Sailpoint Technologies, Inc.

Virtela Technology Services Incorporated

Cameron Williams

Ryan Privette

Christopher Chad Wheeler

Joseph Nathan Zendle

Andrew John Cer

Eric Oakeson

Cory Davies

Systems and methods for network security are provided. Various embodiments issue single use certificates for validating remote endpoints access to the private network. Some embodiments use a triage zone (or triage gateway) to which remote device can calls into using a static issued certificate. However, instead of granting complete access to the virtual private network, the use of this static certificate only grants access to the triage zone where further validation of the endpoint without any access to sensitive content on the private network. The endpoint can be connected to an ID manager within the triage zone. The endpoint can then send the username and password to the ID manager that can create a single use certificate (e.g., valid for a limited period of time). While valid, the single use certificate can be used by the remote device to gain access to the production zone using a VPN tunnel.

Identity defined secure connect

Systems and methods for network security are provided. Various embodiments of the present technology provide an integrated security platform that combines PAM, CASB, identity access management, and multi-factor authentication onto one platform. This integration allows for a frictionless deployment that can be utilized by companies that may not have large teams of system administrators. As such, some embodiments provide a gateway solution and a proxy solution that is easy to deploy. The user equipment (e.g., computer, phone, point of sale terminal, etc.) can be used as a gateway. An agent can be included on each endpoint that combines gateway functionality of PAM and web rewrite and proxy functionality of a CASB deployment into an endpoint solution.

Identity security gateway agent

Various embodiments of the present technology use a combination of static and rotating access credentials to access target devices. Some embodiments start with a multi-factor authentication (MFA) token that can be used to log into the platform head-end. If approved, a landing page requesting login credentials can be presented to the user. The user can provide a username and password via landing page and select a PAM or CASB target. The system then issues a secondary access credential (e.g., a pin/token) that is unknown to the user and is placed into a vault. A dynamic credential can be dynamically generated at each request. The target device can use the static access credential from the vault and the dynamic access credential for access to the device. As such, even if the vault is comprised, the target device would be inaccessible without the dynamic token which constantly changing.

Vaultless authentication

In one example embodiment, a system and method is illustrated that includes receiving user count information that includes a user count value and an address identifier. Further, an operation is executed that includes using the user count information to determine whether a limit variable has been exceeded. An operation is executed that removes a member, identified by the address identifier, from a load balancing pool, where the limit variable has been exceed by the user count information. A further operation is shown that includes introducing a device into the load balancing pool, where the user count information is less than or equal to the difference between the limit variable value and a buffer variable.

Growing community of inventors

Denver, CO, United States of America

Cameron Williams