proxy client. If so, the trusted security server returns to the proxy client a data structure containing information recognizable by the target service to authenticate the proxy client for accessing the target service on behalf of the user.

System and method of proxy authentication in a secured network

The invention relates to secured distributed impersonation, for use within systems such as batch system and batch message transaction systems. In one embodiment, a method includes sending a request for credentials of a network account from an originating account associated with an unpublished object to a dispatch associated with a published object. In one embodiment, both the unpublished and the published objects can each be a message queue. The dispatch authenticates the originating account. Upon successful authentication, the network account access emblem is sent to the originating account&#x2014;that is, the originating account receives the requested credentials, which facilitate the ability to impersonate into the network account.

Secured distributed impersonation

A trigger engine and infrastructure for event registration and handling that is reliable, secure and scalable. Transactional authenticated and/or encrypted messages (e.g., via MSMQ) are used to transport events across each server. A stable recovery mechanism is provided wherein the recovery path is nearly identical to the normal path. A trigger engine may concentrate multiple similar requests into a single base request for event notification, and upon receipt of the base event, access tables maintained in the trigger engine to track which client registered for which type of notification. In this manner, only the base event request is registered remotely, reducing the number of events that need to be communicated to remote servers. Identical event requests from clients may also be concentrated into a base event request, and events distributed to those clients when appropriate. Duplicate base event requests are blocked locally and thus only the first such one ever reaches the remote server. The trigger engines are capable of combining events in a complex manner, such as to notify a client only when a combination of time events, job events and/or other events have occurred, thus being suitable for use in a batch system.

Reliable, secure and scalable infrastructure for event registration and propagation in a distributed enterprise

Guaranteed, exactly once delivery of messages is disclosed. In one embodiment, there is a sender and a receiver. In a sender transaction, the sender does the following: receives a message from a sender queue; generates a substantially unique identifier and an expiration time for the message; and, saves the identifier, the expiration time, and the message in a sender database. The sender then sends the identifier, the expiration time, and the message to the receiver. In a receiver transaction, the receiver then does the following: receives the identifier, the expiration time, and the message from a receiver queue; determines whether the message has expired based on the expiration time and determines whether the message is present in a receiver database by its identifier; and, upon determining that the message has not expired and is not present in the receiver database, stores the message in the receiver database, and performs actions associated with the message.

Guaranteed exactly once delivery of messages

Two-phase filtering for a firewall is disclosed. In the first, general phase, a request is filtered to verify one or more of: that the request is pursuant to a supported protocol, that a command of the request is allowed, that the length of the request does not exceed the allowed maximum for the command, and that characters of the request are of an allowable type. Upon first-phase verification, a second phase is invoked that is particular to the protocol of the request. In the second, specialized phase, the request is filtered to verify one or more of the source, the destination, and the content of the request. Upon second-phase verification, the request is allowed to pass. If either first-or second-phase verification fails, then the request is denied.

Growing community of inventors

Haifa, Israel

Neta Amit