Microsoft Technology Licensing, LLC

Amazon Technologies, Inc.

Upender Sandadi

Amjad Hussain

Scott Randall Shell

Neil Laurence Coles

Matthew G Lyons

Samuel Seung Keun Carl

Anupam Shrivastava

Yadhu Nandh Gopalan

Lloyd Alfred Moore

Andrew Michael Rogers

Adam Sapek

Anh Phuong Tran

Angelo Renato Vals

Gary Jason Waliczek

Christopher Ross Jordan

M Omar Maabreh

John Mark Miller

Loren Kohnfelder

Marc Shepard

David Michael Sauntry

Bor-Ming Hsieh

Javier Nisim Flores Assad

David S Bakin

Andrew D Rogers

Sharath Viswanathan

Keith C Bentley

Andrew L Nicholson

Albert Liu

Jon Vincent

Brian Hudson

Avinashreddy Bathula

Jimmy Alexander

Zoheb Vacheri

A state management server applies configuration information to a set of virtual computer system instances in accordance with one or more limitations specified by an administrator. In an embodiment, the limitations include a velocity parameter that limits the number of virtual computer system instances to which the configuration may be applied concurrently. In an embodiment, the limitations include an error threshold that stops the application of the configuration if the number of configuration failures meets or exceeds the error threshold. In an embodiment, the set of virtual computer systems is identified by providing a list of the individual virtual computer system instances, or by specifying one or more tags that are associated with the virtual computer systems in the set. In an embodiment, the administrator is able to specify that an association be applied according to a predetermined schedule.

Reconfiguration rate-control

An inter-process messaging security management may be provided. A message comprising an operation to be performed may be sent from a process operating in a process chamber to a second process operating in another chamber. Before the message is allowed to be delivered, the validity of the operation contained in the message may be verified and a security policy may be examined to determine whether the message is permitted to be sent from the first process to the second process. If the security policy permits the second process to execute the operation requested by the first process, the message may be delivered to the second process. If the operation is not permitted, the message may not be delivered and an error message may be returned to the first process.

Inter-process message security

Eviction priority technologies provide for the prioritized eviction of memory pages from a first memory, such as a DRAM, in a mobile computing device that have been copied from a second memory, such as flash memory. Eviction priority is based on eviction costs for the memory pages. The eviction cost for a page is based on page-in costs, page-out costs, the priority of a process associated with the page, page access probability and combinations thereof. Page-in costs include read costs, fixup costs and decompression costs, and page-out costs include write-back costs and compression costs. Page lists allow for the sorting of pages by page type (e.g., read only, read/write) and can be used to keep track of eviction costs. Pages are evicted from the first memory in order of increasing eviction cost.

Memory page eviction priority in mobile computing devices

Combining network connection maintenance operations that use a resource to extend battery life. Each of the network connections has a timer and a defined tolerance for early connection maintenance. After receiving notification of an event, the network connections are accessed to identify the connections for which a maintenance operation may be performed early based on the timer and the tolerance. In an embodiment, the maintenance operation includes sending a transmission control protocol (TCP) keep-alive packet on the connection.

Aggregating connection maintenance to optimize resource consumption

Embodiments provide a security infrastructure that may be configured to run on top of an existing operating system to control what resources can be accessed by an applications and what APIs an application can call. Security decisions are made by taking into account both the current thread's identity and the current thread's call chain context to enable minimal privilege by default. The current thread context is captured and a copy of it is created to be used to perform security checks asynchronously. Every thread in the system has an associated identity. To obtain access to a particular resource, all the callers on the current thread are analyzed to make sure that each caller and thread has access to that resource. Only when each caller and thread has access to that resource is the caller given access to that resource.

Granting least privilege access for computing processes

This disclosure describes techniques of using a centralized rule database to control the abilities of software processes to perform actions with regard to resources provided by a computer. As described herein, each software process executing in a computer executes within a chamber and each resource provided by the computer is associated with a canonical name that uniquely identifies the resource. Furthermore, the computer stores a set of security rules in a centralized rule database. In addition, this disclosure describes techniques of enforcing the rules stored in the centralized rule database.

Centralized enforcement of name-based computer system security rules

Methods, functional components and structures are disclosed for carrying out management of client/server processes operating within separate process spaces within a computer system. The disclosed methods, functional components facilitate and carry out management of client and server processes within a computer system such that a greater degree of control can be exhibited over their execution. An active server component process maintains a list structure identifying each client process that is currently using one of the server component process's interfaces. When a new client references a server, the list structure is augmented to include the system identification (e.g., handle) assigned by the operating system to the client process. A thread within the server process blocks while awaiting a triggering event (e.g., a client process in the list terminates). When the client process terminates, the block on the thread releases and the thread processes the change in client references. If the list of clients within the structure reaches zero, then the server process can immediately terminate.

Method and system for effective management of client and server processes

Growing community of inventors

Issaquah, WA, United States of America

Upender Sandadi