Citrix Systems, Inc.

David John Otway

John Albert Bull

Zhixue Wu

Robert Van Der Linden

James Rabey

Richard Hayton

Andrew Innes

Chris Mayers

Mark James Syms

Robertus Johannes Van Der Linden

Methods and systems for creating a secure virtualization environment on a host device, without modifying the host device, the secure virtualization environment bootable from an external media device. A host computing device loads and boots a common operating system image stored on an external media device. A client agent stored on the external media device and executing in the common operating system image creates an adapted operating system image by copying the operating system of the host computing device, eliminating all unnecessary files and data and storing the adapted operating system image to the external media device. The host computing device provides a secure virtualized environment by booting the adapted operating system image.

Secure virtualization environment bootable from an external media device

A system for importing, from a host computer, a device driver into a guest computing environment provided by an external media device which does not include the device driver, includes a first computing environment, a second computing environment, a device discovery agent, a device driver discovery agent, and a device driver installation agent. A device driver associated with a device available to a first computing environment is installed on a computing device. The second computing environment is executed by a virtual machine on the computing device, based upon data retrieved from an external media device. The device discovery agent identifies a device available to the second computing environment. The device driver discovery agent determines that the installed device driver is associated with the device available to the second computing environment. The device driver installation agent imports the installed device driver into the second computing environment without user input.

Methods and systems for importing a device driver into a guest computing environment

A server transmits to a server in a server farm a request for membership in the server farm and a first nonce. The server derives a Kerberos service ticket and a Kerberos authenticator, responsive to generating a hash of the server farm name, a passphrase, the name of the server, the name of the server in the server farm, the first nonce, and a second nonce. The server transmits the Kerberos service ticket and the Kerberos authenticator to the server in the server farm. The server in the server farm authenticates the requesting server responsive to the received Kerberos service ticket and the Kerberos authenticator and a generated hash. The server in the server farm transmits, responsive to the authentication, a secret to the requesting server.

Method and system for requesting and granting membership in a server farm

A method for detecting a change in a current state of a property associated with an element of a user-interface includes the step of associating the element with a property path including a concatenation of a plurality of identifiers defining a path through a plurality of application components to a property at the end of the concatenation. The property path is mapped to a current state of the property at the end of the path. A request is received, from a local machine, for a change in a state of a property mapped to one of said plurality of concatenated identifiers defining the property path. The request for the change is sent to a remote machine. The remote machine applies the change. The local machine updates the element of the user-interface associated with the property path responsive to the change and the received regeneration.

Methods and apparatus for communicating changes between a user-interface and an executing application, using property paths

A method for enabling strong mutual authentication between two computers or devices in a communication system. A user attempting to gain access to a first computer transmits login information to the first computer. The first computer transmits a first message, including a first key encrypted by a second key, to the second computer. The first computer then transmits a second message to a third device. The second message includes the second key needed by the second computer to decrypt the first message. The third device uses the user's login information to obtain the user's private key, which the third device uses to obtain the second key. The third device transmits the second key in a third message to the second computer. The second computer then uses the second key to decrypt the first message and obtain the first key. Once the second computer obtains the first key, the second computer switches the role of the keys from the first message by encrypting the second key with the first key into a fourth message. The second computer transmits the fourth message to the server, and the first computer decrypts the fourth message using its first key. If the received second key is the same as the generated second key, the second computer is authenticated to the first computer.

Strong mutual authentication of devices

The present invention relates to a method for enabling strong mutual authentication between two computers in a communication system. A user from a client attempts to gain access to a server. The server transmits a first key encrypted by a second key to the client and a second key encrypted by a user's private key to a verifier. The verifier uses the user's login information to obtain the user's private key, which the verifier uses to obtain the second key. The verifier transmits the second key to the client and the client decrypts the first key with the second key. The client then transmits the second key encrypted by the first key to the server. If the received second key is the same as the generated second key, the client is authenticated to the server.

Described are a system and method for securely distributing session keys over a network to each node in a chain of computer system nodes. The chain of nodes recursively constructs and presents a nested request to the authentication server. The nested request includes a request from each of the nodes in the chain requiring a session key to communicate with a neighboring node. The authentication server recursively unravels the request and recursively prepares a response that includes a session key for each node that submitted a request. The response traverses the chain of nodes in the reverse order taken by the nested request to reach the authentication server. Each node receiving the response extracts the portion of the response directed to that node, and forwards the remainder of the response, if any, to the next node in the chain. Thus, with a single traversal of the chain of nodes each node receives at least one session key. The forward and reverse protocols easily generalize for any number of nodes in the chain. The protocols can employ one-way hash functions to seal requests and responses and to encode session keys.

System and method for secure distribution of digital information to a chain of computer system nodes in a network

The present invention reduces the risk of damage to data or programs in an end user computer system programmed to operate in response to an imported data stream containing one or more mobile program components from an external source. The incoming data stream is screened to identify mobile program components of that data stream. Some of the mobile program components are passed to a program execution location isolated from the end user system prior to being executed to operate in a desired manner. The execution location has an interface with the external source of the data stream and an interface with the end user system. The operation of the interface between the execution location and the end user system is programmed so that only data which has been interacted on by the program component within the execution location in a specified and controlled manner can be passed to and from the end user system.

Growing community of inventors

Cambridge, United Kingdom

David John Otway