International Business Machines Corporation

Cisco Technology, Inc.

Actona Technologies Ltd.

Etai Lev Ran

Dean Har'el Lorenz

Renato John Recio

Vita Bortnikov

Idan Zach

Eran Gampel

Gal Sagi

Ravinder Reddy Amanaganti

Ryan Moats

Israel Cidon

Shahar Glixman

Daniel Kaminsky

Israel Ben Shaul

Danit Ben Kiki

Ajit Sanzgiri

Alexey Roytman

Su Liu

Itzhack Goldberg

Li Li

Katherine Barabash

Dan Li

Zvi Cahana

Maxim S Martynov

Qiwen Zhang

Gideon Glass

Michal Malka

Barnabas Kadlecsik

Dean Har′el Lorenz

A computer-implemented method, according to one approach, includes: receiving a tunnel request at a service cluster from a client at a remote cluster. The received tunnel request includes metadata associated with the client at the remote cluster. The computer-implemented method further includes using the metadata to establish a surrogate pod at the service cluster that replicates the client at the remote cluster. A tunnel identifier corresponding to the established surrogate pod is returned to the remote cluster. Moreover, in response to receiving a service request that includes the tunnel identifier, the service request is directed to the surrogate pod.

Conveying contextual information across clusters

A secure communication tunnel between user space software and a client device can be established. A private session key can be communicated from the user space software to a network communication device in at least one User Datagram Protocol datagram. Outbound session backets can be communicated from the user space software to the network communication device. The network communication device can generate encrypted outbound session packets by encrypting the outbound session packets using the private session key; communicate, to the client device via the secured communication tunnel, the encrypted outbound session packets; receive, by the network communication device from the client device, via the secured communication tunnel, inbound session packets; generate, by the network communication device, decrypted inbound session packets by decrypting the inbound session packets using the private session key; and communicate, from the network communication device to the user space software, the decrypted inbound session packets.

Distribution of private session key to network communication device for secured communications

A secure communication tunnel between user space software and a client device can be established. A private session key can be communicated from the user space software to a network communication device via an application programming interface. Outbound session packets can be communicated from the user space software to the network communication device. The network communication device can generate encrypted outbound session packets by encrypting the outbound session packets using the private session key; communicate to the client device, via the secured communication tunnel, the encrypted outbound session packets; receive, by the network communication device from the client device, via the secured communication tunnel, inbound session packets; generate decrypted inbound session packets by decrypting the inbound session packets using the private session key; and communicate the decrypted inbound session packets.

API based distribution of private session key to network communication device for secured communications

A secure communication tunnel between user space software and a client device can be established. A private session key can be accessed from a cryptographic service. The private session key can be communicated from the user space software to a network communication device. Outbound session packets can be communicated from the user space software to the network communication device. The network communication device can be configured to generate encrypted outbound session packets by encrypting the outbound session packets using the private session key; communicate to the client device, via the secured communication tunnel, the encrypted outbound session packets; receive from the client device, via the secured communication tunnel, inbound session packets; generate decrypted inbound session packets by decrypting the inbound session packets using the private session key; and communicate the decrypted inbound session packets.

Distribution of a cryptographic service provided private session key to network communication device for secured communications

Various embodiments are directed to receiving, at a receiving device, a packet from a node in a first network. determining a version identifier for the packet, encoding the version identifier into the packet, and transmitting the packet containing the encoded version identifier to a load balancing device in a second network. The version identifier may be encoded into a destination port field of the packet. The receiving device may be a perimeter network address translation device. The packet is received at the load balancing device, where the version identifier is extracted and a hash of source address information is performed. The version and hash are used to select a back-end device in the second network. The packet is transmitted to the selected back-end device.

In-packet version tagging utilizing a perimeter NAT

A method and a system for checking permissions compatibility between a configuration management system and an orchestration system of a computing cluster are disclosed. The method comprises: identifying a request to approve a change in at least one file of the computing cluster. Retrieving from a repository of the configuration management system an identity of a user for performing the change. Acquiring a denial response or an approval response received in response to a query provisioned to the orchestration system, the query is for rights to change the at least one file using the identity of the user. In response to the approval response, entering the approval response, into the configuration management system for confirming the checking permissions compatibility is approved. In response to the denial received, sending a message to the configuration management system, the message is indicative that the checking permissions compatibility is not approved.

Method and system for checking permissions compatibility between a configuration management system and an orchestration system of a computing cluster

A data security method may include storing user data to a first device and storing metadata corresponding to the user data to a second device. The method may further include making a first determination that at least one device selected from the group of the first device and the second device is not in communication with a third device. The method may further include disabling utilization of the user data in response to the first determination.

Data security through physical separation of data

A method for enabling access to a data resource, which is held on a file server () on a first local area network (LAN) (), by a client () on a second LAN (). A proxy receiver () on the second LAN () intercepts a request for the data resource submitted by the client () and transmits a message via a wide area network (WAN) () to a proxy transmitter () on the first LAN (), requesting the data resource. The proxy transmitter () retrieves a replica of the data resource from the file server () and conveys the replica of the data resource over the WAN () to the proxy receiver (), which serves the replica of the data resource from the proxy receiver () to the client () over the second LAN ().

Virtual file-sharing network

In one embodiment, a method for providing secure communications using a proxy is provided. The proxy negotiates with a client and a server to determine a session key to use with communications between the client and the proxy and between the proxy and the server. Encrypted data may then be received from the client at the proxy. The proxy can decrypt the encrypted data for processing using the session key. In one embodiment, the decrypted data is not altered. The proxy then sends the encrypted data that was received from the client to the server without re-encrypting the data that was decrypted. Because the proxy did not alter the data in its processing of the decrypted data and the same session key is used between communications for the proxy and the server, the encrypted data stream that was received from the client can be forwarded to the server.

Reducing processing load in proxies for secure communications

A data redundancy elimination system. In particular implementations, a method includes storing in a memory one or more aggregation trees, each aggregation tree comprising one or more base chunk nodes and one or more super chunk nodes, wherein each base chunk node comprises a chunk signature and corresponding raw data, and wherein super chunk nodes correspond to child base chunk nodes and include a chunk signature; receiving a data block; dividing the data block into a plurality of base chunks, each base chunk having a degree value characterizing the occurrence probability of the base chunk; computing chunk signatures for the plurality of base chunks; applying a super chunk rule to contiguous sequences of base chunks of the plurality of base chunks to create one or more aggregation trees, wherein the super chunk rule aggregates base chunks based on the respective occurrence probabilities of the base chunks; identifying one or more nodes in the one or more created aggregation trees that match corresponding nodes of the aggregation trees in the memory; compressing the received data block based on the identified nodes; and conditionally adding the one or more created aggregation trees to the memory.

Redundancy elimination by aggregation of multiple chunks

Double-proxy remote data access system

Growing community of inventors

Nofit, Israel

Etai Lev Ran