Nicira, Inc.

Salesforce, Inc.

Salesforce Com, Inc.

Vmware, Inc.

Kaushal Bansal

Uday Suresh Masurekar

Shadab Shah

Serge Maskalik

Aravind Srinivasan

Venkata Muralidhar Tejomurtula

Azeem Feroz

Dmytro Kudriavtsev

Dmytro Kashyn

Ajitesh Jain

Shouzhong Shi

Rakesh Ganapathi Karanth

Subrahmanyam Manuguri

Prabhat Singh

Jerry Pereira

Arun Kumar Jagota

James Joseph Stabile

Jingmin Zhou

Sunitha Krishna

Sameer Kurkure

Amrita Dasgupta

Anirban Sengupta

Abhishek Goliya

Igor Ganichev

Srinivas Nimmagadda

Amit Chopra

Kausum Kumar

Medhavi Dhawan

Minjal Agarwal

Radha Popuri

Vaibhav Tendulkar

Steven Peters

Jayant Jain

Anil Kv Kumar

Sachin Mohan Vaidya

Fiaz Hossain

Jonathan Smith

Amitabh B Chakrabarty

Alankar Sharma

Selim Ciraci

Amit Chakrabarty

Aman Raj

Fangchen Richard Sun

Tejas Badadare

Shashikant Anna Shinde

Sorabh Kalra

In some embodiments, a method determines a first functional domain that includes a group of security policies that have been copied from a second functional domain. Network flow data is queried to determine network traffic that is associated with a security policy in the group of security policies in the first functional domain. The method analyzes utilization of the security policy based on the network traffic. Based on the analyzing, a recommendation is generated to change the security policy in the first functional domain.

Self healing network security policy management

A method for configuring the operation of the software of a data as a service (DAAS) system during run time is described. The configuring includes receiving a match query from a customer relationship management system that transmitted the match query responsive to a user using an interface to trigger an update of records in the customer relationship management system that were previously imported from the DAAS system, querying for records in the dataset that match records in the customer relationship management system previously imported from the DAAS system, the querying configured at run time according to metadata that identifies, for records in the dataset, a field to match on and a match threshold, and producing a match query result that includes records in the dataset to be imported to update records that were previously imported from the DAAS system.

Metadata driven dataset management

Systems and methods are provided for requesting, at a service configured on a server, a public key infrastructure (PKI) generated certificate using a PKI agent, where the PKI agent stores a private key and the generated certificate in a key management service (KMS). An application layer security controller communicatively coupled to the server registers the service to enable the application layer to inspect packets. The PKI agent transmits version information for the certificates to the application layer security controller, and the PKI agent updates the certificates and keys in the KMS. The service and an application layer datapath component change the routing of packets using an overlay network and inspect at least one of the packets. The application layer datapath component decapsulates at least one packet by using the private keys and certificates retrieved from the KMS, and performs application inspection of the decapsulated packet.

Systems and methods of application layer packet inspection

Implementation(s) for multi-factor network segmentation are described. A plurality of packets at a higher layer of a network stack is processed, where at least one packet of the plurality of packets was previously determined, as part of processing the at least one packet at lower layers of the network stack, to be authorized to be processed by the higher layer. Specifically, responsive to successful authentication of a cryptographic certificate received during the handshake process, a second service is identified from the cryptographic certificate. It is determined, based on a security policy, that the second service is authorized to access the first service. Responsive to the determination, a configuration is caused such that packets sent using the source address are now authorized to be processed by the higher layer.

Multi-factor network segmentation

Systems, devices, and techniques are disclosed for maintaining service availability. Files including code written using a Domain Specific Language (DSL) for network security may be received. A knowledge graph including connections between services may be generated from the code written using the DSL in the files. A service that will have an availability issue may be determined based on the connections between services in the knowledge graph. The service that will have the availability issue may be replicated. The replication of the service that will have the availability issue may occur before the service has the availability issue.

Maintaining service availability

Some embodiments of the invention provide a novel method for specifying firewall rules. In some embodiments, the method provides the ability to specify for a particular firewall rule, a set of network nodes (also called a set of enforcement points below) at which the particular firewall should be enforced. To provide this ability, the method of some embodiments adds an extra tuple (referred to below as the AppliedTo tuple) to a firewall rule. This added AppliedTo tuple lists the set of enforcement points at which the firewall rule has to be applied (i.e., enforced).

Method and apparatus for distributing firewall rules

An online system performs predictions for real-time tasks and near real-time tasks based on available network bandwidth. A client device receives a regression based machine learning model. Responsive to receiving a task, the client device determines an available network bandwidth for the client device. If the available network bandwidth is below a threshold, the client device uses the regression based machine learning model to perform the task. If the client device determines that the network bandwidth is above the threshold, the client device extracts features of the task, serializes the extracted features, and transmits the serialized features to an online system, causing the online system to use a different machine learning model to perform the task based on the serialized features.

Real-time predictions based on machine learning models

In an example, an apparatus may include a validation module configured to identify a security policy update from a security as code repository, wherein the identified security policy update is a candidate for deployment to a production environment having a plurality of attributes defined by an infrastructure as code repository; identify, from the plurality of attributes and using the infrastructure as code repository, individual attributes that correspond to the identified security policy update, wherein the identified individual attributes are identical to a subset of the plurality of attributes; generate a test environment based on the identified individual attributes; following deployment of the identified security policy update to the test environment, check for security exceptions or availability exceptions using the test environment; and output validation results based on a result of the checking.

Incrementally validating security policy code using information from an infrastructure as code repository

Examples include maintaining a virtual pool of containers; receiving a request from a client for one of a plurality of services to performed; when the request includes client code, determining whether the request belongs to regular or priority queue based on two models; adding the request to an appropriate shard in the queue; getting the request from the selected one of the plurality of queues and assigning a container for the request from the virtual pool of containers, the client code to be executed in the container; and after the client code is executed in the container, deleting the container from the virtual pool.

Predictive allocation of ephemeral containers for cloud computing services

A method for configuring the operation of the software of a data as a service (DAAS) system during run time is described. The configuring includes at least one of configuring ingestion of a vendor dataset to produce an ingested dataset and which analysis operations to perform on the vendor dataset to produce an analyzed dataset, and the configuring also includes at least one of how to search the vendor dataset based on a search query from a customer to allow the customer to locate a new record from the vendor dataset and how to match records in the vendor dataset with a match query from the customer to provide an updated record to the customer.

A network connectivity system identifies potential connection mechanisms between datacenter entities (e.g., between service instances) on the cloud platform. The network connectivity system provides recommendations including one or more connectivity paths that are preferred with respect to one or more indicators, for example, cost, latency, or security. Specifically, the network connectivity system receives a request to configure a network connection between a first service instance and a second service instance on the cloud platform. The first service instance and the second service instance may reside within the same or different datacenters, different geographical locations, and the like. A network connectivity system identifies, from network connectivity information, one or more connectivity mechanisms for establishing connection between a first datacenter entity (e.g., first service instance) and a second datacenter entity (e.g., second service instance).

Network path recommendations for services executing on cloud platforms

Examples include a method of predictive rate limiting for performing services requested by a client in a cloud computing system. The method includes receiving a request from a client for one of a plurality of services to be performed, the client belonging to an organization; and determining a current threshold for the organization by applying a real time data model and a historical data model, the real time data model generating a first threshold at least in part by determining a number of requests received from the organization over a first preceding period of time; the historical data model generating a second threshold, the historical data model being generated by applying a machine learning model to historical data stored during processing of previous requests for the plurality of services from the organization over a second preceding period of time, the current threshold being the average of the first threshold and the second threshold. The method further includes performing the requested service when the current threshold is not exceeded; and denying the request when the current threshold is exceeded.

Predictive rate limiting system for cloud computing services

An online system performs predictions for real-time tasks and near real-time tasks that need to be performed by a deadline. A client device receives a real-time machine learning based model associated with a measure of accuracy. If the client device determines that a task can be performed using predictions having less than the specified measure of accuracy, the client device uses the real-time machine learning based model. If the client device determines that a higher level of accuracy of results is required, the client device sends a request to an online system. The online system provides a prediction along with a string representing a rationale for the prediction.

Determining rationale for a prediction of a machine learning based model

A method for visualizing network flows of a network is provided. The method monitors network flows between a group of machines in a network. The method associates identifiers with the monitored network flows. The method aggregates the monitored network flows into a set of groups based on the associated identifiers. The method displays a set of flow records for the each group of the set of groups.

Application assessment and visibility for micro-segmentation of a network deployment

Growing community of inventors

Sunnyvale, CA, United States of America

Kaushal Bansal