Microsoft Technology Licensing, LLC

Shane Brady

Andrey Lukyanov

Siddhartha Mathur

Rajmohan Rajagopalan

Rajalakshmi Dani

Nicolae Voicu

David Hetherington

Santosh Kumar

Luke Schoen

Jaskaran Singh

Jon Barry Avner

Vikas Ahuja

Michael Allan Friedman

Ruiyi Wang

Vinod Kumar

Haruya Shida

Selim Yazicioglu

Alexander MacLeod

Wing Man Yim

Colin Nash

Ramesh Arimilli

James Nunn

Rage Hawley

Bryan Atwood

Brent Alinger

Ann Williams

Jon Avner

Examples of the present disclosure describe systems and methods relating to the offline protection of secrets. A secret may be encrypted using a public key provided by the client. The client may have obtained the public key from a cryptographic hardware device, wherein the private key of the cryptographic key pair may be bound to the cryptographic hardware device. The encrypted secret may be transmitted by a service to the client using a secured or an unsecured transmission method. In some examples, the service may transmit a subsequent encrypted secret, which may invalidate a previously encrypted secret. In order to authenticate with the service, the client may select an encrypted secret for decryption. The client may access the private key stored by the cryptographic device and decrypt the encrypted secret with the private key. The client may then use the decrypted secret to authenticate with the service.

Offline protection of secrets

Techniques to contain lateral movement of attackers through just-in-time (JIT) provisioned accounts comprising an account management component to receive a request from a first account via a client device for a second account to access a server device in a set of server devices, an account authorization component to authorize the request for the second account based at least partially on account information associated with the first account, an account provisioning component to provision the second account to enable a client to access the server device, and an account notification component to provide account information associated with the second account to a client via the client device. Other embodiments are described and claimed.

Techniques to provide network security through just-in-time provisioned accounts

A secret (e.g. a password, key, certificate) is automatically generated by a system. For example, at the time of deployment of a computing machine, a password may be generated and securely stored by the system with other secrets. The password may be used by the system to perform various operations (e.g. configuring the machine, . . . ). When a secret is requested by a user to access a resource, a secret is provided to the user. Once the secret has been utilized by the user, the secret is reset and replaced with a newly generated secret. All/portion of the secrets may also be automatically regenerated. For example, when a breach occurs and/or is suspected, each of the secrets may be replaced with newly generated secrets and securely stored. Auditing and reporting may also be provided (e.g. each request/access to a secret is logged).

Scalable and automated secret management

Command sequencing may be provided. Upon receiving a plurality of action requests, an ordered queue comprising at least some of the plurality of actions may be created. The actions may then be performed in the queue's order.

Superseding of recovery actions based on aggregation of requests for automated sequencing and cancellation

Alerts based on detected hardware and/or software problems in a complex distributed application environment are mapped to recovery actions for automatically resolving problems. Non-mapped alerts are escalated to designated individuals or teams through a cyclical escalation method that includes a confirmation hand-off notice from the designated individual or team. Information collected for each alert as well as solutions through the escalation process may be recorded for expanding the automated resolution knowledge base.

Automated recovery and escalation in complex distributed applications

A system is provided for employing an orchestrator to deploy and implement changes to a system. A change request may be a system build, upgrade, and patches for updating a subset of files within the system. The orchestrator may initially perform a security check and a validation check on a received change request. Upon receiving validation and approval, the change request may be deployed and propagated through a series of deployment scopes. The deployment scopes may become increasingly larger to extensively test the applied change before fully implementing the change on the target system. The orchestrator may submit the applied change to a validation component for getting validation of the change within the deployment scope after each applied change within a deployment scope. After the change request has been deployed through the deployment scopes and validated, the change request may be deployed to the target system and fully implemented.

Automatic system upgrade orchestrator

Growing community of inventors

Seattle, WA, United States of America

Shane Brady