Microsoft Technology Licensing, LLC

Other

Salesforce Com, Inc.

Vishal Agarwal

Octavian Tony Ureche

Narendra Shripati Acharya

Giridharan Sridharan

Jawahar Jain

Preston Derek Adam

Christopher Leonard Walstad

Lakshya Jain

Saurabh Tara

Paul J Leach

Mark Fishel Novak

Arun K Nanda

Nir Ben Zvi

Sunil P Gottumukkala

Pranav Kukreja

Yifan Wang

David McPherson

Ramaswamy Ranganathan

Arun Upadhyaya Kishan

John Michael Sheehan

David Benson Cross

Jonathan D Schwartz

Philip Joseph Hallin

Fiaz Hossain

David Charles LeBlanc

Kinshumann Kinshumann

Yogesh A Mehta

Kelvin Shek Yiu

Gopinathan Kannan

Md Nazmus Sakib

Juan-Lee Pang

Kinshuman Kinshumann

Dave M McPherson

Jignesh Shah

Geir Olsen

Karanbir Singh

Salahuddin Khan

Ryan M Hurst

Monica Ioana Ene-Pietrosanu

Deskin M Miller

Avi Ben-Menahem

Aleksandr Radutskiy

Jonathan M Andes

Crispin Cowan

Arnold Paul Pereira

Jagadeesh Kunda

Sainath Narendranath Thadkal

Kamran Riaz Khan

Ming Tang

Andrey Popov

Aman Gulati

Ariel Anant Chavan

Greg Domzalski

Qian Han

Sridhar Dutta

Gage David Laufenberg

Adam Damiano

Michael D Ward

A method may include collecting sensor data related to a quality of health of a patient. The method may include receiving patient input in response to a minimum number of questions for high statistical measurement of three health dimensions of the patient. The method may include generating a health score for each of three health dimensions of the patient. The method may include categorizing the health score for each of the three health dimensions. The method may include determining a minimum category of questions for high statistical measurement of each category of the three health dimensions. The method may include quantifying each of the three health dimensions of the patient per a VAS health score. The method may include generating a health risk score that is based on the health score for each of the three health dimensions. The method may include providing a health risk result to a care-provider.

Health risk score for risk stratification and compliance monitoring for next best action

Examples include a system and computer-implemented method to create a cloud native workload identity (CNWI) and assign the CNWI to an instance of a workload to be instantiated in a cloud computing environment of a cloud service provider (CSP); translate the CNWI into a cloud agnostic workload identity (CAWI) and assign the CAWI to the workload instance; and use the CAWI by the workload instance to communicate with other workloads in the same or a different CSP.

Cloud agnostic workload identity

A method may include collecting sensor data and patient data. The method may include receiving input from a patient that provides a quantification of a present health risk assessment of the patient using minimum clicks in minimum categories using a VAS. The method may include receiving patient input including both manual input and sensor output in response to one or more questions directed to a quality of health of the patient. The method may include generating a CCB score with a pre-defined risk stratification. The CCB score may be based on at least two of the patient data, the sensor data, and the patient input. The method may include generating a CCB result. The CCB result may include the CCB score and a risk stratification of the patient based on the pre-defined risk stratification and the CCB score. The method may include providing a CCB result to a care-provider.

Next best action based by quantifying chronic disease burden on a patient and their willingness to take that action

Techniques are disclosed relating to generating authentication information independent of user input. In some embodiments, an authentication application repeatedly performs operations to authenticate a client application to one or more hosts of a server system during an automated tasks. In some such embodiments, an instance of the operations includes receiving, from the client application, a request to generate authentication information. In response to the request, the authentication application may retrieve authentication data for the user and, independent of user input, generate an item of authentication information based on the authentication data. The authentication application may then output the item of authentication information to the client application, where the item of authentication information is usable by the client application to authenticate to at least one of the one or more hosts.

Generating authentication information independent of user input

A data protection policy can specify which applications are allowed and/or dis-allowed from accessing cloud data that is subject to a data protection policy (i.e., data that has been assigned a classification and/or an owner.) To enforce that policy, the operating system (or other trusted entity) that stores or caches access credentials only provides these credentials to applications that are allowed by the policy. In this manner, because they are not provided with the credentials required to access the network resource, the dis-allowed applications cannot access the 'protected' data thereby helping prevent these dis-allowed (or non-compliant) applications from leaking data.

Data classification and access control for cloud based data

A method may include collecting sensor data related to health of a patient and receiving input that provides quantification of health of the patient. The method may include generating a first marker based on the sensor data and/or the quantification of the health of the patient including a first dimension indicative of additional examination to be performed. The method may include generating a second marker based on one or more risk algorithms including a second dimension indicative of an acute assessment of issues related to the health of the patient. The method may include comparing the first and/or second markers to a first or second marker baseline. The method may include generating a health result based on the comparison of the first and/or second marker to the first or second marker baseline and providing an alert to a care-provider that includes the health result.

Graded escalation based triage

A system may identify resources such as applications or network locations that are not adequately covered by an enterprise's security policy to notify a network administrator of such deficiencies. An exemplary security policy may allow or deny access to individual functional resources (e.g. computing devices and/or applications) or groups of functional resources to individual data resources (e.g. enterprise network storage locations and/or enterprise data) or groups of data resources. The system may monitor enterprise network activity to identify when a security policy fails to define permissions corresponding to the use of particular resources. In response to identifying such gaps in the security policy, the system may enter policy enforcement event information into a policy learning log. The system may further generate a policy gap notification and transmit this notification to a policy management service to prompt a network administrator to take remedial action if appropriate.

Incremental security policy development for an enterprise network

A data protection policy can specify which applications are allowed and/or dis-allowed from accessing cloud data that is subject to a data protection policy (i.e., data that has been assigned a classification and/or an owner.) To enforce that policy, the operating system (or other trusted entity) that stores or caches access credentials only provides these credentials to applications that are allowed by the policy. In this manner, because they are not provided with the credentials required to access the network resource, the dis-allowed applications cannot access the 'protected' data thereby helping prevent these dis-allowed (or noncompliant) applications from leaking data.

A system for changing policy information of a process is provided. When a process is to execute, the system stores policy information for the process in association with the process code. The system also creates a token for the process. The token provides evidence of the policy for the process and includes at least a reference to the stored policy information. The system provides the token to the process for use by the process as evidence of the policy for the process. When the process provides the token to a service provider, the service provider uses the reference to access the policy information for the process. While the process is executing, the system modifies the stored policy information. When the process subsequently provides the token to a service provider, the service provider uses the reference to access the modified policy information for the process.

Dynamic updating of process policies

A method and system for providing a multi-user application executing in a user privilege mode with access to resources of multiple users is described. The multi-user application identifies a first user and a second user of the multi-user application. The multi-user application retrieves an access token for the first user and an access token for the second user. Each access token provides evidence of authorization to access a resource in accordance with access rights of the user. The multi-user application accesses resources by providing one of the access tokens as evidence of authorization to access the resource in accordance with the access rights of the user. The multi-user application can thus access resources of multiple users without having to execute in a system privilege mode.

Multi-user application executing in user privilege mode

Aspects of the technology described herein can provide enhanced metadata to authentically report the provenance of a file. An exemplary computing device may have a file broker to receive an indication from a first security principal to write a file to a file system. The file broker can use one file utility to write the file, but use another file utility to write an identification of the first security principal and its opinion about the file into metadata associated with the file. Subsequently, the identification of the first security principal and its opinion may be used to authentically report the provenance of the file and applied in other security applications.

Enhanced metadata to authentically report the provenance of a file

Single sign-on techniques via an application or browser are described. In one or more implementations, a single instance of entry of authentication information is received that is entered via interaction with an application or browser of a computing device. Responsive to this receipt, the single instance of the entry of authentication information is used by the computing device automatically and without user intervention to cause authentication to obtain access to one or more network services that are accessible via a network by the application and the browser.

Single sign-on via application or browser

The techniques and systems described herein present various implementations of a model for authenticating processes for execution and specifying and enforcing permission restrictions on system resources for processes and users. In some implementations, a binary file for an application, program, or process may be augmented to include a digital signature encrypted with a key such that an operating system may subsequently authenticate the digital signature. Once the binary file has been authenticated, the operating system may create a process and tag the process with metadata indicating the type of permissions that are allowed for the process. The metadata may correspond to a particular access level for specifying resource permissions.

Process authentication and resource permissions

Resource authorization policies and resource scopes may be defined separately, thereby decoupling a set of authorization rules from the scope of resources to which those rules apply. In one example, a resource includes anything that can be used in a computing environment (e.g., a file, a device, etc.). A scope describes a set of resources (e.g., all files in folder X, all files labeled 'Y', etc.). Policies describe what can be done with a resource (e.g., 'read-only,' &#x201c;read/write,&#x201d; &#x201c;delete, if requestor is a member of the admin group,&#x201d; etc.). When scopes and policies have been defined, they may be linked, thereby indicating that the policy applies to any resource within the scope. When a request for the resource is made, the request is evaluated against all policies associated with scopes that contain the resource. If the conditions specified in the policies apply, then the request may be granted.

Scoped resource authorization policies

A policy that governs access to a resource may be tested against real-world access requests before being used to control access to the resource. In one example, access to a resource is governed by a policy, referred to as an effective policy. When the policy is to be modified or replaced, the modification or replacement may become a test policy. When a request is made to access the resource, the request may be evaluated under both the effective policy and the test policy. Whether access is granted is determined under the effective policy, but the decision that would be made under the test policy is noted, and may be logged. If the test policy is determined to behave acceptably when confronted with real-world access requests, then the current effective policy may be replaced with the test policy.

Testing access policies

Growing community of inventors

Kirkland, WA, United States of America

Vishal Agarwal