Microsoft Technology Licensing, LLC

Microsoft Corporation

Ravindra Pandya

Muthukrishnan Paramasivam

Paul England

Paul J Leach

Charles W Kaufman

Butler W Lampson

Melissa Wood Dunn

Carl Melvin Ellison

Charles F Rose

Thekkthalackal Varugis Kurien

David Earl Heckerman

Eric S Chung

Niels Thomas Ferguson

Daniel Lo

Scott C Cottrille

Kalin Ovtcharov

Gregory Kostal

Vladimir Yarmolenko

Yuhui Zhong

Vasantha K Ravula

Marco A Demello

Brian LaMacchia

Aidan T Hughes

Vinay Krishnaswamy

Blair Brewster Dillaway

Alan Geller

Peter David Waxman

Caglar Gunyakti

Vijay G Bharadwaj

Kristjan Eric Hatlelid

Sergey Bykov

Yue Liu

Gabriel Kliot

Raja Pazhanivel Perumal

Duncan G Bryce

Steven Bourne

Dave M McPherson

Xiaoxi Tan

Roman Snytsar

Jorgen Thelin

Satyajit Nath

Mike Hamburg

Charles F Rose, Iii

Paul J Lach

Comparisons between two nucleotide sequences can be performed by customized integrated circuitry that can implement a Smith Waterman analysis in series, as opposed to the parallel implementations known in the art. Series performance enables such customized integrated circuitry to take advantage of optimizations, including enveloping thresholds that demarcate between cells of a two-dimensional matrix for which nucleotide comparisons are to be performed, and cells of the two-dimensional matrix for which no such comparison need be performed, and, instead, a value of zero can simply be entered. Additionally, such customized integrated circuitry facilitates the combination of multiple control units, each directing the comparison of a unique pair of nucleotides, with a single calculation engine that can generate values for individual cells of the two-dimensional matrices by which such pairs of nucleotides are compared.

Customized integrated circuit for serial comparison of nucleotide sequences

Comparisons between two nucleotide sequences can be performed by customized integrated circuitry that can implement a Smith Waterman analysis in a reduced memory footprint, storing and referencing only individual portions, or subsections, of a two-dimensional matrix that is representative of the comparison between the two nucleotide sequences. As the backtracking proceeds, backtracking metadata corresponding to a cell from a subsection that is not currently retained in memory can be required. Such a subsection can be regenerated from previously generated scores associated with checkpoint cells of the two-dimensional matrix that comprise two edges of the subsection being regenerated. Moreover, to further reduce memory consumption, the backtracking metadata stored for each cell can comprise four binary digits: two indicative of a directional assignment, one indicative of whether the corresponding cell is part of a deletion stretching across multiple contiguous cells, and one analogously indicative of insertions stretching across multiple contiguous cells.

Reduced memory nucleotide sequence comparison

The subject disclosure is directed towards virtual components, e.g., comprising software components such as virtual components of a distributed computing system. Virtual components are available for use by distributed computing system applications, yet managed by the distributed computing system runtime transparent to the application with respect to automatic activation and deactivation on runtime-selected distributed computing system servers. Virtualization of virtual components is based upon mapping virtual components to their physical instantiations that are currently running, such as maintained in a global data store.

Virtualized components in computing systems

Systems and methods provide multiple partitions hosted on an isolation technology such as a hypervisor where at least one of the partitions, a local secure service partition (LSSP), provides security services to other partitions. The service partitions (LSSPs) host those high assurance services that require strict security isolation, where the service can be shared across partitions and accessed even when the user is not connected to a network. The LSSP also can certify the results of any computation using a key signed by a TPM attestation identity key (AIK), or other key held securely by the hypervisor or a service partition. The LSSPs may be configured to provide trusted audit logs, trusted security scans, trusted cryptographic services, trusted compilation and testing, trusted logon services, and the like.

Local secure service partitions for operating system security

The subject disclosure pertains to systems and methods that facilitate managing access control utilizing certificates. The systems and methods described herein are directed to mapping an access policy as expressed in an access control list to a set of certificates. The set of certificates can be used to grant access to resources in the manner described by the ACL. The certificates can be distributed to entities for use in obtaining access to resources. Entities can present certificates to resources as evidence of their right to access the resources. The access logic of the sequential ACL can be transformed or mapped to a set of order independent certificates. In particular, each entry, position of the entry in the list and any preceding entries can be analyzed. The analysis can be used to generate order independent certificates that provide access in accordance with the access policy communicated in the ACL.

Transformation of sequential access control lists utilizing certificates

The subject disclosure pertains to a domain identification system, comprising a principal that has a key and a mnemonically meaningless identifier, the mnemonically meaningless identifier is used to identify the component in a networked environment. The mnemonically meaningless identifier can be bound to the public key by a binding. The component may be part of a neighborhood of components, and each member component knows the members' binding.

Domain ID service

The subject disclosure pertains to systems and methods that facilitate managing groups entities for access control. A negative group is defined using a base group, where the negative group associated with a base group includes any entities not included in the base group. Negative groups can be implemented using certificates rather than explicit lists of negative group members. A certificate can provide evidence of membership in the negative group and can be presented for evaluation to obtain access to resources. Subtraction groups can also be used to manage access to resources. A subtraction group can be defined as the members of a first group, excluding any members of a second group.

Access control negation using negative groups

Abstracting access control policy from access check mechanisms allows for richer expression of policy, using a declarative model with semantics, than what is permitted by the access check mechanisms. Further, abstracting access control policy allows for uniform expression of policy across multiple access check mechanisms. Proof-like reasons for any access query are provided, such as who has access to what resource, built from the policy statements themselves, independent of the access check mechanism that provide access. Access is audited and policy-based reasons for access are provided based on the access control policy.

Abstracting security policy from, and transforming to, native representations of access check mechanisms

A license is issued to a user as decryption and authorization portions. The decryption portion is accessible only by such user and has a decryption key (KD) for decrypting corresponding encrypted digital content and validating information including an identification of a root trust authority. The authorization portion sets forth rights granted in connection with the digital content and conditions that must be satisfied to exercise the rights granted, and has a digital signature that is validated according to the identified root trust authority in the decryption portion. The user issued accesses the decryption portion and employs the validation information therein to validate the digital signature of the authorization portion. If the conditions in the authorization portion so allow, the rights in the authorization portion are exercised by decrypting the encrypted content with the decryption key (KD) from the decryption portion and rendering the decrypted content.

Flexible licensing architecture in content rights management systems

A method of avoiding a second login of user information in an encrypted disk computer system includes a communications path for transferring user login information. The login information is acquired and used by a first software module which authenticates the user to decrypt a disk with an encrypted operating system. The same login information is transferred using the communications channel to a second use which logs the user into the decrypted operating system. The method also supports multiple users through maintenance of multiple users credentials.

Logon and machine unlock integration

In a storage system, multiple information units are individually associated with an access control policy (ACP) of multiple ACPs. Each respective information unit corresponds to a respective information unit encryption key (IUEK). The multiple information units are grouped into encryption zones based on their associated ACPs. In a described implementation, each ACP is associated with a zone root key (ZRK). In another described implementation, each IUEK corresponding to a given information unit is encrypted by an IUEK corresponding to an information unit at a most-proximate linked node of the storage system.

Access control and encryption in multi-user systems

A resource of a first organization provides access thereto to a requestor of a second organization. A first administrator of the first organization issues a first credential to a second administrator of the second organization, including policy that the second administrator may issue a second credential to the requestor on behalf of the first administrator. The second administrator issues the second credential to the requester, including the issued first credential. The requestor requests access from the resource and includes the issued first and second credentials. The resource validates that the issued first credential ties the first administrator to the second administrator, and that the issued second credential ties the second administrator to the requester. The resource thus knows that the request is based on rights delegated from the first administrator to the requester by way of the second administrator.

Delegating right to access resource or the like in access management system

Disclosed herein is a technique for certifying distributable objects. The technique involves creating a certification for each distributable object to indicate properties of the object. Using certifications such as this, it is possible to accept objects having certain properties only from specified entities.

Certifying and grouping distributed objects

Growing community of inventors

Clyde Hill, WA, United States of America

Ravindra Pandya