Vmware, Inc.

Airwatch LLC

Omnissa, LLC

Wmware, Inc.

Daniel James Beveridge

Blake Ryan Watts

Banit Agrawal

Hui Henry Li

Scott Howard Davis

Sean James Huntley

Joerg Lew

Ricky Trigalo

Mark Benson

David Ott

Marc Wayne Brotherson

Jian Mu

Akeem Lamar Jenkins

Yao Zhang

Gabriel Tarasuk-Levin

Sairam Veeraswamy

Jairam Choudhary

Anil Kumar Sharma

Raunak Ravindra Singwi

Erol Aygar

Jivan Madtha

Jonathan Clark

Fei Huang

Gerard T Murphy

Puneet Chawla

Per Olov Larsson

Nicholas Grivas

David Snowdon

Oswald Chen

Ming Zhao

Wen Jie Wang

Kiran Prakash Madnani

Matthew Conover

Nan Wang

Jayanth Gummaraju

Shengbo Teng

Vasantha Kumar Dhanasekar

Mark Peek

Andre Leibovici

Bin Guo

Wenping Fan

Nilanjan Daw

Amarnath Raghunathan

Thiruvengada Govindan Thirumal

Tony Lu

Charles Andrew Hirstius

Ed Shmookler

Mike O'Reilly

Pascal Laroche

Heath Reynolds

Sean Lambert

Neeraj Goyal

Pranay Pareek

Steve Tilkens

Yuriy Georgiev

Ramnatthan Alagappan

Hui Li

Puneet Singh Chawla

This disclosure relates generally to configuring a legacy application or service with a reconfigurable cryptographic provider capable of leveraging many different cryptographic algorithms, protocols or functions. The application or service can be configured with the reconfigurable cryptographic provider by redirecting cryptographic API calls intended for a linked static shared cryptographic library or provider to a cryptographic adapter configured to emulate responses provided by the linked static shared cryptographic library. A cryptographic adapter is also described and is configured to generate abstracted versions of the cryptographic API calls and pass them on to the reconfigurable cryptographic provider, which selects and implements an appropriate cipher solution based on the abstracted cryptographic API calls.

Cryptographic agility through link layer abstraction

Some embodiments provide a novel method for connecting one or more vehicles to a software defined wide area network (SD-WAN). The method deploys an edge router to operate in the vehicle, and configures the edge router to connect to several wireless network links (e.g., 5G cellular links) operating in the vehicle. In some embodiments, the different wireless network links are different mobile hotspot links provided by different telecommunication network providers (e.g., AT&T, Verizon, T-Mobile, Orange, etc.). The method configures the edge router to forward several data message flows from a device operating in the vehicle (e.g., a computer located in the vehicle or a machine (e.g., virtual machine, Pod, container, etc.) executing on a computer located in the vehicle) to the SD-WAN using the several telecommunications network links.

Dynamic use of multiple wireless network links to connect a vehicle to an SD-WAN

The present disclosure relates to workload placement responsive to fault. One embodiment includes instructions to remove a first host from a first cluster of a software-defined datacenter (SDDC) responsive to a determination of a fault in a hypervisor of the first host, place the first host into a second cluster of the SDDC, wherein the second cluster is designated to run stateless workloads, and add a second host to the first cluster.

Workload placement responsive to fault

A desktop is unlocked or locked using a mobile client device, such as a smart phone, tablet, smart watch, etc. The authentication mechanism of the mobile client device, such as fingerprint, facial recognition, voice recognition, username and password, is leveraged for faster, less-cumbersome user authentication on the desktop. In this vein, a client device is added to an authentication agent on the desktop, and the desktop recognizes successful attempts to access the mobile client device as a method of unlocking or locking the desktop.

Mobile device authentication

Systems and methods for setting virtual machines ('VMs') to desired configurations while the virtual machines are running. In some systems, a user can select a VM and a desired configuration. An agent can then set an attribute of the virtual machine to indicate that on guest operation system (“OS”) reboot of the VM, the VM will enter BIOS mode. The agent can also store the desired configuration in the database based on authenticating the user. When the VM reboots at a future time, the attribute can cause the VM to enter BIOS setup. The agent can be notified and can retrieve the desired configuration from a database using an identifier for the VM. Then the agent can apply the desired configuration to the VM during BIOS setup with a system process that does not require further user authentication.

Desired state configuration for virtual machines

The current document is directed a resource-exchange system that facilitates resource exchange and sharing among computing facilities. The currently disclosed methods and systems employ efficient, distributed-search methods and subsystems within distributed computer systems that include large numbers of geographically distributed data centers to locate resource-provider computing facilities that match the resource needs of resource-consumer computing-facilities based on attribute values associated with the needed resources, the resource providers, and the resource consumers. Nested-hypervisor technology is employed, in disclosed implementations, to guarantee data security for, and prevent monitoring of operational states and characteristics of, resource-consumer virtual machines and virtual applications while they execute above leased computational resources in remote computing facilities. Nested-hypervisor technology is additionally employed to facilitate installation of resource-exchange system management components in participant computing facilities as well as to guarantee data and operational security for the management components.

Use of nested hypervisors by a resource-exchange system to enhance data and operational security and to facilitate component installation

Solutions for discovering and onboarding edge devices at scale include: receiving, by a device aggregator, edge device state information including state information for a first edge device; based on at least the state information for the first edge device, configuring the first edge device to perform as a software-defined wide area network (SD-WAN) node; based on at least the edge device state information, determining a first device profile for the first edge device; and transmitting the first device profile to a workload manager. In some examples, the edge device state information includes state information for a second edge device; the second edge device is configured to perform as an SD-WAN node; and a second device profile is determined for the second edge device and transmitted to the workload manager. The workload manager allocates an SD-WAN workload among the first edge device and the second edge device.

Discovering and onboarding edge devices

The disclosure provides an approach for certificate management for cryptographic agility. Embodiments include receiving, by a cryptographic agility system, a cryptographic request related to an application. Embodiments include selecting, by the cryptographic agility system, a cryptographic technique based on contextual information associated with the cryptographic request. Embodiments include determining, by the cryptographic agility system, based on the cryptographic request, a certificate for authenticating a key related to the cryptographic technique. Embodiments include providing, by the cryptographic agility system, the certificate to an endpoint related to the cryptographic request for use in authenticating the key.

Dynamic certificate management in cryptographic agility frameworks

Embodiments perform automatic document handling by retrieving icons from local document handlers or from an application volumes manager, without installing the application locally. Embodiments further perform on-demand application mounting by intercepting and suspending requests to launch applications until the appropriate virtual disk, corresponding to the application, is mounted to the disk subsystem by the application volumes manager. The application launch is then resumed.

Automatic document handling with on-demand application mounting

The disclosure provides an approach for cryptographic agility. Embodiments include receiving a request from an application for a cryptographic operation, wherein the request is associated with a computing device. Embodiments include determining one or more resource constraints related to the computing device. Embodiments include selecting, based on the one or more resource constraints, a cryptographic technique from a plurality of cryptographic techniques associated with indications of resource requirements. Embodiments include performing the cryptographic operation using the cryptographic technique. Embodiments include providing a response to the application based on performing the cryptographic operation.

Dynamic selection and calibration of ciphers based on network and resource constraints

The current document is directed to efficient, distributed-search methods and subsystems within distributed computer systems, including computer systems distributed over multiple sets of geographically distributed data centers, each comprising multiple discrete computer systems, such as multi-processor servers. In one implementation, the distributed-search methods and subsystems are implemented locally within participating entities as well as within one or more distributed-search engines. Each search is directed, by a participant, to identify attribute-associated entities within, provided by, connected to, or otherwise accessible to a distributed computing system having attribute values specified or indicated by the search query. Certain attribute values are continuously collected and centrally stored by the one or more centralized distributed-search engines while other attribute values are obtained through information requests distributed among participating entities.

Efficient, automated distributed-search methods and systems

Computer-implemented methods, media, and systems for inter-cluster automated failover and migration of containerized workloads across edges devices are disclosed. One example method includes monitoring telemetry data received from a first software defined wide area network (SD-WAN) edge device that has a workload scheduled, where the telemetry data includes at least one of a health status of the workload or multiple runtime context elements at the first SD-WAN edge device. It is determined that a failure associated with either the first SD-WAN edge device or the workload occurs. A mode of the failure is determined. A remediation process based on the determined mode of the failure and a current state of the workload is performed.

Inter-cluster automated failover and migration of containerized workloads across edges devices

User profiles of remote desktops are managed in a crash-consistent manner. When a user logs into a remote desktop, metadata of the user profile is loaded from persistent storage while registry settings and files of the user profile are loaded asynchronously with respect to the login. During the remote desktop session, snapshots of the remote desktop image in persistent storage are generated periodically, and a change log that indicates changes to the user profile is created therefrom. The user profile stored in persistent storage is updated lazily using the change log at opportunistic times after snapshot generation. When the user logs out of the remote desktop, the user profile stored in the persistent storage is updated with any additional changes to the user profile by extracting the changes from the copy-on-write cache associated with the most recent snapshot.

Preserving user profiles across remote desktop sessions

The disclosure provides an approach for cryptographic agility. Embodiments include establishing, by a proxy component associated with a cryptographic agility system, a first secure connection with an application. Embodiments include receiving, by the proxy component, via the first secure connection, a communication from the application directed to an endpoint. Embodiments include selecting, by the cryptographic agility system, a cryptographic technique based on contextual information related to the communication. Embodiments include establishing, by the proxy component, a second secure connection with the endpoint based on the cryptographic technique. Embodiments include transmitting, by the proxy component, a secure communication to the endpoint via the second secure connection based on the communication.

Mechanism for enabling cryptographic agility in legacy applications and services

Growing community of inventors

Apollo Beach, FL, United States of America

Daniel James Beveridge