Mcafee, Inc.

Cellsec, Inc.

Netskope, Inc.

Digital Video Express, L.p.

Other

Dolby Laboratories Licensing Corporation

Pulse Secure, LLC

Skyhigh Security LLC

Cinea, Inc.

David Moshe Goldschlag

Karl L Ginter

Michael Bartman

Yoav Weiss

Victor Ronin

Vadim Tarnavsky

Kevin Eugene Sapp

Sven Schrecker

Prasanna Ganapathi Basavapatna

Satish Kumar Gaddala

Roman Boroday

David W Kravitz

Robert W Schumann

William P Supernor

Norm Laudermilch

David Walker

Kevin Sapp

Michael A Bergeron

Guillaume Mercier

Siu-Leong Iu

Jack Ehrhardt

Richard Vitkus

Richard Whittemore

Eric Dahl

Jeffrey Segal

Erik Dahl

Randal Eye

Thomas Siner

William Supernor

A system for providing policy-controlled communication over the Internet includes a client endpoint function that executes on a client device while coupled to a first VPN tunnel, a service endpoint function that operates a remote service of a plurality of remote services, and a mid-link server coupled to the first VPN tunnel and a second VPN tunnel. The client endpoint function includes a first VPN endpoint component, and the service endpoint function includes a second VPN endpoint component. A router component operates to route network packet traffic between the first and second VPN tunnels via a route specified by a plurality of policies, an inspection component that analyzes network packet traffic in accordance with the plurality of policies. The plurality of policies for the network packet traffic and the content mediation selected dynamically on the basis of one or more of a user, an application, an endpoint, and a session.

Policy-based network packet inspection and mediation

The invention provides a method for managing access to a network resource on a network from a mobile device, the method including the steps of intercepting a data stream from the mobile device attempting to access the network resource, extracting information from the intercepted data stream relating to at least one of the mobile device or a user of the mobile device, accessing at least one of enterprise service based information and third party information regarding at least one of the mobile device or the user of the mobile device, determining whether the mobile device is authorized to access the network resource, preparing an access decision that specifies whether the mobile device is authorized to access the network resource, and storing the access decision in a database on the network. The method may also include the step of enforcing the access decision by granting access to the mobile device to the network resource if the mobile device is determined to be authorized and denying access to the mobile device to the network resource if the mobile device is determined not to be authorized.

System and method for controlling mobile device access to a network

Systems and methods for providing policy-controlled communication over the Internet are provided. A system may include a client endpoint function configured to execute on a client device while coupled to a first VPN tunnel, a service endpoint function that operates a remote service of a plurality of remote services, a gateway server including a first VPN termination point that authenticates and terminates the first VPN tunnel, a stitcher server including a second VPN termination point that authenticates and terminates a second VPN tunnel, and a mid-link server coupled to the first VPN tunnel and the second VPN tunnel. The mid-link server may include a plurality of Access Resource Servers (ARSs), and the gateway server and the stitcher server may communicate via a network connecting the plurality of ARSs.

Mid-link server having a plurality of access resource servers for policy control

This invention provides secure, policy-based separation of data and applications on computer, especially personal computers that operate in different environments, such as those including personal applications and corporate applications, so that both types of applications can run simultaneously while complying with all required policies. The invention enables employees to use their personal devices for work purposes, or work devices for personal purposes. The secure, policy-based separation is created by dividing the data processing device into two or more 'domains,' each with its own policies. These policies may be configured by the device owner, an IT department, or other data or application owner.

Dividing a data processing device into separate security domains

Systems and methods for providing policy-controlled communication over the Internet are provided. A system may include a client endpoint function configured to execute on a client device while coupled to a first VPN tunnel, a service endpoint function that operates a remote service of a plurality of remote services, and a mid-link server coupled to the first VPN tunnel and a second VPN tunnel. The mid-link server may include an inspection component that analyzes network packet traffic in accordance with a plurality of policies. The inspection component may inspect the network packet traffic for specific content and provide instructions to a router component and/or a mediation component of the mid-link server. The instructions may be a function of at least one policy that applies to the specific content.

Inspection of network packet traffic for policy control

Systems and methods for providing policy-controlled communication over the Internet are provided. A system may include a client endpoint function configured to execute on a client device while coupled to a first VPN tunnel, a service endpoint function that operates a remote service of a plurality of remote services, and a mid-link server coupled to the first VPN tunnel and a second VPN tunnel. The client endpoint function may include a first VPN endpoint component, and the service endpoint function may include a second VPN endpoint component. The mid-link server may include a first VPN termination point that authenticates and terminates the first VPN tunnel and a second VPN termination point that authenticates and terminates the second VPN tunnel. The first VPN termination point may re-authenticate the client device based on a first characteristic of the first VPN endpoint component and/or a second characteristic of the second VPN endpoint component.

Policy-controlled authentication for internet communication

Systems and methods for policy-controlled communication over the Internet between third party client applications and remote services. A client device enforces policies on the communication between the applications and services. The communication is redirected through a mid-link server using a digitally protected tunnel. Network addresses of the client device and remote service are masked.

Mid-link policy-controlled internet communication

A query is received from a particular endpoint device identifying a particular wireless access point encountered by the particular endpoint device. Pre-existing risk assessment data is identified for the identified particular wireless access point and query result data is sent to the particular endpoint device characterizing pre-assessed risk associated with the particular wireless access point. In some instances, the query result data is generated based on the pre-existing risk assessment data. In some instances, pre-existing risk assessment data can be the result of an earlier risk assessment carried-out at least in part by an endpoint device interfacing with and testing the particular wireless access point.

Mobile risk assessment

Systems, software, and methods are provided for providing simpler and more secure ARSs that operate to separate and isolate configuration details from connecting systems by: moving most of the connection information to the easily secured ARS; requiring endpoints to initiate outbound connections to that server instead of exposing the systems to inbound connections from the internet; consolidating policy enforcement and routing decisions from the individual endpoints to an ARS; and consolidating network packet traffic filtering and monitoring in an ARS. The present invention substantially reduces the complexity of endpoint configurations by offloading most of the connection and endpoint validation, policy enforcement, information leakage management, and routing decisions from the endpoints to an ARS.

Zero trust and zero knowledge application access system

Systems and methods are described for determining whether an electronic computing device complies with the security policy for a network. One example includes receiving an electronic request signal including an electronically encoded request to allow an electronically encoded process operating on an electronic processor of the electronic computer device to establish electronic communication with a specific target electronic device or service operating on the electronic communications and data network; receiving electronically encoded information about the identity of the electronically encoded process, the electronic computing device, or the use of the electronic computing device; receiving electronically encoded policy elements for the security policy; receiving electronically encoded information about the compliance of the electronic computing device; receiving electronically encoded information related to the identity of the principal of the electronic computing device; and determining whether the electronic computing device complies with the security policy.

Authenticating and enforcing compliance of devices using external services

Methods, apparatus, systems, and non-transitory computer-readable media for managing a plurality of disparate computer application and data control policies on a computing device, especially a computing device connected to a computer network, are described. In one example, at least one policy distribution point is provided that includes least one policy distribution point including at least one information management policy. A plurality of policy enforcement points, including a first policy enforcement point operating at a first policy enforcement level, and a second enforcement point operating at second policy enforcement level, are also provided. A first policy element to the first policy enforcement point, and a second policy element to the second policy enforcement point, are allocated. A management compartment in computer memory in communication with said computing device including one or more computer applications, data, and metadata specified and controlled by the information management policy is also provided.

Automated multi-level federation and enforcement of information management policies in a device network

Growing community of inventors

Siver Spring, MD, United States of America

David Moshe Goldschlag