Skyport Systems, Inc.

Cisco Technology, Inc.

Big Switch Networks, Inc.

Edward Ronald Swierk

Philippe Lacroute

William Norman Eatherton

Stefan Alexander Dyckerhoff

Thomas John Giuli

Robert Stephen Rodgers

Keith Eric Holleman

Srivatsan Rajagopal

Michael John Beesley

Neil Vincent Geraghty

Paul Edward Fraley

Vijay Krishnaji Tapaskar

Daniel Sergeevich Selifonov

Keith Anthony Low

Guido Appenzeller

Munish Mehta

Ranganath Rao

In general, embodiments of the invention relate managing the interaction of applications with one or more file systems and/or data managed by the file systems. More specifically, embodiments of the invention relate to providing applications with access to an overlay file system (OFS) and then servicing OFS operations using a file system module and one or more underlay file systems (UFSes) that are not directly accessible to the applications.

Method and system for managing file system access and interaction

A method and system for deploying applications. The method includes deploying an application image of an application to a computing device, where the application is accessible using a first uniform resource locator (URL). The method also includes sending an application creation message to an authoritative domain name system (DNS) server to create a record mapping the first URL to a second URL. The first URL is in a first domain and the second URL is in a second domain. The method further includes providing, to the computing device, a digital certificate associated with the application. The method further includes generating certificate data using the digital certificate and sending, to a remote application server, the second URL and certificate data. A client software module may establish a connection to the application on the computing device using the second URL and the certificate data.

Method and system for software application deployment

A method and system for verifying integrity of computing devices. The method includes providing a first integrity associated with a server executing on a computing device to a management service, and receiving, in response to providing the first integrity measurement, a first mutual attestation value from the management service. The method further includes providing a second integrity associated with a network adaptor executing on a computing device to a management service, and receiving, in response to providing the second integrity measurement, a second mutual attestation value from the management service. The method further includes performing a mutual attestation between the server and the network adaptor using the first mutual attestation value and the second mutual attestation value, and notifying the management service that the mutual attestation has been successfully completed.

Method and system for verifying the integrity of computing devices

A method and system for configuring computing devices. The method includes receiving, by a computing device, a first cache list object from a management service. The method also includes comparing the first cache list object to a second cache list object on the computing device, and based on the comparing, identifying a first object fingerprint that is present in the first cache list object and that is not present in the second cache list object. The method further includes obtaining, from a location that is external to the computing device, a first object corresponding to the first object fingerprint; and updating a configuration of the computing device using the first object.

Method and system for configuring computing devices

A method and system for authenticating applications. The method includes receiving, by a service virtual machine (SVM), a secret from a management service. The SVM is executing on a computing device. The method also includes providing, by the SVM, the secret to an application executing on an application virtual machine (AVM). The AVM is executing on the computing device. The method further includes providing, by the application, the secret to a remote application server in order for the remote application server to authenticate the application.

Method and system for authentication by intermediaries

A method and system for key management. The method includes receiving, by a control domain on a server, a request for a tenant key, and obtaining an authorization secret from a management service, where the management service is external to the server. The method further includes, in response to the request, decrypting, after obtaining the authorization secret, an encrypted platform master key to obtain a platform master key, decrypting an encrypted tenant key to obtain the tenant key using the platform master key, and providing the tenant key to an entity that issued the request.

Method and system for key management

In general, embodiments of the invention relate to a method and system for managing network access for applications. More specifically, embodiments of the invention provide mock Internet Protocol (IP) addresses to the applications, where the applications may use the mock IP addresses to communicate with other systems (e.g., other computing devices, the management service, or any other system that is accessible via the network). Each mock IP address may be associated with one or more policies, where the policies dictate how packets that includes the mock IP address are processed. In one or more embodiments of the invention, the mock IP addresses may be used to maintain a class of service (CoS) between applications executing on the computing devices and an application service provider (ASP).

Method and system for managing class of service in a network

In general, embodiments of the invention relate to a method and system for managing network access for applications. More specifically, embodiments of the invention provide mock Internet Protocol (IP) addresses to the applications, where the applications may use the mock IP address to communicate with other systems. Each mock IP address may be associated with one or more policies, where the policies dictate how packets that include the mock IP address is processed.

Method and system for managing network access

A method and system for accessing local resources. The method includes intercepting, by a proxy, a request from an application to access a local resource, where the application is executing in an application virtual machine (AVM) on a computing device and where the proxy is executing on a service virtual machine (SVM) on the computing device. The method further includes replacing, by the proxy, a placeholder credential in the request with a local resource credential to obtain a second request. The method also includes sending, by the proxy, the second request to the local resource, receiving, by the proxy, a response to the second request from the local resource, and providing the response to the application.

Method and system for protecting credentials

A network may include switches that have controller clients that are controlled from one or more controller servers. Clusters of the switches that have the controller clients may be isolated from other clusters by switches without the controller clients. The controller server may use graph searches to identify the clusters. The controller server may use information on the cluster topology of switches containing controller clients along with information in per-switch forwarding databases to generate per-cluster forwarding databases. The controller server may use the per-cluster forwarding databases in generating flow tables for the network switches that direct the switches to forward packets along desired paths through the network.

Methods for determining network topologies

A packet forwarding network may include switches that perform network forwarding operations to forward network traffic between end hosts that are coupled to the packet forwarding network. An analysis network that is controlled by a controller may be coupled to the packet forwarding network. The analysis network and the packet forwarding network may overlap. Switches such as hybrid switches in the overlapping network portions may be controlled by the controller to copy network packets without interfering with the network forwarding operations of the packet forwarding network. The analysis network may include a central portion to which analysis tools are coupled and one or more isolated portions. The controller may control the client switches of the central portion and the isolated portions to establish tunneling paths through the forwarding network.

Growing community of inventors

Mountain View, CA, United States of America

Edward Ronald Swierk