Microsoft Technology Licensing, LLC

Sriram Kottarakurichi Rajamani

Joseph M Joy

Kapil Vaswani

John J Lambert

Baskar Sridharan

Mitica Manu

Prasad G Naldurg

Victor V Boyko

Stefan Schwoon

Ramarathnam R Venkatesan

Marcus Peinado

Mark Eugene Russinovich

Manuel Costa

Ganesan Ramalingam

Raghunath Ramakrishnan

Balasubramanyan Ashok

Orion Tamlin Hodson

Pushkar Vijay Chitnis

Aditya Nori

Shastry M C Shankara

Sumit Gulwani

Vipindeep Vangala

Andrew Donald Gordon

Thore Graepel

Jacek Andrzej Czerwonka

Krishna Kumar Mehra

Venkatesh-Prasad Ranganath

Kaushik Rajan

Gopal Ranganatha Srinivasa

Christopher L Conway

Johannes Borgstroem

Hongkang Liang

Rahul Srinivasan

Shashank Yaduvanshi

Prakash Chandrasekharan

Aravinda P Sistla

Sumit K Jha

Bhargav Gulavani

Operating upon encrypted data with a particular data scope. A base encryption key is established and associated with the particular data scope, and then stored in a base encryption key store. That base encryption key store might be managed by an application or service that stores base encryption keys for multiple data scopes. A proxy encryption key acts as a kind of proxy for the base encryption key. The proxy encryption key may be used for frequent operations on encrypted data within the particular data scope. Thus, the principles described herein act as a frequency amplifier that allows key-based operations upon the particular data scope to be performed at much higher frequencies than otherwise would be possible by operating directly using the base encryption key.

Data operations using a proxy encryption key

Data may be encrypted using a derived block encryption key for each of at least one append blocks of data. A data operation associated with manipulating particular data associated with a user may be received. The particular data may comprise at least one append block of data. In response to the received data operation, for each append block of data of the at least one append block of data, parameters associated with deriving a block encryption key for a given append block of data of the at least one append block of data may be accessed. The parameters may comprise at least a data encryption key associated with the user and a nonce. A block encryption key may be derived for the given append block of data utilizing the parameters. The given append block of data may be encrypted utilizing the block encryption key.

Encryption using multi-level encryption key derivation

Techniques to secure computation data in a computing environment from untrusted code. These techniques involve an isolated environment within the computing environment and an application programming interface (API) component to execute a key exchange protocol that ensures data integrity and data confidentiality for data communicated out of the isolated environment. The isolated environment includes an isolated memory region to store a code package. The key exchange protocol further involves a verification process for the code package stored in the isolated environment to determine whether the one or more exchanged encryption keys have been compromised. If the signature successfully authenticates the one or more keys, a secure communication channel is established to the isolated environment and access to the code package's functionality is enabled. Other embodiments are described and claimed.

Techniques to secure computation data in a computing environment

A platform that facilitates software application development, maintenance, and support includes a storage component that receives structured and unstructured data pertaining to at least one application subject to development, maintenance, or support and causes the structured and unstructured data to be stored in a distributed fashion over a plurality of accessible data repositories. The storage component causes the structured and unstructured data to be stored in the data repositories such that the structured and unstructured data is accessible through utilization of a common access format. An executor component executes an analytical process over the structured and unstructured data and generates a first dataset, wherein the storage component causes the first dataset to be stored in at least one of the plurality of accessible data repositories in a format that is accessible by front end analysis applications.

Distributed analytics platform

A facility is described for analyzing access control configurations. In various embodiments, the facility comprises an operating system having resources and identifications of principals, the principals having access control privileges relating to the resources, the access control privileges described by access control metadata; an access control scanner component that receives the access control metadata, determines relationships between principals and resources, and emits access control relations information; and an access control inference engine that receives the emitted access control relations information and an access control policy model, analyzes the received information and model, and emits a vulnerability report. In various embodiments, the facility generates an information flow based on access control relations, an access control mechanism model, and an access control policy model; determines, based on the generated information flow, whether privilege escalation is possible; and when privilege escalation is possible, indicates in a vulnerability report that privilege escalation is possible.

Analyzing access control configurations

There is provided a method and system for modeling a data generating process. The method includes generating a dyadic Bayesian model including a pair of probabilistic functions representing a prior distribution and a sampling distribution, and modeling a data generating process based on the dyadic Bayesian model using observed data. The method includes generating a learner object for the dyadic Bayesian model. The method further includes training the dyadic Bayesian model with the learner object based on the observed data to produce a trained dyadic Bayesian model. The method also includes generating a posterior distribution over parameters based on the trained dyadic Bayesian model. The method also further includes generating a posterior predictive distribution based on the posterior distribution. The method also includes predicting an outcome of observable variables based on the posterior predictive distribution.

Modeling a data generating process using dyadic Bayesian models

Software debugging recommendation technique embodiments are presented that generally entails creating a database of characterized software bug descriptions and providing software debugging recommendations from the database in response to a query. This can employ a two-phased approach in the search for similar software bugs. The first is a search phase that takes a query as input and returns a ranked list of software bug descriptions that match the query. These bug descriptions can contain a mix of structured and unstructured data. The second phase is a related-information phase that uses the output of the first phase to retrieve a set of related recommendations such as for people, source files, functions and binaries.

Software debugging recommendations

A quantified belief propagation (QBP) algorithm receives as input an existentially quantified boolean formula (QBF) of existentially quantified boolean variables, universally quantified variables, and boolean operators. A tripartite graph is constructed, and includes (i) there-exists nodes that correspond to and represent the existentially quantified variables, (ii) for-all nodes that correspond to and represent the universally quantified variables, and (iii) sub-formula nodes that correspond to and represent sub-formulas of the QBF. A set of boolean values of the existentially quantified variables is found by (i) passing a first message from an arbitrary sub-formula node to an arbitrary for-all node, and (ii) in response, passing a second message from the arbitrary for-all node to the arbitrary sub-formula node.

Program synthesis with existentially and universally quantified belief propagation using probabilistic inference

Described are methods of providing data sharing between applications. The applications run on different computers, communicate via a network, and share a same distributed object. Each application maintains on its computer an invariant copy of the distributed object and a variant copy of the distributed object. Each application performs update operations to the distributed object, where such an update operation issued by a given one of the applications is performed by: executing the update operation on the variant copy maintained by the given application (i) without the given application waiting for the other applications to perform the operation (each invariant copy is guaranteed to converge to a same state) and (ii) at each of the applications, including the given application, executing the update operation on the corresponding invariant copies.

Programming model for collaborative distributed systems

A facility is described for analyzing access control configurations. In various embodiments, the facility comprises an operating system having resources and identifications of principals, the principals having access control privileges relating to the resources, the access control privileges described by access control metadata; an access control scanner component that receives the access control metadata, determines relationships between the principals and the resources, and emits access control relations information; and an access control inference engine that receives the emitted access control relations information and an access control policy model, analyzes the received information and model, and emits a vulnerability report. In various embodiments, the facility generates an information flow based on access control relations, an access control mechanism model, and an access control policy model; determines, based on the generated information flow, whether privilege escalation is possible; and when privilege escalation is possible, indicates in a vulnerability report that the privilege escalation is possible.

Locks are used to protect variables. All variables protected by a lock are allocated on a page associated with a lock. When a thread (called the owner) acquires the lock, a local copy of the memory page containing the variable is created, the original memory page is protected, and all access of the variable in the owner thread is directed to the local copy. Upon releasing the lock, the changes from the local copy are carried over to the memory page and the memory page is unprotected. Any concurrent access of the variable by non-owner threads triggers an exception handler (due to the protection mechanism) and delays such an access until after the owner thread has finished accessing the variable.

System to reduce interference in concurrent programs

A source code clarification system is described. In various embodiments, the source code clarification system receives clarified source code and transforms the clarified source code into standard source code or object code that implements asynchronous components. The standard software source code can contain expressions for enabling asynchronous communications. The clarified code can be software source code that is expressed in an imperative language and is capable of static analysis. The clarified source code can contain a coordination primitive that encapsulates interactions between asynchronous components. By using the coordination primitives and events, the clarified source code can express interactions between asynchronous components so that the clarified source code is easier for developers to understand and for static analysis tools to analyze.

Enabling analysis of software source code

Growing community of inventors

Bengaluru, India

Sriram Kottarakurichi Rajamani