Box Limited

International Business Machines Corporation

Benjamin John Kus

Peter Benjamin Loer

Jonathan S Fan

Matthew Self

Faizan Nabi Buzdar

Andrew Coven

Dennis Sidney Goodrow

Gregory Mitchell Toto

Jeremy Scott Spiegel

James B Evans

Amrit Tsering Williams

Jason E Mealins

Nakul Chander

Lev Kantorovskiy

Kechen Huang

Adelbert Chang

Justin Tim Peng

Karthik Shanmugasundaram

Divya Jain

Seena Burns

Jonathan Shih-Shuo Fan

Yang Hu

Anil Chaurasia

Systems and methods for deploying data processing services to operate with a cloud-based collaboration platform. Deployment of a data processing service commences upon receiving a description of a function to perform on content of the cloud-based collaboration platform. The description comprises characteristics of the function as well as characteristics of given input and characteristics of desired output. A data processing service is formed (e.g., compiled) into a collection of executable instructions that communicate with an integration layer of the cloud-based collaboration platform. The data processing service is configured to receive event data indicative of an event pertaining to a content item stored in the cloud-based collaboration platform, and to then process the event data to determine at least one aspect of the input and at least one aspect of the output. The portion of the executable instructions comprising the function are executed on the content item to produce desired output.

Deploying data processing service plug-ins into a cloud-based collaboration platform

Shared content is stored at a cloud-based collaboration platform hosted at first network domain. External data processing services are hosted at a second domain. An integration layer situated between the cloud-based collaboration platform and the external data processing services is configured to receive triggering events pertaining to content of the cloud-based collaboration platform. Based on characteristics of the content, communications with the external data processing services are initiated. The communication includes accessing network interfaces to send and receive data between the network domain of the cloud-based collaboration platform and a different network domain of the external data processing services. A plurality of rules are applied to select between a first external data processing service at a first network domain and a second external data processing service at a second domain. The selected external data processing service is invoked to produce outputs that are further processed by the cloud-based collaboration platform.

Integrating external data processing technologies with a cloud-based collaboration platform

Systems for fine-grained management of plug-ins. A method embodiment commences upon identifying a plug-in to perform a particular computing function in a computing environment. A set of configuration parameters that correspond to the particular computing function are determined. Based at least in part on the determined configuration parameters, an instance-specific plug-in management wrapper corresponding is generated. The instance-specific plug-in management wrapper includes fine-grained management controls so as to be able to observe performance characteristics, functional characteristics and other runtime characteristics of the plug-in while it operates in the computing system. When a particular plug-in is invoked, its management wrapper is automatically generated so as to encapsulate the particular plug-in. Deployment instructions are generated to instantiate the plug-in management wrapper and its encapsulated plug-in in the computing system. When the plug-in has performed its function, any measurements taken by the management wrapper are saved and the generated management wrapper is destroyed.

Plug-in management wrappers

Systems and methods for combining two or more outputs of two or more data processing services. A method embodiment commences upon receiving an event indication and a content item from a cloud-based collaboration platform. The method analyzes the event and the content item to determine two or more data processing services to apply to the content item. The method further determines a common metric to use to correlate two or more different outputs from the two or more data processing services. The method invokes both of the two or more data processing services, which in turn each generate respective outputs. Metadata that relates the respective outputs based on the common metric as well as the outputs themselves are stored for retrieval by the cloud-based collaboration platform. A query is executed to retrieve at least portions of the respective outputs and corresponding metadata. The retrieved data is correlated in a display.

Combining outputs of data processing services in a cloud-based collaboration platform

Systems and corresponding computer-implemented methods for context-based rule evaluation in an electronic data storage system are described. A request to perform an operation with respect to a resource is received from a client device, with the request including various attributes associated with the client device. At least one set of rules applicable to the operation is identified. The rules can be formed from a combination of primitives arranged to dynamically evaluate attributes associated with the resource and attributes associated with the client device. Based on the evaluation of the rule set(s), an action is identified to be performed with respect to the resource.

Access control system for enterprise cloud storage

Techniques are described for separating subdomains as part of a secure login process. For example the subdomains can correspond to an enterprise user or personal user accounts, or both. The login process involves responding to a login request with an assertion, such as for example a redirect based assertion, that includes an encrypted data structure with account and user information necessary for identification of the corresponding subdomain. The encrypted data structure includes browser-, IP address, and user-specific information to thwart a cross-site request forgery (CSRF) security vulnerability, among other things.

Method and system for secure cross-domain login

Systems and methods for secure resource access and network communication are provided. A plurality of policies are received on a client device, each policy comprising a respective resource and a respective permission for a respective action that can be performed by a user of the client device in regards to the resource. A first application, which is configured to store data in an encrypted repository on the client device, receives a request to open a resource. The first application determines that one of the policies prohibits access by the resource to the encrypted repository and, based thereon, selects a different second application to open the resource that does not have access to the encrypted repository. The second application then opens the resource.

Systems and methods for secure resource access and network communication

A client hypervisor comprises a virtual agent that runs outside of a system OS and that allows device management independent of the OS and user. The virtual agent is tied to a device and not a specific instance of the OS. Such client hypervisors expose new functionality to ease managing systems. Some of these capabilities come from the persistence and privileges outside the OS. In some embodiments of the invention, this new management functionality is exposed to allow device management via new virtualization concepts, such as multiple VMs per system, VM replacement, snapshot/rollback, etc.

Endpoint-hosted hypervisor management

Growing community of inventors

Alameda, CA, United States of America

Benjamin John Kus