Vmware, Inc.

Trend Micro Inc.

Suse LLC

Neuvector, Inc.

Omnissa, LLC

Provilla, Inc.

Fei Huang

Gang Duan

Liwei Ren

Shu Huang

Matthew Conover

Jairam Choudhary

Aiguo Dong

Rajesh Parekh

Dehua Tan

Gregory Tauglich

Henrik Rosendahl

Daniel James Beveridge

Zang Li

Glen K Kosaka

Yingqiang Lin

A threat level analyzer probes for one or more threats within an application container in a container system. Each threat is a vulnerability or a non-conformance with a benchmark setting. The threat level analyzer further probes for one or more threats within a host of the container service. The threat level analyzer generates a threat level assessment score based on results from the probing of the one or more threats of the application container and the one or more threats of the host, and generates a report for presentation in a user interface including the threat level assessment score and a list of threats discovered from the probe of the application container and the host. A report is transmitted by the threat level analyzer to a client device of a user for presentation in the user interface.

Vertically integrated automatic threat level determination for containers and hosts in a containerization environment

A container system monitors one or more activities of an application container in a container system by intercepting data from the one or more activities of the application container. The application container includes computer-readable instructions and initiated via a container service and isolated using operating system-level virtualization. The monitoring is performed at a layer between the app container and the container service. The container system also transmits a report of the intercepted one or more activities to a designated source. The container system inspects the intercepted one or more activities, and in response to the intercepted one or more activities violating a policy in a policy store, triggers an action specified in the policy.

Application layer data protection for containers in a containerization environment

Embodiments perform automatic document handling by retrieving icons from local document handlers or from an application volumes manager, without installing the application locally. Embodiments further perform on-demand application mounting by intercepting and suspending requests to launch applications until the appropriate virtual disk, corresponding to the application, is mounted to the disk subsystem by the application volumes manager. The application launch is then resumed.

Automatic document handling with on-demand application mounting

A policy interpreter detects that an application container has been added in a container system, and opens a stored manifest for the application container. The policy interpreter retrieves running services information regarding the application container, and generates a security policy for the application container. The security policy defines a set of actions for which the application container can perform, and the set of actions are determined using the manifest and the running service information associated with the application container. The policy interpreter loads the security policy at a security container. The security container blocks an action performed by the application container in response to determining that the action performed by the application container does not match any action in the set of actions defined in the security policy. The policy interpreter transmits the security policy to a graphical user interface container for presentation to a user via a display device.

Automatic deployment of application security policy using application manifest and dynamic process analysis in a containerization environment

Embodiments provide for application-specific provisioning of files or registry keys. As applications are installed or launched, data is recorded by an application virtualization engine, and an index is created linking the recorded data to both the application and the underlying files or registry keys. As applications are requested (e.g., launched, updated, or the like), the application virtualization engine reveals various copies of file or registry keys to the application on demand or in accordance with a policy.

Content or file based application virtualization using a cache

Examples disclosed herein provide systems, methods, and software to provide individualized applications to remote desktop sessions. In one example, a method of operating a remote desktop server to provide individualized applications to remote desktop users includes identifying a request from a user for a remote desktop session. The method further includes, in response to the request, identifying one or more applications associated with the user that are stored in at least one hidden volume, and virtually overlaying application objects associated with the one or more applications in at least one non-hidden volume. The method also provides initiating the remote desktop session with the at least one non-hidden volume accessible to the user.

Dynamic application overlay for remote desktop servers

Disclosed herein are systems, methods, and software for attaching applications to a computing device based on a file type selection. In one example, a method for operating an application attaching system to dynamically make applications available to a computing device includes identifying an application attach triggering event based on a file selection of a certain file type on the computing device. The method further includes, in response to the application attach triggering event, identifying an application within an application volume based on the certain file type. The method also includes attaching the application volume to computing device, and associating the application to the certain file type on the computing device.

Attaching applications based on file type

The various implementations described herein include systems, methods and/or devices method for applying security policies in a virtualization environment. In one aspect, the method is performed at an electronic device of a plurality of electronic devices in a computing network, the electronic device having one or more processors and memory storing instructions for execution by the one or more processors. A plurality of user-space instances is instantiated. Respective properties that characterize the user-space instances are identified, and based on the identified properties, respective security policies that define authorized or unauthorized operations and data communications for user-space instances are identified. Furthermore, the identified security policies are applied so as to detect and/or remediate violations of the identified set of security policies.

Methods and systems for applying security policies in a virtualization environment

The various implementations described herein include systems, methods and/or devices method for applying security policies in a virtualization environment. In one aspect, the method is performed at an electronic device of a plurality of electronic devices in a computing network, the electronic device having one or more processors and memory storing instructions for execution by the one or more processors. A plurality of user-space instances is instantiated. Furthermore, a security instance distinct from the plurality of user-space instances is instantiated. The security instance, which executes in user space of a respective virtual address space, monitors operations and data communications for the plurality of user-space instances. The security instance applies security policies to the monitored operations and data communications for the plurality of user-space instances so as to detect and/or remediate violations of the security policies.

Methods and systems for applying security policies in a virtualization environment using a security instance

Examples disclosed herein provide systems, methods, and software for minimizing Small Computer System Interface (SCSI) limitations on virtual machines are disclosed herein. In one example, a method of operating a volume combining system to combine volumes for a virtual machine includes identifying two or more volumes to be attached to the virtual machine. The method further provides combining the two or more volumes into a single volume, and attaching the single volume to the virtual machine.

Growing community of inventors

Fremont, CA, United States of America

Fei Huang