Microsoft Technology Licensing, LLC

Yizhong Wu

Na Li

Jun Shi

Prasanna Chromepet Padmanabhan

Yongyu Chen

Yan Zhang

Yu Xia

Yu Zhang

Somesh Goel

Christian Cruz Montoya

Wei Deng

Pin Sun

Xiangyi Deng

Yiteng Yu

Jonathan Shi

Suyin Liu

Jie Liu

Honglu Chen

Xuling Luo

Minming Guo

Weijian Wang

Rongbin Han

This disclosure relates to a context enforcement system that efficiently and securely protects tenant context information that travels across microservices in a multi-tenant distributed cloud computing system and protects against data leaks that often occur in conventional microservice management systems. For example, the context enforcement system ensures secure external and internal communications and context isolation by providing various shared library functions to microservices of a multi-tenant distributed cloud computing system. Additionally, the shared library provided by the context enforcement system improves the efficiency of the multi-tenant distributed cloud computing system by allowing microservices to focus on target operations rather than also maintaining and performing additional redundant functions.

End-to-end context isolation across microservices in a multi-tenant distributed cloud infrastructure

The present disclosure relates to implementing, updating, and managing operation of a client agent on a client device (e.g., computing device, virtual device) in a way that enables isolation of features and functionality while also allowing the client agent to self-heal and intelligently update discrete features thereon. The client agent includes a collection of plugins that are isolated and run in accordance with respective plugin policies. The client agent makes use of device-level, agent-level, and plugin-level health monitors that collectively monitor a health status of discrete components of the client agent in a way that enables the client agent to selectively discontinue scheduling certain plugins without interrupting functionality of other plugins or of the client agent as a whole. Indeed, features described herein enable the client agent to intelligently update and self-heal with respect to individual plugins based on information obtained by the respective health monitors.

Implementing a policy-based agent with plugin infrastructure

A computer implemented method includes granting a tenant administrator client machine access to a cloud hosted tenant service joined to a directory service. A bulk token for the tenant is obtained in response to a request received from the tenant administrator client machine. An identifier of an authorized tenant client to the cloud hosted tenant service is received and results in the provisioning of a tenant client virtual machine in a cloud service for the authorized tenant client in accordance with a specified provisioning package associated with the bulk token. The tenant client virtual machine is then joined to the directory service. On receipt of an authorized client token at the cloud hosted tenant service from a tenant client machine, the tenant client machine is provided a connection to the tenant client virtual machine.

Virtual machine provisioning and directory service management

The present technology provides a method to regenerate secrets while a version of the system is operational, thus avoiding the loss of availability that would have resulted from a system shutdown. The technology described herein may work in a computing context that assigns a first secret in an active role and a second secret in the backup role. The technology described herein activates a second instance of the service with the key not being regenerated serving as the active key. The second instance is then moved to the production mode and the first version of the service is moved to the staging mode. A new secret is generated and then assigned to the first instance of the service while it runs in the staging mode. Once the secret rotation is complete, the primary service instance is then moved back to the production mode with the new key configuration.

Secret rotation in a cloud service

Growing community of inventors

Shanghai, China

Yizhong Wu