Microsoft Technology Licensing, LLC

Yoganand Rajasekaran

Ayla Kol

Kameshwar Jayaraman

Parul Manek

Ganesh Pandey

Brijesh Bhupendra Desai

Benjamin Du

Mainul Mizan

Raquibur Rahman

Philip Ross Moyer

Zijun Hao

Ramarathnam R Venkatesan

Ganesh Ananthanarayanan

Yuanchao Shu

Priyanshu Kumar Jha

Girish Nagaraja

Kiran Muthabatulla

Paul Howard Rich

Soumit Rahman

Yeshua Garcia

Jaclynn Hiranaka

Curtis Thibault

Nikhil Aggarwal

Ajay Kalidindi

The techniques described herein use an edge device to manage the security for a data stream being ingested by a tenant and a cloud platform. The creation of the data stream for ingestion occurs in an environment that is trusted by a tenant (e.g., an on-premises enterprise network). The cloud platform that is part of the data stream ingestion process is outside this trusted environment, and thus, the tenant loses an element of security when ingesting data streams for cloud storage and/or cloud processing. Accordingly, the edge device is configured on a trust boundary so that the data stream ingestion process associated with a cloud platform is secured, or trusted by the tenant. The edge device is configured to encrypt the data stream using a data encryption key and/or manage the protection of the data encryption key.

Secure data ingestion with edge computing

A secure investigation platform in a sovereign cloud includes a request processing system that receives requests to investigate an incident. A control message processing system creates a workspace, within the sovereign cloud, so that an investigation can be conducted within that workspace. An investigation pack, which includes investigative resources used in the investigation, is identified and the workspace is pre-configured with the identified investigation pack. The control message processing system performs investigation tasks within the workspace using the investigation pack.

Secure incident investigation workspace generation and investigation control

A secure investigation platform in a sovereign cloud includes a request processing system that receives requests to investigate an incident. A control message processing system creates a workspace, within the sovereign cloud, so that an investigation can be conducted within that workspace. The control message processing system performs investigation tasks within the workspace. A secure log generation system captures information corresponding to the tasks and generates an event record based on the captured information.

Secure incident investigation event capture

A request to perform a command or operation on a computing system is received from a support user. A clearance level needed to perform that requested command or operation is identified, and a data store that has a pool of cleared users is accessed to identify a cleared user that has an adequate clearance level. The secured user is assigned to the request. A risk level, corresponding to the requested command or operation is identified and surfaced for the secured user. The requested command or operation can be automatically executed, after it is authorized by the secured user.

Cleared user facilitation and control system

A secure investigation platform in a sovereign cloud includes a request processing system that is a user-facing system and receives requests to prepare for an incident investigation. A control message processing system creates a workspace, within the sovereign cloud, so that an investigation can be conducted within that workspace. The request processing system does not access the workspace and the control message processing system is not available for external access by a user. Data and functionality are ingested into the workspace. The control message processing system performs investigation preparation tasks within the workspace. The results of the investigation tasks are surfaced for user access.

Secure investigations platform

Systems, methods, and software technology for managing keys used to encrypt data at-rest and decrypt the data when serving requests for the data. In an implementation, a data service receives a request for data that has been encrypted at rest using a data key, wherein the data key has been encrypted using a policy key, and wherein the policy key has been encrypted using a root key. When the root key is unavailable, the data service requests a key service to decrypt the policy key using an alternative root key. When the data service receives the policy key in an unencrypted state from the key service, it decrypts the data key using the policy key and decrypts the data using the data key.

Enhanced key availability for data services

Growing community of inventors

Bothell, WA, United States of America

Yoganand Rajasekaran