Zentera Systems, Inc.

Imera Systems, Inc.

Cisco Technology, Inc.

Jaushin Lee

Dileep Kumar Devireddy

Hugh Weber Holbrook

Bangalore Priyadarshan

Wei-Chin Chu

William Norman Eatherton

Hung Chuen Jason Lee

Fusun Ertemalp

Priyank Ramesh Warkhede

Quan Li

Budi Sutardja

Venkateshwar Rao Pullela

Bhushan Mangesh Kanekar

Hugh Holbrook

Chunchau Lin

Junwei Wu

Dipankar Bhattacharya

François Gautier-Le Boulch

Bangalore L Priyadarshan

A controller connects to endpoints. Profiles specify valid flows between groups of endpoints. Endpoints are provisioned according to the profiles. Provisioning includes the controller generating static routing tables. A static routing table includes an IP subnet that an endpoint will be allowed to connect to. The static routing table is programmed into a network kernel table of an OS at the endpoint. The network kernel table includes other routing information not provided by the controller. A copy is made of the network kernel table, maintained at the endpoint, and another copy is sent to the controller. The table in the OS is periodically compared with the copy of the table to detect tampering of the table in the OS. Upon detection of tampering, the tampered table in the OS is replaced with the copy of the table maintained at the endpoint and an alert is issued to the controller.

Cloud over IP session layer network

A secure virtual network platform connects two or more subnets in different or separate network domains. The secure virtual network can use the under layer physical networks in various domains as an IP forwarding fabric without changing any existing firewalls, security settings, or network topology. A first type of connection across the virtual network involves connecting server groups. A second type of connection across the virtual network involves connecting a server group to a physical network. A third type of connection across the virtual network involves connecting a physical network to another physical network.

Secure cloud fabric to connect subnets in different network domains

An application profile is provided to manage security of an application deployed across two or more cloud computing networks. A user can define in the application profile first and second server groups, a cloud chamber as including the first and second server groups, and a computing flow to the cloud chamber. A firewall rule is generated based on the computing flow. The firewall rule is distributed to the first server group of the cloud chamber. A copy of the firewall rule is distributed to the second server group of the cloud chamber. The first server group is in a first cloud computing network that is provided by a first cloud provider. The second server group is in a second cloud computing network that is provided by a second cloud provider, different from the first cloud provider.

Distributed firewall security system that extends across different cloud computing networks

A system and technique for securing communications between endpoints in a local area network (LAN) includes receiving at a first endpoint in the LAN, a request from an application to connect to a second endpoint in the LAN. Approval from a controller to establish a Secure Socket Layer (SSL) tunnel to the second endpoint is requested. Upon receiving approval from the controller, the first endpoint receives from the controller a session identifier for the SSL tunnel. The controller also distributes a copy of the session identifier to the second endpoint. After receipt of the session identifier at the first endpoint, the session identifier is forwarded from the first endpoint to the second endpoint for security authorization, and the SSL tunnel is established. The SSL tunnel extends from the first endpoint in the LAN to the second endpoint in the LAN.

Cloud over IP for enterprise hybrid cloud network and security

Cloud endpoints are secured using agents and a controller connected to the agents. A whitelist identifies components and processes of an authorized multi-tiered application for the cloud. An application profile for the application specifies valid computing flows between components of a tier and components of another tier, where components of the tier are executed at an endpoint and the other components of the other tier are executed at another endpoint. Endpoints are provisioned with static routing tables identifying at least one subnet destination. A request is received at a first endpoint to connect to a second endpoint. If the second endpoint falls within the at least one subnet destination, the controller performs one or more further security checks including checking the application profile flow, whitelist, and endpoint quarantine list. A network kernel table at an endpoint that includes the static routing table may be periodically checked to detect tampering.

Clusters of virtual network switches (VNS) and controllers are provided. The controller cluster is connected to the VNS cluster which is between first and second network domains. A request is received at a first end point in the first network domain to connect to a second end point in the second network domain. If the connection should be through a virtual network connecting the network domains, a virtual network connection is established as allowed by a controller of the controller cluster. The establishment includes initiating first outbound traffic from the first end point to a VNS of the VNS cluster and initiating second outbound traffic from the second end point to the VNS. The VNS places a payload from the first outbound traffic into a reply to the second outbound traffic.

Secure virtual network platform for enterprise hybrid cloud computing environments

An application profile specifies server groups, components, and computing flows among the server groups and components. Each computing flow may be identified as malicious or not malicious. Firewall rules are generated based on the computing flows. The firewall rules are distributed to a server group. According to the firewall rules distributed to the server group, data that is malicious is directed to another server for quarantine.

Distributed firewall security system for cloud computing environments

A data transfer profile defines the transfer of data among different domains. The data transfer profile is processed to generate data transfer rules. Subsets of the rules are distributed to the different domains. A rule can specify a folder in a particular domain in which files stored in the folder will be transferred to another domain.

Secure data transfer platform for hybrid computing environment

A secure virtual network platform connects two or more different or separate network domains. When a data packet is received at an end point in one network domain, a determination is made as to whether the data packet should be forwarded outside the virtual network platform, or transmitted via the virtual network to a destination in another network domain connected by the virtual network platform.

A file system monitoring layer is positioned between a virtual file system (VFS) encryption layer and a lower level file system layer. The file system monitoring layer stores a list of applications that are allowed to access encrypted files stored in the lower level file system. The monitoring layer receives from the VFS encryption layer a request by an application to access an encrypted file. If the application is not listed on the list, the VFS encryption layer is instructed to provide the application a denial of service. If the application is listed, the VFS encryption layer is instructed to decrypt the encrypted file for the application.

Interlocking applications and files

User input including an application profile is received. The profile specifies a first server group, a second server group, and computing flows between the first and second server groups. User input identifying at least the first server group to include in a cloud chamber is received. Internet Protocol (IP) addresses assigned to virtual machines provisioned into the first and second server groups are obtained. Based on the computing flows specified in the application profile and the IP addresses assigned to the virtual machines, a set of firewall rules are generated for each virtual machine in the cloud chamber.

Peripheral firewall system for application protection in cloud computing environments

Methods and systems are described for providing a lock-down community. In one aspect, a system comprises an indication handler component in a host node device managing a lock-down community of a computer node device, the lock-down community comprising a plurality of resources where the computer node device is configured to communicate only with a resource in the lock-down community via a network. The host node device hosts an operating system that maintains an approved resource list that identifies the plurality of resources in the lock-down community of the computer node device. The indication handler component is configured to receive an indication to update the approved resource list, wherein the indication identifies a target resource. The system also includes an update handler component configured to update the approved resource list based on the received indication, thereby modifying the lock-down community of the computer node device.

Method and system for providing lock-down communities comprising a plurality of resources

Methods, computer products, and systems are described for providing remote access to resources in a secure data center protected by at least one firewall. One method includes sending by an internal server within the secure data center a request to an external server outside of the secure data center to establish a secure data transport channel between the internal server and the external server. The request travels through at least one firewall protecting the secure data center and over a public network, a private network, and/or a second firewall. The internal server receives a reply to the request from the external server granting the request and confirming the establishment of the secure data transport channel. When a first message from the external server instructing the internal server to create a first data access point associated with a first session is received via the established secure data transport channel, the internal server instantiates the first data access point for the first session and visual data corresponding to the resources in the secure data center is sent from the first data access point to the external server via the secure data transport channel. The visual data is received by the external server and then sent to a first client associated with the first session so that the first client is provided visual access to the resources in the secure data center while the resources remain protected within the secure data center.

Method and system for providing remote access to resources in a secure data center over a network

Methods, computer products, and systems are described for providing terminal view access of a client device in a secure enterprise network. One method includes receiving a request from a first client device within the secure enterprise network and/or a second client device for providing terminal view access of the first and/or second client device to the second and/or first client device respectively. A security check on the request is performed to enforce a security policy of the secure enterprise network. When the security policy is satisfied, a secure data transport channel is established between the first client device and the second client device. Terminal view data corresponding to a desktop associated with the first and/or second client device is received from the first and/or second client device respectively via the data transport channel and is provided to the second and/or first client device respectively via the data transport channel.

Growing community of inventors

Saratoga, CA, United States of America

Jaushin Lee