Sophos Limited

Amit Katyal

Andrew James Thomas

Biju Ramachandra Kaimal

Venkata Suresh Reddy Obulareddy

Nikhil Bhandari

Thiyagu Rajendran

Prashil Rakeshkumar Gupta

Robert Paul Andrews

Avni Bhupendrakumar Wala

Mayur Premi

Matthew Charles Setzer

Madan Mohan Nayak

Srisakthi Subramaniam

Robert W Cook

Ramesh Kamath

In a cluster of network devices using a consensus protocol for cluster synchronization, a full software rollback is performed by backing up a cluster state on a primary instance for the cluster, and then restarting all devices at the same time from a prior partition. The primary instance can then start a cluster management service and other devices can join the cluster using the consensus state stored by the primary instance.

Software rollback of cluster of network devices

A cloud-based platform for zero trust network access (ZTNA) services provides zero trust network access as a service for multiple customers in a multi-tenant architecture. In this context, the configuration for a new ZTNA application is validated with a service proxy in a sandbox or similar environment before release by the cloud-based platform for access through a public network. As a significant advantage, this approach mitigates inadvertent conflicts or instability in a service proxy that supports other applications and customers.

Validation of ZTNA configuration for a multi-tenant proxy environment

A Transport Layer Security (TLS) handshake can be terminated early—i.e., before certificate validation—to reduce server-side demand, which can be particularly advantageous in counteracting Denial-of-Service (DOS) attacks and the like. To this end, an endpoint may provide a one-time password (OTP) in the client hello message during the initial steps of a TLS handshake or similar connection protocol. A gateway, upon receiving the client hello message, may generate its own OTP for comparison with the OTP in the client hello message. The endpoint and gateway may advantageously generate the OTP based on a secret provided by a threat management facility with a preexisting secure connection to the two entities. If the OTP provided in the client hello message and the OTP generated on the gateway are the same, then the TLS handshake may continue; otherwise, the Transmission Control Protocol (TCP) connection will be terminated by the gateway.

Early termination of secure handshakes

In one or more embodiments, an apparatus includes one or more memories and one or more processors operatively coupled to the one or more memories. The one or more processors is configured to receive a policy bundle associated with at least one tenant from a plurality of tenants, determine a policy change associated with a change between the policy bundle and a tenant policy, the policy change associated with a load value, subscribe an administration client to an administration layer server based on the tenant policy, transmit the policy change to the administration layer client, implement the policy change into an agent associated with the administration layer client, determine a system load status based on a plurality of administration layer clients and the load value, and responsive to determining the system load status exceeds a predetermined threshold, generate at least one agent associated with the at least one tenant.

Systems and methods for implementing policy changes in multi-tenant environments

Growing community of inventors

Bengaluru, India

Amit Katyal