Microsoft Technology Licensing, LLC

Simon Porter

Affan Arshad Dar

Juan J Perez

Nicole Elaine Berdy

Rajeev Mandayam Vokkarne

Jelani Zukar Brandon

The disclosed technology is generally directed to communications in an IoT environment. In one example of the technology, device twins for corresponding IoT devices are stored, wherein the device twins include metadata that is associated with the corresponding IoT devices. A schedule job instruction may be received, and at least one candidate IoT device among the IoT devices that is associated with the schedule job instruction may be identified. In some examples, executors associated with the at least one candidate IoT device are created, and jobs are executed via the executors such that the executors are capable of resuming execution after at least one of an outage or a failure.

IoT device jobs

An existing Simple Authentication and Security Layer (SASL) framework is modified to overcome message size limitations by implementing a control byte that enables segmentation of SASL messages. In implementations in which client computing devices utilize a trusted platform module (TPM) for enhanced security, the client computing device can transmit multiple public keys and other information to a provisioning service during an attestation process. This information can be segmented across multiple messages while leveraging the SASL framework. A control byte may be utilized in each message and define attributes about the respective messages, such as whether a current message is an interim or final message segment. Likewise, the provisioning service can divide a challenge key into multiple segments and include a control byte for each segment. The control byte within segmented messages enables utilization of the TPM public keys and thereby can leverage the heightened security provided by the TPM.

Trusted platform module attestation flow over simple authentication and security layer with multiple symmetric key identification

A method for uniquely authenticating a device provides for receiving a scoping request, allocating a scope ID responsive to the request, and storing one or more device identification credentials in a database. Each device identification credential stored in the database includes the allocated scope ID and a device ID provided within the scoping request. The method further provides for receiving a registration request specifying a device identification credential and authenticating the specified device identification credential by confirming a match between the specified device identification credential and one of the device identification credentials stored in the database. The method further provides for provisioning the device with initial configuration information responsive to the authentication.

Growing community of inventors

Woodinville, WA, United States of America

Simon Porter