Citrix Systems, Inc.

Microsoft Technology Licensing, LLC

Microsoft Corporation

Anatoliy Panasyuk

Bradley Jay Pedersen

Martin Duursma

Terry Noel Treder

David Sean Stone

Andre Kramer

Lee Laborczfalvi

David Neil Robinson

Marc A Bloomfield

Dharshan Rangegowda

Georgy Momchilov

Geoffrey Hugh Outhred

Anil Roychoudhry

Hasan Alkhatib

Min-Chih L Earl

Abolfazl Sirjani

Pierre Semaan

Anthony Ungerman

Tom Davis, Iii

Michael Burr

Deepak Bansal

Neeraj Garg

Hans Christian Andersen

Anthony S Chavez

Venkata Somanadha Sarma Remany

Bart Kus

Robert Ciraldo

Geoffrey John Hulten

Eliot Carleton Gillum

Catharine Van Ingen

Krishna Kumar Parthasarathy

Jason Eric Brewer

Guhan Suriyanarayanan

Abhishek Shukla

Ivan Osipkov

Hasan S Alkhatib

John Scarrow

Ram Viswanathan

Morgan Asher Brown

Jeff Muir

Vijay Krishnan

Chandrasekhar Pasupuleti

Alphonse Kurian

Arpan Kumar Asthana

Chetan A Parulekar

Steve E Olsson

Ben Walters

Jiazhen Chen

Kumar S Srivastava

Erica Sui-Ching Lan

PushpRaj Agrawal

Sandeep Kumar Srivastava

Suyog Mukund Gadgil

Luis Irun-briz

Kannan Ramasubramanian

Rohan Bhattacharjee

Monika Machado Santacruz

Abolfazi Sirjani

Min-Chih Earl

Pierre Semann

According to examples, an apparatus includes a processor that receives a request from a requester apparatus to access a target apparatus. The processor may provide a token valid to the requester apparatus upon determining that the requester apparatus is authenticated to access the target apparatus, in which the token complies with and is sent via a centralized authentication and authorization protocol. The processor may also receive an access check message from the target apparatus, in which the access check message includes the token and the identity of the requester apparatus. In addition, the processor may enable the target apparatus to control access to the requester apparatus. The apparatus disclosed herein enable for the retrofitting of secure multi-factor or one-time password authentication into systems that rely on a centralized authentication and authorization protocol, such as the TACACS+ or the RADIUS protocol.

Authentication and authorization of requester apparatuses in network systems

A system and method executed by a computer server include determination that the computer server has lost network connectivity and, in response to the determination that the computer server has lost network connectivity, disabling of power to a volatile memory of the computer server. Determining that the computer server has lost network connectivity may include transmission of data to an external system and determination that a response to the data was not received from the external system. Disabling of power to the volatile memory may include transmission of a request to an operating system of the system to initiate a power-down sequence of the system.

Autonomous server protection system

Architecture that provides Internet Protocol security (IPsec) certificate exchange based on certificate attributes. An IPsec endpoint can validate the security context of another IPsec endpoint certificate by referencing certificate attributes. By facilitating IPsec certificate exchange using certificate attributes rather than solely certificate roots, it is now possible to build multiple isolated network zones using a single certificate authority rather than requiring one certificate authority per zone. Moreover, the ability to use certificate attributes during the IPsec certificate exchange can be leveraged for more focused communications such as QoS (quality of service). Certificate attributes can be utilized to identify the security context of the endpoint. The IPsec certificate use can be locked down to a single IP or group of IPs.

IP security certificate exchange based on certificate attributes

Embodiments of the invention relate to techniques for classifying received e-mails and e-mails to be sent. In some embodiments, a set of e-mail zones may be defined and e-mails may be classified into one of the plurality of zones. An indication of the zone into which an e-mail has been classified may be displayed in a visual display of the e-mail.

Zone classification of electronic mail messages

Computerized methods, systems, and computer-readable media for promoting cooperation between a first and second virtual network overlay ('overlay') are provided. The first overlay is governed by a first authority domain and includes members assigned virtual IP addresses from a first address range. The second overlay is governed by a second authority domain, which is associated with a second federation mechanism, for negotiating on behalf of the second overlay. The second federation mechanism is capable of negotiating with, or soliciting delegation of authority from, a first federation mechanism that is associated with the first authority domain. When negotiations are successful or authority is delegated, the second federation mechanism establishes a communication link between the second overlay and the first overlay or joins a member of the second overlay to the first overlay. Joining involves allocating a guest IP address from the first address range to the member.

Federation among services for supporting virtual-network overlays

Architecture that facilitates the virtual specification of a connection between physical endpoints. A network can be defined as an abstract connectivity model expressed in terms of the connectivity intent, rather than any specific technology. The connectivity model is translated into configuration settings, policies, firewall rules, etc., to implement the connectivity intent based on available physical networks and devices capabilities. The connectivity model defines the connectivity semantics of the network and controls the communication between the physical nodes in the physical network. The resultant virtual network may be a virtual overlay that is independent of the physical layer. Alternatively, the virtual overlay can also include elements and abstracts of the physical network(s). Moreover, automatic network security rules (e.g., Internet Protocol security-IPSec) can be derived from the connectivity model of the network.

Model-based virtual networking

The invention generally relates to generating a display having graphical and/or media components at a client. In one aspect, a method for generating a graphical display at a client includes transmitting output from an application program executing on a server to the client, identifying a non-textual element within the application output, retrieving a compressed data format associated with the non-textual element, and transmitting to the client the compressed data format in place of the non-textual element. In another aspect, a method for generating a media presentation at a client includes transmitting output from an application program executing on a server to the client, identifying a media stream within the application output, intercepting an original compressed data set representing at least a portion of the media stream before processing by the application program, and transmitting the original compressed data set to the client.

Methods and apparatus for generating graphical and media displays at a client

The invention relates to methods and systems for reconnecting a client and providing user authentication across a reliable and persistent communication session. The method includes providing a first connection between a client and first protocol service and a second connection between the first protocol service and a host service. The first protocol service detects a disruption in the first connection. The client re-establishes the first connection between the client and the first protocol service while maintaining the second connection between the first protocol service and the host service. The first protocol service receives a ticket associated with the client and validates the ticket. The first protocol service links the re-established first connection to the maintained second connection after the ticket is validated.

Automatically reconnecting a client across reliable and persistent communication sessions

Techniques described are capable of receiving an indication that an operating system of a computing device has entered a hibernated state and, in response, booting the computing device from a trusted environment that is unalterable by the hibernated operating system. A component stored on or accessible by the trusted environment may then perform an operation on the computing device. This operation may include scanning the device, performing a memory test on the device, or updating firmware on the device. In some instances, the computing device enters the hibernated state due to a predetermined length of user inactivity on the computing device. As such, the described techniques may perform an operation on the computing device without user interaction causing the operation.

Booting a device from a trusted environment responsive to device hibernation

The invention provides scalable, secure, and easily administerable methods and systems for providing remote access to networked resources by combing aspects of physical access limitation measures with traditional computer access limitation measures. The methods and systems utilize an enrollment administration system for specifying enrollment rules, an enrollment system configured to communicate with the enrollment administration system to permit enrolling a first networked resource if permitted by specified enrollment rules, and a remote access system for granting a user remote access to the first networked resource if the user successfully enrolled the first networked resource.

Methods and apparatus for scalable secure remote desktop access

The present invention extends to methods, systems, and computer program products for adaptive electronic message scanning. Embodiments of the invention relate to dynamically (and potentially unpredictably) varying the depth/thoroughness of classifying electronic messages to protect against undesirable message content (e.g., SPAM, viruses, digital leakage, etc.). A minimum effectiveness is maintained and, when available resources permit, can be exceeded to provide increased protection. An optimal subset of available message classification rules can be selected on a per message basis. The selection of rules is based on available system resources, minimum desired effectiveness (e.g., defined in a Service Level Agreement ('SLA')), and rule characteristics. Feedback loops can be used to optimize selected classification rule subsets.

Adaptive electronic message scanning

An apparatus and method for determining a program neighborhood of a client node in a client-server network is described. The program neighborhood of the client node includes application programs hosted by application servers on the network. The present invention enables a user of a client node to learn of these application programs. The user is not required to know where to find such applications or to manually establish links to such applications. To make the client node aware of its program neighborhood, a host server collects application-related information corresponding to application programs hosted by the servers in the network. The application-related information can include the application name, the server location of the application, minimum capabilities required of client nodes for executing the application, and those users who are authorized to use that application. User credentials are received from the client system. The user credentials are used to filter the application-related information. Information representing those application programs that are available to the client node is transmitted from the host server to the client system for display. In a Windows-based client node, the information can be represented by a graphical icon for each available application program.

Apparatus and method for determining a program neighborhood for a client node in a client-server network

The present invention extends to methods, systems, and computer program products for adaptively selecting electronic message scanning rules. Embodiments of the invention relate to dynamically (and potentially unpredictably) varying the depth/thoroughness of classifying electronic messages to protect against undesirable message content (e.g., SPAM, viruses, digital leakage, etc.). A minimum effectiveness is maintained and, when available resources permit, can be exceeded to provide increased protection. An optimal subset of available message classification rules can be selected on a per message basis. The selection of rules is based on available system resources, minimum desired effectiveness (e.g., defined in a Service Level Agreement ('SLA')), and rule characteristics. Feedback loops can be used to optimize selected classification rule subsets.

Adaptively selecting electronic message scanning rules

Growing community of inventors

Bellevue, WA, United States of America

Anatoliy Panasyuk