Microsoft Technology Licensing, LLC

Qi Cao

Parul Manek

Ganesh Pandey

Ayla Kol

Kameshwar Jayaraman

Brijesh Bhupendra Desai

Steven Jay Lieberman

Siddharth Bhai

James J Simmons

Anuj Dhawan

Amit A Bapat

Umit Akkus

Scott Field

Liqiang Zhu

Colin Harrison Brace

Christopher Warner McCarron

William James Whalen

William S Jack

Gopinathan Kannan

Ramesh Chinta

Ryan James Fairfax

Paul J Miller

Gokay Hurmali

Khushru M Irani

Alexandru Hanganu

Zhe (Jessie) Li

William S Jack, Iii

Greg Johnson

Methods, systems, and computer programs are presented for protecting restricted actions on encryption keys that control the management of data stored by a service provider. In some implementations, a system of the service provider receives a request to generate a data encryption policy (DEP) for data stored by the system of the service provider for a customer, the request including a reference to a customer key and an availability key. The customer key and the availability key are root keys for encrypting a data encryption key. The data encryption key is used to encrypt the data stored by the service provider for the customer. Further, destructive changes to the availability key require receiving an approval from an account of the service provider. The system of the service provider validates the DEP. The system of the service provider stores the DEP based on the validation.

Protection for restricted actions on critical resources

Methods, systems, and computer programs are presented for protecting restricted actions on encryption keys that control the management of data stored by a service provider. In some implementations, a of the service provider receives a request to generate a data encryption policy (DEP) for data stored by the of the service provider for a customer, the request including a reference to a customer key and an availability key. The customer key and the availability key are root keys for encrypting a data encryption key. The data encryption key is used to encrypt the data stored by the service provider for the customer. Further, destructive changes to the availability key require receiving an approval from an account of the service provider. The of the service provider validates the DEP. The of the service provider stores the DEP based on the validation.

This disclosure describes methods, systems, and application programming interfaces for creating a credential managed account. This disclosure describes creating a new password managed account, defining the password managed account, wherein the password managed account is to access a service on a managed computing device, identifying the password managed account for a lifecycle, and automatically managing the password managed account by updating and changing a password for the password managed account on a periodic basis.

Isolation of services or processes using credential managed accounts

An offline trust system establishes a trust relationship between a trust authority computer system and a target computer system without relying on an active network connection between the computer systems. The offline trust system separates the trust establishment operation into a provisioning phase and a configuration phase. The provisioning phase can be performed entirely on the trust authority, while the configuration phase can be performed entirely on the target computer system requesting trust. The two phases can be performed at different times and do not assume any connection between the two computer systems. An administrator may perform the provisioning phase for many target computer systems at the same time. Thus, the offline trust system provides a way to establish trust between computer systems that is more reliable and less prone to failure.

Establishing trust relationships between computer systems

Dynamically associating an attribute and an associated value to an object includes dynamically associating attribute-value sets to an object, but is not so limited. An exemplary system includes a directory component that can be configured to dynamically assign different values, for a set attributes, to an object. An exemplary directory application can be configured to select an attribute-value set for an object based in part on a group membership determination, and a precedence parameter associated with an attribute-value, set, or other grouping. Other embodiments are available.

Dynamically associating attribute values with objects

Growing community of inventors

Bellevue, WA, United States of America

Qi Cao