Microsoft Technology Licensing, LLC

Oleg Ananiev

Nir Nice

John F Wohlfert

Efim Hudis

Yigal Mordechai Edery

Eugene (John) Neystadt

Yair Tor

Patrik Schnell

Arthur Zavalkovsky

Amit Finkelstein

Daniel Rose

Anat Eyal

Anders Bertil Vinberg

John Eugene Neystadt

Daniel Kershaw

Asaf Kariv

Moshe Sapir

Alik Teplitsky

Alexander Teplitsky

Eli Tovbeyn

Embodiments of the invention provide techniques for basing access control decisions at the network layer at least in part on information provided in claims, which may describe attributes of a computer requesting access, one or more resources to which access is requested, the user, the circumstances surrounding the requested access, and/or other information. The information may be evaluated based on one or more access control policies, which may be pre-set or dynamically generated, and used in making a decision whether to grant or deny the computer access to the specified resource(s).

Network layer claims based access control

Systems, methods and apparatus for accessing at least one resource hosted by at least one server of a cloud service provider. In some embodiments, a client computer sends authentication information associated with a user of the client computer and a statement of health regarding the client computer to an access control gateway deployed in an enterprise's managed network. The access control gateway authenticates the user and determines whether the user is authorized to access the at least one resource hosted in the cloud. If the user authentication and authorization succeeds, the access control gateway requests a security token from a security token service trusted by an access control component in the cloud and forwards the security token to the client computer. The client computer sends the security token to the access component in the cloud to access the at least one resource from the at least one server.

Flexible end-point compliance and strong authentication for distributed hybrid enterprises

Secure content management is enabled as a cloud-based service through which security protection and policy enforcement may be implemented for both on-premise network users and roaming users. The global SCM service integrates the security functionalities&#x2014;such as anti-virus, spyware, and phishing protection, firewall, intrusion detection, centralized management, and the like&#x2014;that are typically provided by enterprise network SCM appliance hardware or servers into a cloud-based service that users reach via Internet-based points-of-presence ('POPs'). The POPs are configured with forward proxy servers, and in some implementations, caching and network acceleration components, and coupled to hubs which provide configuration management and identity management services such as active directory services.

Authentication in a globally distributed infrastructure for secure content management

Embodiments of the invention provide a trusted intermediary for use in a system in which access control decisions may be based at least in part on information provided in claims. The intermediary may request claims on behalf of a network resource to which access is requested, and submit the claims for a decision whether to grant or deny access. The decision may be based at least in part on one or more access control policies, which may be pre-set or dynamically generated. Because the intermediary requests the claims and submits the claims for an access control decision, the network resource (e.g., a server application) need not be configured to process claims information.

Trusted intermediary for network layer claims-enabled access control

Aspects of the subject matter described herein relate to authentication for a distributed secure content management system. In aspects, a request to access a resource available through the Internet is routed to a security component. The security component is one of a plurality of security components distributed throughout the Internet and responsible for authenticating entities associated with an enterprise. The security component determines an authentication protocol to use with the entity and then authenticates the entity. If the entity is authenticated, the entity is allowed to use a forward proxy.

Authentication for distributed secure content management system

Enterprise security assessment sharing for consumers using globally distributed infrastructure

Secure content management is enabled as a cloud-based service through which security protection and policy enforcement may be implemented for both on-premise network users and off-premise or roaming users. The global SCM service integrates the security functionalities&#x2014;such as anti-virus, spyware, and phishing protection, firewall, intrusion detection, centralized management, and the like&#x2014;that are typically provided by enterprise network SCM appliance hardware or servers into a cloud-based service that users reach via Internet-based points-of-presence ('POPs'). The POPs are configured with forward proxy servers, and in some implementations, caching and network acceleration components, and coupled to hubs which provide configuration management and identity management services such as active directory services.

Enterprise security assessment sharing for off-premise users using globally distributed infrastructure

Architecture that provides additional data that can be obtained and employed in security models in order to provide security to services over the service lifecycle. The architecture automatically propagates security classifications throughout the lifecycle of the service, which can include initial deployment, expansion, moving servers, monitoring, and reporting, for example, and further include classification propagation from the workload (computer), classification propagation in the model, classification propagation according to the lineage of the storage location (e.g., virtual hard drive), status propagation in the model and classification based on data stored in the machine.

Automated security classification and propagation of virtualized and physical virtual machines

Services using globally distributed infrastructure for secure content management

Growing community of inventors

Migdal Haemeq, Israel

Oleg Ananiev