Microsoft Technology Licensing, LLC

Symform, Inc.

Amazon Technologies, Inc.

Quantum Corporation

Microsoft Corporation

Praerit Garg

Richard Bruce Ward

Robert P Reichel

Bassam Tabbara

Clifford P Van Dyke

Paul J Leach

Michael M Swift

Peter T Brundrett

Donald E Schmidt

Cliff Van Dyke

Christopher Andrew Evans

David Andrew Matthews

Murli D Satagopan

Reiner Fink

Giampiero M Sierra

Paul Stephen Hellyar

Victor Tan

Jianrong Gu

Everett McKay

Scott Field

Balan Sethu Raman

Sivaprasad Venkata Padisetty

John E Brezak

Kedarnath Atmaram Dubhashi

Bhalchandra Pandit

Mario C Goertzel

David A Orbits

Manivannan Sundaram

Sameer Palande

Brian D Andrew

Jeffrey B Hamblin

Sudarshan Anand Chitre

Dave M McPherson

Karthik Jaganathan

Manoj Krishna Ghosh

Martin Chen Mao

Kirk Soluk

Mark Pustilnik

Lekshmi Unnikrishnan

Bradley Scott Murphy

Anne C Hopkins

Christopher G Kaler

Yun Lin

John Peter Shewchuk

Giovanni Moises Della-Libera

Mark Joseph Zbikowski

Keith Stuart Kaplan

Thomas Jay Miller

Geoffrey Hugh Outhred

Jeffrey Bruce Parham

Shishir P Pardikar

Loren Kohnfelder

Klaus U Schutz

Shannon J Chan

Rohan Kumar

John J Lambert

Donald J Hacherl

James W Kelly

Bharat Shah

Wesley Allan Witt

Pratul Dublish

Michael Howard

Gary D Kimura

Brendan W Dixon

Jeffrey A Lawson

Hitesh Raigandhi

Kevin D J Grealish

Jin Huang

Gregory A Jensenworth

Vishnu A Patankar

Susi E Strom

Yang Gao

Xiaohong Wu

Mike K Lai

Keith S Kaplan

Peter Brundrett

Brian Andrew

Thomas J Miller

Gregory Jensenworth

A customer submits a request to a virtual computer system service to launch a virtual machine instance and to join this instance to a managed directory. The service may obtain, from the customer, a domain name and Internet Protocol addresses for the selected directory, which is then stored within a systems management server. When launched, the instance may initiate an agent, which may communicate with the systems management server to obtain the configuration information. The agent may use this configuration information to establish a communications channel with the managed directory and create a temporary set of computer credentials that may be used to verify that the customer is authorized to join the virtual machine instance to the managed directory. If the credentials are valid, the managed directory may generate a computer account within the managed directory, which may be used to join the virtual machine instance to the managed directory.

Automatic domain join for virtual machine instances

A hardware and/or software facility for durably and securely storing data within a shared community storage network. A user may have a storage device that they intend to share with others in the network. All or a portion of the storage device is registered with the community storage network as a storage node. Once registered with the network, third party data may be stored on the storage node and remotely accessed by third parties. In addition, data stored on the storage device by the user may be stored in the shared community storage network by encrypting the data, adding redundancy, and distributing it to other storage nodes within the storage network. Data that is stored in the storage network is accessible to the user even if their storage device is inaccessible or fails.

Shared community storage network

A role-based authorization management system maintains an authorization policy store that represents user authorizations to perform operations associated with an application. When a user attempts to perform a function associated with an application, the authorization management system verifies that the user is authorized to perform the requested function. The authorization management system also provides an interface for an application administrator to update role-based user authorization policies associated with one or more applications.

Role-based authorization management framework

A selective cross-realm authenticator associates an identifier with a request from an entity authenticated in one realm to access a resource associated with a second realm. The identifier indicates that the entity was authenticated in a realm other than the realm associated with the requested resource. A domain controller associated with the resource performs an access check to verify that the authenticated user is authorized to authenticate to the requested resource. Permissions associated with the resource can be used to specify levels of access to be granted to entities authenticated by a domain controller associated with another realm.

Selective cross-realm authentication

A storage device configured to join a shared community storage network. All or a portion of the storage device is registered with the community storage network as a storage node. Once registered with the network, third party data may be stored on the storage node and remotely accessed by third parties. In addition, data stored on the storage device by a user may be stored in the shared community storage network by encrypting the data, adding redundancy, and distributing it to other storage nodes within the storage network. Data that is stored in the storage network is accessible to the user even if their storage device is inaccessible or fails. The user may receive economic or non-economic incentives for allowing the storage device to join the shared community storage network.

Storage device for use in a shared community storage network

Modeling operational policies of operating a business's or institution's actual or planned IT system. The IT system may include components such as applications, application hosts, one or more networks or components thereof, hardware, and interrelationships between the components. The IT system is to be operated in accordance with operational policies that govern existence or numerosity of components, how the components are interrelated, how the components and interrelationships are configured, and/or manual or automated processes for managing and maintaining the IT system. The modeling may involve generating code that conforms to a language by declaring abstractions using types that correspond to the components of the IT system, by declaring types of interrelationships that correspond to the interrelationships of the IT system, and by defining constraints upon and between the abstract types, where the constraints correspond to operational policies of operating the IT system.

Modeling IT operations/policies

Improved intrusion detection and/or tracking methods and systems are provided for use across various computing devices and networks. Certain methods, for example, form a substantially unique audit identifier during each authentication/logon process. One method includes identifying one or more substantially unique parameters that are associated with the authentication/logon process and encrypting them to form at least one audit identifier that can then be generated and logged by each device involved in the authentication/logon process. The resulting audit log file can then be audited along with similar audit log files from other devices to track a user across multiple platforms.

Enhanced computer intrusion detection methods and systems

Described is a system and method for replicating each of a set of resources to a subject computer in a replica set prior to making use of a resource in the set of resources. The set of resources includes resources that are dependent upon each other for a proper functioning of the group. A manifest file that identifies each resource in a group of interrelated resources is used. The manifest file is generated at one computer in the replica set (typically the computer at which a modification to one of the interrelated resources occurred). When the modification occurs to one of the set of resources, the manifest file is transmitted (e.g., itself replicated) to each computer in the replica set. The manifest file includes an indicator that identifies the manifest file as a special file. When received at another computer in the replica set, a service evaluates the manifest file to identify whether the appropriate versions of the identified resources exist at the receiving computer. If not, the service at that computer awaits the receipt of each resource. The wait period may include delaying the execution of an application associated with (or even included within) the manifest file from launching. Alternatively, the FRS could simply disallow access to one or more resources identified in the manifest file until all have arrived. When all have arrived, the FRS releases control of the identified resources, which may then operate or be accessed in the ordinary manner.

System and method for reliably replicating data

A process identifies one or more roles associated with a target server. The process also identifies one or more services associated with each role and identifies one or more ports associated with each role. The identified ports associated with the role are presented to a user. The user is requested to select among the identified ports associated with the role.

Method and apparatus for configuring a server

An enterprise network architecture has a trust link established between two autonomous network systems that enables transitive resource access between network domains of the two network systems. The trust link is defined by data structures maintained by each of the respective network systems. The first network system maintains namespaces that correspond to the second network system and a domain controller in the first network system, or a first network system administrator, indicates whether to trust individual namespaces. An account managed by a domain in the second network system can request authentication via a domain controller in the first network system. The first network system determines from the trust link to communicate the authentication request to the second network system. The first network system also determines from the trust link where to communicate authorization requests when administrators manage group memberships and access control lists.

Authentication and authorization across autonomous network systems

Methods and arrangements are provided for use in multiple user computing environments. These methods and arrangements can be configured to allow for a plurality of separate and concurrent desktops and workspaces within the shared computing environment. One method includes creating a separate desktop thread for each user that is authenticated during a logon process, creating a separate desktop associated with each desktop thread, and maintaining a list of desktop threads that are created. In this manner, several users can be logged on simultaneously. In certain implementations, the method further includes establishing a separate user environment associated with each desktop and launching a separate user shell associated with each desktop. The list of desktop threads allows for selective and/or automatic switching from a first desktop to a second desktop without terminating a desktop thread associated with the first desktop. The methods and arrangements are also applicable to remote process logon and switching.

Methods and arrangements for providing multiple concurrent desktops and workspaces in a shared computing environment having remote nodes

Growing community of inventors

Kirkland, WA, United States of America

Praerit Garg