Microsoft Technology Licensing, LLC

Apptio, Inc.

Venkatesh Krishnan

Andrey Shur

Irina Gorbach

Lars Kuhtz

Dmitry Denisov

Michael Entin

David Tijerina

Shankar Lakshmi Regunathan

Christian Liensberger

Roy Peter D'Souza

Kunal Mukerjee

Rahul V Auradkar

Ziv Kasperski

Stéphane Nyombayire

Santosh Balasubramanian

Sumant Mehta

Marina Galata

Michael Ray Clark

Darrell J Cannon

Sumalatha Adabala

Gitika Aggarwal Saubhasik

Edward Mark Hayman

Embodiments are directed towards infrastructure benchmarking based on dynamic cost modeling. Raw customer models that represent a customer's business system may be ingested into a benchmarking system and mapped to customer models based on one or more standard models. Benchmarking information that may be generated from one or more community models that are one or more customer models of other customers that may be available to the benchmarking application. Additional third-party information, such as, industry survey information may also be used for generating benchmarking information. The benchmarking information may be used to generate reports that include comparisons between one or more customer models and the one or more community models. The benchmarking information may be continuously updated based on changes to customer models and/or data, community models and/or data, external information.

Infrastructure benchmarking based on dynamic cost modeling

Embodiments are directed towards for models for visualizing resource allocation. A plurality of data models may be provided to a benchmarking engine. The benchmarking engine may be employed to provide a plurality of benchmark models based on the plurality of data models. If an organization is selected, additional actions may be performed including: providing one or more of the plurality of benchmark models based on a data model that corresponds to the organization and one or more model objects of the data model; and, employing a visualization engine to provide a visualization that compares one or more resource allocations associated with the one or more model objects with the one or more benchmark models, such that the visualization is displayed on a hardware display for viewing by a user.

Models for visualizing resource allocation

The present invention extends to methods, systems, and computer program products for forming data responsive to a query. Responding to a query can include selecting data views on top of data sources. A data catalog stores data elements from different data sources and stores links between data elements from the different data sources. A view can be selected for a query based on one or more of: classification of data included in the data catalog or prior usage of data included in the data catalog. A selected data view is populated with data elements from the data catalog using the links to determine that data elements spanning multiple data sources satisfy the query. The data catalog can be used to identify relationships between data elements from different data sources that would not otherwise be identified.

Forming data responsive to a query

Embodiments are directed to identifying allocation discrepancies. Data models and Benchmark models may be provided to an analysis engine. Discrepancy models may be provided to the analysis engine, such that each discrepancy model may be arranged to include one or more rules. The analysis engine may be employed to search for discrepancies in the data models based on the discrepancy models and the benchmark models. If discrepancies may be identified by the analysis engine, one or more notifications may be provided to one or more users. Also, the discrepancy models may be modified based on subsequent feedback provided by the one or more users. Correlations in the resource allocation values may be identified based on machine learning that includes one or more of linear regression, deep learning neural networks, or the like. And, additional discrepancy models may be provided based on the identified correlations.

Identifying resource allocation discrepancies

A digital escrow pattern for data services can include selective access for obscured data at a remote site or in a cloud service, distributing trust across multiple entities to avoid a single point of data compromise. Based on the pattern, a 'trustworthy envelope' for any kind of payload enables curtained access through a variety of decorations or seals placed on the envelope that allow for a gamut of trust ranging with guarantees such as, but not limited to, confidentiality, privacy, anonymity, tamper detection, integrity, etc. For instance, XML tags can be applied or augmented to create trust envelopes for structured XML data. Some examples of mathematical transformations or 'decorations' that can be applied to the XML data include, but are not limited to, size-preserving encryption, searchable-encryption, or Proof(s) of Application, blind fingerprints, Proof(s) of Retrievability, etc.

Trustworthy extensible markup language for trustworthy computing and data services

Embodiments are directed to securing data in the cloud, securely encrypting data that is to be stored in the cloud and to securely decrypting data accessed from the cloud. In one scenario, an instantiated trust service receives information indicating that a trust server is to be instantiated. The trust service instantiates the trust server, which is configured to store key references and encrypted keys. The trust service receives the public key portion of a digital certificate for each publisher and subscriber that is to have access to various specified portions of encrypted data. A data access policy is then defined that specifies which encrypted data portions can be accessed by which subscribers.

Trust services for securing data in the cloud

The present invention extends to methods, systems, and computer program products for creating data views. Embodiments of the invention allow automatic creation of data views/projections on top of data sources. A view can be created on one data source (by looking at one or multiple data elements within the data source) or by looking at multiple data sources (of the same or different data types) and combining elements into a view. Data sources can be any kind of data source, including but not limited to: databases, files, and Web services. Views can be picked from a set of predefined views, picked from views of another tenant (either statically or using fuzzy logic), selected based on data element classifications and/or data element relationship classifications, selected based on data usage (e.g., by looking at logs), etc.

Creating data views

Embodiments include method, systems, and computer program products for filtering trust services records. Embodiments include receiving a trust services record that includes a plurality of security components and that is usable to secure data that is stored in an untrusted location. It is determined whether the trust services record has been tampered with, including verifying each of the plurality of security components of the trust services record. The trust services record is filtered based on the determination of whether the trust services record has been tampered with. The filtering includes, when the trust services record is determined to have not been tampered with, allowing performance of at least one task with respect to the secured data; and, when the trust services record is determined to have been tampered with, disallowing performance of any task with respect to the secured data.

Securely filtering trust services records

Embodiments are directed to mapping encryption policies to data stored in a database using a policy identifier, and to accessing data stored in a database using a policy identifier. In one scenario, a computer system receives an indication that identifies which type of encryption is to be applied when encrypting a specified portion of data stored in a database. The database has a database schema identified by a database schema identifier, where the database schema defines relationships for data stored in the database. The computer system then accesses a namespace that identifies a set of databases in which the specified portion of data is accessed in the same manner. The computer system also generates a policy identifier, which contains information including the namespace and the database schema identifier.

Data mapping using trust services

Embodiments are directed to securely filtering trust services records. In one scenario, a client computer system receives at least one of the following trust services records: a trust services certificate, a principal certificate, a group certificate and a trust services policy. The client computer system performs a time validity check to validate the trust services record's timestamp, performs an integrity check to validate the integrity of the trust services record and performs a signature validity check to ensure that the entity claiming to have created the trust services record is the actual creator of the trust services record. The client computer system then, based on the time validity check, the integrity check and the signature validity check, determines that the trust services record is valid and allows a client computer system user to perform a specified task using the validated trust services record.

Embodiments are directed to mapping encryption policies to user data stored in a database using a policy column uniform resource identifier (URI). In one scenario, a computer system receives the following: a database schema name that identifies the name of a specified schema within a relational database in which user data is stored, a table name that identifies a specified table within the relational database, a column name that identifies a specified column in the specified table and a namespace identifier that identifies a set of relational databases. The computer system also receives an indication that identifies which type of encryption is to be applied when encrypting the column of data specified by the column name. The computer system then generates a policy column URI that includes a hierarchical string comprising the namespace identifier, the database schema name, the table name and the column name.

Growing community of inventors

Sammamish, WA, United States of America

Venkatesh Krishnan