Cisco Technology, Inc.

Jean Andrei Diaconu

Marcelo Yannuzzi

Hervé Muyal

Frank Brockners

Benjamin William Ryder

Carlos Goncalves Pereira

Hitesh S Saijpal

Marco Trinelli

Mohamed Tahar Kedjour

Sändor Szilárd Magyari

Márk Sági-Kazár

In one embodiment, a method comprises accessing information associated with a user that is trying to login to an application, generating a first session identifier corresponding to the information, sending a first notification to an authentication client that the user is trying to login using an authentication service, receiving a first request from an authentication provider for authenticating a second session identifier, determining that the second session identifier is identical to the first session identifier by comparing the second session identifier with stored first session identifier, and causing the authentication provider to patch one or more authentication tokens with the information regarding the tenant, where the one or more authentication tokens are used for accessing the application.

Multi-tenanted authentication for applications

In one embodiment, an observability and assurance service, associated with various clusters of application services for an application that are executed in a data mesh, may configure a data compliance filter for a particular application service in one of the clusters of application services according to a data compliance policy. The observability and assurance service may monitor the data and traffic associated with the particular application service, wherein the data compliance filter is applied to the traffic to restrict sensitive data in the traffic from being processed by the particular application service. The observability and assurance service may make a determination that the data compliance policy has been violated by the particular application service. The observability and assurance service may modify, based on the determination, the data compliance filter for the particular application service.

Automated data compliance and observability

In one embodiment, a device may obtain a location of an endpoint that communicates with an application service. The device may match the location of the endpoint to a data compliance policy. The device may identify sensitive data within the application service to which the data compliance policy applies. The device may configure the application service to permit the endpoint to at least one of access or send the sensitive data when permitted by the data compliance policy.

Dynamic resolution and enforcement of data compliance

In one embodiment, a device may determine a compliance status of a communication of a type of data between a first workload and a second workload based on a data compliancy policy and a verified node location of at least one of the first workload and the second workload. The device may send, based on the compliance status of the communication, an instruction for handling the communication to at least one of a node executing the first workload and a node executing the second workload.

Compliant data transfers

In one embodiment, a device may obtain an identifier of a proof of location process (PLP) and an identifier of a node where the PLP is executed. The device may receive a query from a compliance engine for a proof of location of the node where the PLP is executed. The device may identify, based on the identifier of the PLP and the identifier of the node, a physical location of the node. The device may provide, to the compliance engine, a response to the query that is indicative of the physical location of the node, wherein the compliance engine enforces one or more data compliance policies with respect to a workload executed by the node and based on the physical location of the node.

Growing community of inventors

Haute-Savoie, France

Jean Andrei Diaconu