Microsoft Technology Licensing, LLC

Ziv Caspi

Yosef Dinerstein

Amit Finkelstein

Avihai Lifschitz

Yifat Orlin

Alexander Sloutsky

Ron E Dar Ziv

Itai Frenkel

A generic master-slave mechanism enables a single processor of a cluster of firewall processors to define the behavior of the other processors in the cluster for a specific logical connection. The cluster of firewall processors utilizes virtual adapters representing physical adapters on other processors in the firewall cluster. This virtualization allows each cluster member to act as though it is a standalone machine that owns all local IP addresses of the entire cluster. When traffic is received by a firewall processor, the firewall processor determines if there is a master associated with the logical connection for the traffic. If so, the traffic is routed to the master. If no master is associated, in an example configuration, the receiving firewall processor becomes the master. A message traffic logical connection has a single master. A master remains the master of a logical connection until the connection is terminated.

Transparently extensible firewall cluster

Correlating activity events to identify a root cause of a process failure. Activity event data is received from a process executing on a computing device. The activity event data corresponds to a plurality of activity events. Each of the activity events has a correlation identifier, a resolution status, and an occurrence time value associated therewith. Each of the activity events are assigned to one of a plurality of event groups based on the correlation identifier of the activity event. Thereafter, at least one of the event groups is determined to have an activity event with a resolution status indicating failure of the process. One of the activity events within the determined event group is selected as a root cause activity event based on the occurrence time values. In some embodiments, the root cause activity event is identified to a user of the computing device.

Root cause problem identification through event correlation

The evaluation of a policy can be delayed until all rules criteria needed for evaluation are available. Also, new types of rules criteria can be registered without requiring changes to a rules engine. A policy manager allows rules to be evaluated and decisions made at different stages of the request handling. The policy manager facilitates interaction with the rules engine until all criteria are evaluated. The policy manager also allows modules developed by third parties to provide notification when criteria can be decided and thus complete evaluation.

Delayed policy evaluation

Growing community of inventors

Tel Aviv, Israel

Ziv Caspi